At 3R Creative, we believe that customer information should be protected and accessible only to authorised individuals.
This policy explains how access to personal and business information is managed within LS (Luxury Shoppe), how information is protected and how important activities are recorded.
Our aim is to ensure that customer information remains secure, private and accessible only when there is a legitimate business requirement.
Access to Information
Access to customer and business information is restricted based on an individual’s responsibilities. We follow the principle of providing only the minimum access required to perform assigned tasks.
Our access management practices
- Access is provided only to authorised users.
- Permissions are assigned based on job responsibilities.
- Sensitive customer information is restricted to users who require it.
- Access permissions are reviewed periodically.
- Unnecessary access is removed when responsibilities change or employment ends.
User Roles and Permissions
LS (Luxury Shoppe) uses role-based access controls to manage user permissions. Different users may have different levels of access depending on their responsibilities. Access may include:
- Viewing information.
- Adding new records.
- Updating existing records.
- Deleting records.
- Approving specific activities.
Access to customer information obtained through Shopify is separately restricted and is not automatically available to every user.
Account and Access Security
We implement appropriate security measures to protect user accounts and prevent unauthorised access. These measures include:
- Password protection for user accounts.
- Secure authentication and session management.
- Automatic expiration of access sessions.
- Restricted access to sensitive information.
- Immediate revocation of access when an account is no longer required.
Users are responsible for keeping their login credentials confidential and must not share their accounts with others.
Monitoring and Activity Logging
We maintain records of important activities performed within the platform to support security, accountability and investigation. These records may include:
- Creation of records.
- Updates to existing records.
- Deletion of records.
- User login and logout activities.
- Important system and integration activities.
These records help us understand important changes made within the platform and identify suspicious activities.
Customer information access
Currently, the platform records important changes to customer and business records but does not maintain a separate history of every occasion on which an individual customer record is viewed.
We recognise the importance of this functionality and plan to improve access monitoring to provide greater visibility into the use of sensitive customer information.
Protection of Customer Information
We take appropriate measures to prevent unauthorised access, disclosure or misuse of customer information. Our practices include:
- Protecting sensitive information through encryption.
- Restricting access based on user permissions.
- Using secure connections for data transmission.
- Preventing unauthorised sharing of customer information.
- Maintaining separate environments for development and production.
- Following appropriate data retention and deletion practices.
Customer information must not be copied, shared or stored in unauthorised personal devices or external services.
Employee Responsibilities
All authorised users are expected to handle customer and business information responsibly. Users must:
- Access information only when required for their work.
- Keep passwords and account credentials confidential.
- Avoid sharing customer information with unauthorised individuals.
- Never use real customer information for unauthorised testing or development.
- Report suspicious activities or accidental data exposure immediately.
Any misuse of access privileges may result in appropriate action.
Report misuse or accidental exposure
info@creative3r.com
Policy Updates
We may periodically review and update this policy to reflect changes in our services, security practices and applicable legal requirements. Any updates to this policy will be published on this page.