Privacy Policy

Name, email address, phone number, mailing address, payment information, and any other details you provide during registration or purchase

To handle your orders efficiently, including processing payments, shipping, and delivery

To provide customer service, address inquiries, and resolve issues related to our products and services

To enhance user experience, develop new features, and optimize our website's performance

To send promotional materials, updates, and offers, provided you have opted in to receive such communications. You can unsubscribe at any time

To comply with applicable laws, regulations, and legal processes

We may share your information with third-party service providers who assist us in operating our website, conducting our business, or servicing you. These providers are contractually obligated to keep your information confidential and secure

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction

We may disclose your information if required by law, in response to valid requests by public authorities, or to protect our rights, property, and safety, as well as that of our users and the public

Storing your information on secure servers protected by firewalls

Encrypting sensitive information during transmission using Secure Socket Layer (SSL) technology

Restricting access to personal data to authorized personnel only

To store your preferences and login information

To gather statistical data on how users interact with our website

To tailor our website content and offers to your interests

You can request access to the personal information we hold about you

You can request corrections to any inaccurate or incomplete information

You can request the deletion of your personal information, subject to certain legal obligations

You can object to the processing of your personal information for specific purposes, such as direct marketing

You can request a copy of your personal information in a structured, commonly used, and machine-readable format

The UAE has established a national Data Office responsible for overseeing the implementation of the PDPL, ensuring compliance, and providing guidance

Organizations may be required to appoint a DPO based on the nature and scope of their data processing activities. The DPO's role includes monitoring compliance, advising on data protection obligations, and acting as a point of contact with the Data Office

The PDPL outlines significant penalties for non-compliance, which can include fines, restrictions on data processing activities, and even suspension of business operations. The exact fines and penalties are determined based on the severity and nature of the violation

Obtaining explicit consent from data subjects is mandatory for processing personal data, except in certain lawful circumstances (e.g., performance of a contract, legal obligations, protection of vital interests)

Special provisions are in place for processing personal data of children, requiring parental consent and ensuring that data processing practices are appropriate for minors

Processing sensitive personal data (e.g., health data, biometric data) requires additional safeguards and, in many cases, explicit consent from the data subject

Encourages techniques to protect personal data by making it less identifiable

The DIFC Commissioner oversees compliance with the data protection law, provides guidance, and enforces the regulations within the DIFC

Required for organizations involved in extensive processing of personal data, or where processing involves regular and systematic monitoring of data subjects on a large scale

Mandatory for high-risk processing activities, ensuring that potential risks to data subjects are identified and mitigated

Organizations can adopt BCRs approved by the Commissioner to facilitate data transfers within corporate groups across borders

Encourages the development of codes of conduct and certification mechanisms to demonstrate compliance with the data protection principles

The ADGM Commissioner oversees the enforcement of data protection regulations within the ADGM and provides necessary guidance

Required for organizations whose core activities involve regular and systematic monitoring of data subjects on a large scale, or processing large volumes of sensitive personal data

Organizations must integrate data protection principles into their processing activities and ensure that only necessary data is processed by default

ADGM requires appropriate safeguards for data transfers, including standard contractual clauses, approved codes of conduct, or certifications

Where two or more controllers jointly determine the purposes and means of processing, they must clearly define their respective responsibilities in a transparent manner

Regularly review and audit data processing activities to ensure compliance with data protection laws and identify any potential areas of risk

Establish a risk management plan to address identified risks and outline procedures for mitigating potential data breaches

Provide ongoing training for employees on data protection principles, the importance of data security, and the specific requirements of applicable data protection laws

Conduct awareness campaigns within the organization to promote a culture of data protection and ensure that all employees understand their responsibilities

Establish an incident response team responsible for managing data breaches, including detection, containment, eradication, and recovery

Develop clear procedures for notifying the Data Office, DIFC Commissioner, or ADGM Commissioner, as well as affected data subjects, in the event of a data breach

Implement streamlined processes for handling data subject requests, such as access, rectification, erasure, and data portability, ensuring timely and efficient responses.

Maintain detailed records of all data subject requests and the actions taken to address them

Use strong encryption methods to protect personal data both when stored and when transmitted across networks

Restrict access to personal data based on employees’ roles and responsibilities, ensuring that only authorized personnel can access sensitive information

Conduct regular reviews of access controls to ensure that they remain appropriate and effective

Collect only the personal data necessary for the specified purposes and avoid excessive data collection

Establish and enforce data retention policies to ensure that personal data is not retained longer than necessary

Conduct thorough due diligence on third-party vendors and service providers to ensure they comply with data protection laws and have adequate safeguards in place