1. Who processes your data

1. The controller of personal data is WELAZA GENERAL TRADING L.L.C S.O.C, trade licence No. 972475, address: Office No. 316, Arenco Real Estate Building 4, Dubai Investment Park 1, postal code 500001, Dubai, United Arab Emirates (hereinafter Welaza, we).

2. Processing is carried out in accordance with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (hereinafter the Law).

3. This Policy applies to the welaza.com website, related applications, and all services that we provide (hereinafter the Platform).

4. The Platform operates on the technology infrastructure of Shopify. Shopify processes personal data as a processor on the basis of the Shopify Data Processing Addendum, available at shopify.com/legal/dpa. The arrangements for such processing are described in sections 6 and 7.

5. Contact for data protection matters: info@welaza.com.

2. What data we process

1. Identification data: first name, surname, date of birth, gender, language of communication.

2. Contact data: delivery address, billing address, email address, telephone number.

3. Account data: login, password hash, settings, login history.

4. Order data: contents of the order, value, status, purchase history, returns, support requests.

5. Payment data: payment method, last four digits of the card, transaction status, payment identifier. The full card number and the security code are processed by the payment provider and are not transferred to us.

6. Technical data: IP address, browser type and version, operating system, device identifiers, time zone, session data.

7. Behavioural data: pages and goods viewed, basket actions, response to mailings.

8. Marketing settings: consents and refusals in respect of communications, channels.

9. Communications: correspondence, chat messages, records of support requests.

10. We do not intentionally collect data that the Law classifies as sensitive. If you yourself disclose such information to us in a support request, for example by mentioning an intolerance to a particular ingredient, we use it solely in order to handle that specific request and do not store it in your profile.

3. Where we obtain data

1. Directly from you, on registration, when placing an order, on subscribing, when contacting support, and when leaving a review.

2. Automatically, through cookies and similar technologies when you use the Platform. Further details are set out in the Cookie Policy.

3. From third parties, namely payment providers (transaction status), carriers (delivery status), anti-fraud services, and social networks (if you log in through them).

4. Purpose and legal basis of processing

1. Where the basis is consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

2. We do not use your data for marketing communications without your consent.

1. Automated decisions

1. We apply automated checks in order to detect suspicious orders. Such a check may result in an order being delayed or cancelled.

2. You have the right to object to an automated decision and to require that it be reviewed with human involvement. To do so, please contact info@welaza.com.

3. We do not carry out profiling having legal consequences for you beyond what is described in this section.

2. To whom we disclose data

1. To the technology platform. The online store operates on Shopify. Shopify and its sub-processors process data as processors on the basis of the Shopify Data Processing Addendum. Shopify remains responsible for the acts of its sub-processors, and the current list of them is published by Shopify separately and is available at help.shopify.com/en/manual/your-account/privacy/subprocessors.

2. To providers of apps connected to the Platform. Certain functions of the Platform are provided by third-party developers’ apps, each of which processes only the data necessary for its function:

1. To the payment provider, for the purpose of processing payments and refunds and handling chargebacks.

2. To carriers, for the purpose of delivery and returns.

3. To sellers. For goods sold by Welaza, no data is transferred to a third-party seller. For goods of third-party sellers, we transfer to the seller only the data necessary in order to fulfil the order and provide warranty service; where delivery is carried out by the seller, this includes the delivery address and contact telephone number. Sellers are prohibited from using such data for their own marketing and from transferring it to third parties, other than to carriers engaged in order to fulfil the order.

4. To IT service providers, for hosting, cloud storage, and backup.

5. To professional advisers, namely lawyers, auditors, and accountants, subject to confidentiality.

6. To state authorities, on the basis of a mandatory requirement of law or a court decision.

7. To an acquirer of the business, in the event of a sale or reorganisation, provided that the level of data protection is maintained.

8. The list in clause 6.2 may change together with the set of apps connected to the Platform. The current list of recipients is available on request to info@welaza.com.

1. Transfers of data outside the UAE

1. Customers’ data is processed outside the United Arab Emirates. Shopify distributes data across several international regions and does not guarantee that the data of a particular store will be stored exclusively within the territory of the UAE.

2. The processing infrastructure is provided, in particular, by:

1. Data may be transferred and processed, in particular, in Canada, the United States of America, Ireland, Singapore, and other countries in which the companies of the Shopify group and its sub-processors operate.

2. The basis for such transfer under the Articles of the Law on cross-border transfer is the existence of a contract containing personal data protection provisions. That contract is the Shopify Data Processing Addendum, which is incorporated into the Shopify terms of service and applies to Welaza as a merchant. Shopify is obliged to enter into written contracts with its sub-processors and remains responsible for their acts.

3. For transfers between the companies of the Shopify group and its sub-processors, intra-group rules and standard contractual clauses provided for by the Shopify Data Processing Addendum apply in addition.

4. You may request information about the safeguards applied at info@welaza.com.

1. Retention periods

1. We retain data for no longer than is necessary for the purposes for which it was collected.

1. On expiry of the period, data is deleted or anonymised.

2. Following the cessation of use of the Platform, we may elect to have the data processed by Shopify deleted or returned, in the manner provided for by the Shopify Data Processing Addendum, with exceptions for cases where retention is required by law and for standard backups.

1. Your rights

1. Under the Law, you have the right:

- to obtain information about the processing of your data;

- to obtain access to your data;

- to require the rectification of inaccurate or incomplete data;

- to require the erasure of data;

- to require the restriction of processing;

- to receive your data in a structured format and transfer it to another controller;

- to object to processing, including for direct marketing purposes;

- to withdraw consent;

- to lodge a complaint with the competent UAE authority.

1. A request is to be submitted to info@welaza.com. We may ask you to confirm your identity.

2. We provide a response within the period established by law and, in the absence of such a period, within 30 days of the date of receipt of the request. Where a request is complex, the period may be extended, with notice to you of the reasons.

3. The exercise of rights is free of charge. A fee may be charged only in respect of manifestly unfounded or repetitive requests, to the extent permitted by law.

4. We may refuse to erase data where its retention is required by law, in particular for tax records or in order to protect rights in a dispute. In such a case we notify you of the ground.

1. Security

1. We apply technical and organisational protection measures, in particular encryption of the data transmission channel, role-based segregation of access, logging of actions, backup, and contractual confidentiality undertakings for providers.

2. At the level of the technology platform, the measures provided for by the Shopify Data Processing Addendum apply, in particular least-privilege access control, two-factor authentication for access to systems, vulnerability testing, and incident response procedures.

3. No system is absolutely secure. We do not guarantee absolute security, but we undertake to take reasonable and appropriate measures.

4. In the event of a personal data breach that creates a risk to your rights, we notify the competent UAE authority and, where there are grounds to do so, you personally, within the periods established by law. Shopify is obliged to notify us of a confirmed breach within the period provided for by the applicable data protection law.

2. Children

1. The Platform is not intended for persons who have not attained the age of full legal capacity under the law applicable to them, and we do not knowingly collect their data.

2. If you are a parent or guardian and believe that we have obtained a child’s data, please notify us at info@welaza.com. We will erase such data.

3. Cookies

1. The arrangements for the use of cookies and similar technologies are described in the Cookie Policy.

4. Changes to the Policy

1. We may amend this Policy. The new version is published on the Platform, stating its effective date.

2. We give additional notice of material changes, by email or by a message on the Platform.

3. Shopify may amend the Shopify Data Processing Addendum by posting a new version. This Policy therefore refers to that document rather than reproducing its content.

5. Contacts

WELAZA GENERAL TRADING L.L.C S.O.C

Address: Office No. 316, Arenco Real Estate Building 4, Dubai Investment Park 1, postal code 500001, Dubai, UAE

Email address for data protection matters: info@welaza.com

Telephone: +971 52 913 5717