Your Privacy

Privacy Policy

Last updated:

This Privacy Policy explains what personal information Luster & Co. collects when you use lusterandcompany.com, visit our Vancouver studio, or purchase from us, why we collect it, and the choices you have.

1. Who We Are

Luster & Co. Diamonds ("Luster & Co.", "we", "us", "our") is a fine jewellery retailer based in Vancouver, British Columbia, Canada. We are the organization responsible for the personal information described in this policy.

Luster & Co.
600-609 West Hastings Street
Vancouver, BC V6B 4W4
Canada

2. Information We Collect

2.1 Information you give us

  • Enquiry and callback requests: your name, phone number, email address, preferred contact time, and anything you write in the message field.
  • Appointment bookings: your name, contact details, and the details of what you would like to view or discuss.
  • Newsletter sign-up: your email address.
  • Orders and custom commissions: billing and shipping address, order contents, ring size and other sizing details, design preferences, engraving text, and correspondence about your commission.
  • Payment: payments are processed by our payment providers. We receive confirmation of payment and limited details such as the card type and last four digits. We do not store full payment card numbers on our systems.
  • Reviews and photographs: if you choose to submit a review, testimonial, or photo, the content you submit and the name you attach to it.

2.2 Information collected automatically

  • Device and usage data: IP address, browser type and version, operating system, device type, screen size, referring page, pages viewed, and the dates and times of your visit.
  • Interaction data: clicks, scroll depth, mouse movement, and similar interactions, including session replays and heatmaps captured by Microsoft Clarity (described in section 4).
  • Cookies and similar technologies: see our Cookie Policy for the full list and how to control them.

2.3 Information we do not intentionally collect

We do not ask for sensitive personal information such as government identification numbers, health information, or racial, religious, or political data. Please do not include this kind of information in free-text fields such as the enquiry message box.

Our website is not directed at children and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact us and we will delete it.

3. Why We Use Your Information

We use personal information only for the purposes below.

  • To respond to you — answering enquiries, arranging callbacks, and confirming appointments.
  • To fulfil orders — processing purchases and custom commissions, arranging insured delivery, handling exchanges, resizing, and warranty claims.
  • To provide after-sales service — maintaining a record of your piece, its certification, and its warranty history so we can service it in future.
  • To send marketing — but only where you have asked us to. See section 6.
  • To improve our website and service — understanding which pages and products are useful, diagnosing faults, and improving the browsing experience.
  • To keep our business and customers safe — preventing fraud, securing our systems, and protecting high-value merchandise in transit.
  • To meet legal obligations — including tax, accounting, consumer protection, and anti-money-laundering record-keeping requirements that apply to dealers in precious metals and stones.

3.1 Our legal basis (visitors in the UK, EU and EEA)

Where the UK GDPR or EU GDPR applies to you, we rely on the following bases: performance of a contract (fulfilling your order), consent (marketing emails and non-essential cookies, which you may withdraw at any time), legal obligation (tax and record-keeping), and legitimate interests (securing our site, preventing fraud, and understanding how our website is used — balanced against your rights).

4. Analytics, Advertising and Third-Party Services

We use a small number of third-party services that process data on our behalf or in their own right.

  • Wix — hosts our content management system, product catalogue, and store data. Wix processes order and content data on our behalf.
  • Google Analytics 4 — measures website traffic and how visitors move through the site. Data is processed by Google. You can opt out across all sites using the Google Analytics Opt-out Browser Add-on.
  • Microsoft Clarity — records anonymised session replays and heatmaps so we can see where the site is confusing or broken. Clarity automatically masks text entered into form fields, but please avoid typing sensitive information into any field regardless. See the Microsoft Privacy Statement.
  • Google Merchant Center and Google Ads — we submit our product catalogue to Google Shopping and may run advertising. This can involve advertising cookies and conversion measurement.
  • Google Workspace — our newsletter list and enquiry records are stored in Google services.
  • Shipping and courier partners — we share the name, address, and phone number needed to deliver your order and to insure it in transit.
  • Payment providers — process your payment directly and are independently responsible for the card data you enter with them.
  • Gemological laboratories (GIA and IGI) — we exchange certificate and grading report numbers, which relate to the stone rather than to you personally.

We do not sell your personal information, and we do not rent or trade our customer or newsletter lists.

5. International Transfers

Some of the providers above store or process data outside Canada, including in the United States and the European Union. Where personal information is transferred outside your jurisdiction, it may be accessible to courts, law enforcement, and regulatory authorities of that country. We take reasonable contractual and organizational steps to require comparable protection from our providers, including standard contractual clauses where applicable.

6. Marketing and Your CASL Rights

We send commercial email only to people who have signed up, or who have an existing business relationship with us as permitted by Canada's Anti-Spam Legislation (CASL). Every marketing email contains a one-click unsubscribe link and our mailing address. Unsubscribing is honoured promptly and does not affect transactional messages about an order, appointment, or warranty claim you already have with us.

You may also unsubscribe at any time by emailing info@lusterandcompany.com.

7. How Long We Keep Information

  • Enquiries that do not become orders: up to 24 months, then deleted.
  • Order, invoice, and tax records: at least 7 years, as required by Canadian tax law.
  • Warranty and service records: for the life of the warranty, because a lifetime warranty claim requires proof of the original purchase.
  • Newsletter subscription: until you unsubscribe.
  • Analytics and session replay data: retained according to each provider's default retention period, typically between 2 and 26 months.

8. How We Protect Your Information

We use HTTPS encryption across the site, restrict access to customer records to staff who need it, and rely on established providers for hosting and payment processing. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach occurs that creates a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner of Canada as required by law.

9. Your Rights

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA), you have the right to:

  • ask whether we hold personal information about you, and request access to it;
  • ask us to correct information that is inaccurate or incomplete;
  • withdraw consent to a use of your information, subject to legal and contractual limits;
  • ask us to delete information we no longer need; and
  • complain about how we have handled your information.

If the UK or EU GDPR applies to you, you additionally have rights of data portability, restriction of processing, objection to processing based on legitimate interests, and the right not to be subject to solely automated decision-making. We do not carry out automated decision-making that produces legal effects.

To exercise any of these rights, email info@lusterandcompany.com. We will respond within 30 days. We may need to verify your identity before releasing information, which protects you as much as us.

10. Complaints

Please raise any concern with us first — most issues are resolved quickly. If you are not satisfied with our response, you may contact:

11. Changes to This Policy

We may update this policy as our business or the law changes. The effective date at the top of this page always reflects the current version. If we make a significant change to how we use personal information, we will give notice on the website and, where appropriate, by email.

Contact Us

Questions about this policy? We are happy to help.