LAIZ Group ("LAIZ", "we") operates thelaiz.com, shop.thelaiz.com, and related services. This Privacy Policy explains how we collect, use, store, and share personal data when you use our websites, marketplace, news surfaces, and publisher tools.
Data we collect
We collect account information (name, email, phone), order and payment metadata, device and browser data, support messages, and optional profile preferences. Checkout and escrow records are retained for compliance, dispute resolution, and fraud prevention.
Delivery address, gate codes & courier notes
At checkout you may provide a delivery address, building or compound gate code, and free-text courier instructions. Gate codes are physical-access credentials equivalent in sensitivity to a door PIN — we treat them as confidential delivery data, not marketing information.
Encryption & storage: Gate codes and courier notes are transmitted over TLS and stored in our order database (Supabase) with encryption at rest. They are saved on the order record and, when you opt to save an address, in your account address book.
Who can access them: You; LAIZ operations staff with a legitimate fulfillment or dispute need; and LAIZ-contracted couriers assigned to your order via fleet.thelaiz.com for the active delivery window only. Couriers see gate codes and notes in the rider app while the parcel is in transit — not after delivery is confirmed.
Third parties: We do not sell gate codes or courier notes. They are shared only with subprocessors that help us operate delivery (hosting, payment, contracted last-mile partners) under data-processing agreements. We do not pass them to unrelated advertisers or data brokers. If a non-LAIZ courier partner is used for a specific route, they receive only the minimum fields needed for that delivery and must delete them when the job closes.
Retention: Gate codes and courier notes remain on the order record for up to 7 years for dispute, fraud, and tax compliance, then are archived or deleted. Saved address gate codes are removed when you delete the address or close your account (subject to legal holds). You may request earlier deletion where law allows by emailing privacy@thelaiz.com.
Visual search photos
On shop.thelaiz.com/search/visual you may upload or capture a product photo to find catalog matches. We accept JPEG, PNG, or WebP images up to 5 MB. Photos may contain identifiable people, locations, or other personal content — only upload images you have the right to share.
Images are processed in memory to describe the product and rank matches. LAIZ does not persist visual-search photos on our servers, does not use them to train LAIZ AI models, and discards them when the search completes. If OpenAI Vision is enabled, the image is sent once to OpenAI's API under their processing terms (typically not used for model training for API customers) and is not stored by LAIZ afterward. Browser previews shown on your device are cleared when you leave the page.
Seller & brand application documents
Brand sellers upload Pakistan government registration documents (SECP, FBR, NADRA CNIC, banking KYC) and brand authorization files. These are among the most sensitive data categories under Pakistan PDPA, UAE PDPL, UK GDPR, and EU GDPR.
Versioning: When you upload a new version, the previous file is retained only for the limited period below — not indefinitely.
Retention schedule: The latest accepted version of each required document is kept for the life of your seller account plus 7 years for tax, AML, and dispute obligations. Superseded versions are deleted 90 days after a newer version is accepted, or 12 months after application rejection or withdrawal — whichever is sooner. If your application is rejected, government ID copies (e.g. CNIC) are purged within 12 months unless an open dispute or regulatory hold requires longer retention.
Access & security: Documents are stored in private, access-controlled object storage with encryption at rest. Only your authorized brand users, LAIZ compliance reviewers, and auditors with a legitimate need can access them via time-limited signed URLs. They are never published on the public marketplace.
To request erasure outside this schedule, contact privacy@thelaiz.com. We may retain minimal records where law requires.
How we use data
We use personal data to operate the marketplace, process orders, provide buyer protection, improve our services, send transactional communications, and comply with legal obligations. We do not sell personal data to third parties.
Pakistan PDPA
LAIZ processes personal data in accordance with applicable Pakistani data protection requirements. Where required, data is stored in-region. Users may request access, correction, or deletion by contacting privacy@thelaiz.com.
United Arab Emirates (Federal PDPL)
If you are in the United Arab Emirates, LAIZ processes personal data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL). We collect only data necessary for marketplace operations, escrow, delivery, and fraud prevention. Processing is based on contract performance, legal obligation, legitimate interests, or your consent where required.
UAE residents may request access, correction, erasure, restriction of processing, and data portability where applicable. Cross-border transfers use appropriate safeguards (standard contractual clauses or equivalent mechanisms). To exercise rights or raise a complaint, contact privacy@thelaiz.com. You may also contact the UAE Office of Data Protection if we do not resolve your concern within a reasonable period.
United Kingdom (UK GDPR)
For users in the United Kingdom, LAIZ acts as data controller for personal data processed through thelaiz.com and shop.thelaiz.com. Lawful bases include contract, legal obligation, legitimate interests, and consent for non-essential cookies and marketing where applicable.
Under UK GDPR you have the right to access, rectify, erase, restrict processing, object to certain processing, and data portability. You may withdraw consent at any time without affecting prior lawful processing. To exercise these rights, email privacy@thelaiz.com. You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
European Union (GDPR)
If you are in the European Economic Area, LAIZ processes personal data under the General Data Protection Regulation (EU GDPR). We maintain records of processing activities, implement appropriate technical and organisational measures, and limit retention to what is necessary for orders, escrow, tax, and dispute resolution.
EU data subjects have rights of access, rectification, erasure ("right to be forgotten"), restriction, portability, and objection. Where processing is based on consent, you may withdraw it at any time. Contact privacy@thelaiz.com for requests. You may also complain to your local supervisory authority. International transfers rely on adequacy decisions or Standard Contractual Clauses.
Cookies & analytics
We use essential cookies for authentication and security. Optional analytics and marketing cookies are shown only after consent via our CookieYes banner (UK, UAE, EU, and other regions where required). You can change preferences anytime from the cookie settings control on any page, or through your browser settings.
Contact
Privacy enquiries: privacy@thelaiz.com