PRIVACY POLICY

4. PRIVACY POLICY

4.1 Data Controller

The controller responsible for personal data collected through the Website is:

BUGITEX TRADING CO. L.L.C S.O.C  
Trade licence number: 1584558  
Warehouse No. 73, Goshi Warehouse City, Al Quoz, Dubai, United Arab Emirates  
Email: misswhenceae@gmail.com  
Telephone: +971 54 554 1001  

4.2 Personal Data We Collect

Depending on how you use the Website, we may collect:

a. name, billing address and delivery address;

b. email address and telephone number;

c. account login and preference information;

d. order history, returns, exchanges and communications;

e. payment status and transaction references;

f. device type, IP address, browser information and Website activity;

g. cookie and analytics information;

h. marketing preferences; and

i. information supplied in reviews, enquiries or customer-service communications.

Complete card information is normally collected directly by the relevant payment provider and is not stored by us.

4.3 How We Collect Data

We may collect information:

a. directly from you;

b. automatically through cookies and similar technology;

c. from Shopify and applications used to operate the online store;

d. from payment providers;

e. from delivery and logistics providers; and

f. from advertising, analytics or fraud-prevention service providers.

4.4 Purposes of Processing

We use personal data to:

a. process, confirm, deliver and manage orders;

b. collect and verify payments;

c. provide digital invoices;

d. manage returns, exchanges, refunds and complaints;

e. communicate about orders and customer-service requests;

f. prevent fraud and protect the security of the Website;

g. maintain accounting, tax and business records;

h. improve Website performance, products and services;

i. personalise content, where permitted;

j. send marketing communications where consent or another lawful basis applies; and

k. comply with legal and regulatory obligations.

4.5 Lawful Processing

We process personal data where:

a. you have provided valid consent;

b. processing is necessary to take steps at your request or perform a contract with you;

c. processing is required to comply with a legal obligation;

d. processing is necessary to protect our rights, customers, systems or business; or

e. another lawful basis is available under applicable UAE law.

Where processing is based on consent, consent may be withdrawn. Withdrawal does not affect processing lawfully completed before withdrawal.

4.6 Sharing Personal Data

We may share relevant data with:

a. Shopify and providers supporting the online store;

b. payment gateways, banks and fraud-prevention providers;

c. couriers, customs brokers and logistics companies;

d. email, customer-service, analytics, hosting and marketing providers;

e. accountants, auditors, insurers and legal advisers;

f. government, regulatory, customs, tax, law-enforcement or judicial authorities where required; and

g. a purchaser or successor in connection with a lawful sale, restructuring or transfer of the business.

Service providers are permitted to use personal data only for authorised purposes and subject to applicable contractual and legal safeguards.

We do not sell personal data to advertisers.

4.7 International Data Transfers

Some service providers may process or store personal data outside the UAE. Where personal data is transferred internationally, we will use the safeguards required by applicable UAE law, such as an adequate level of protection, appropriate contractual safeguards, consent where required or another legally permitted transfer mechanism.

4.8 Data Retention

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, including order fulfilment, customer service, accounting, tax, dispute resolution, fraud prevention and legal compliance.

Data may be deleted, anonymised or securely archived when it is no longer required, subject to mandatory record-retention obligations.

4.9 Security

We use reasonable technical and organisational measures designed to protect personal data from accidental loss, unauthorised access, misuse, alteration or disclosure.

No internet or electronic-storage system can be guaranteed completely secure. Customers should use a strong password and keep account credentials confidential.

4.10 Marketing Communications

Marketing messages will be sent only where permitted by law.

You may unsubscribe by:

a. using the unsubscribe link in an email;

b. using an opt-out mechanism provided in the message; or

c. contacting misswhenceae@gmail.com.

Unsubscribing from marketing does not stop operational communications concerning an existing order, refund, security issue or legal notice.

4.11 Your Data Rights

Subject to applicable law and applicable exceptions, you may request:

a. information about the personal data being processed and the purposes of processing;

b. access to relevant personal data;

c. correction or completion of inaccurate data;

d. deletion of data that is no longer required;

e. restriction or suspension of certain processing;

f. withdrawal of consent;

g. objection to direct-marketing processing;

h. transfer of data in a structured, machine-readable form where applicable; and

i. human review of certain decisions made solely through automated processing.

Requests should be sent to misswhenceae@gmail.com. We may request reasonable information to verify identity before processing a request.

4.12 Children’s Data

The Website is not intended to knowingly collect personal data from children without appropriate parental or guardian involvement. A parent or guardian who believes that a child has provided personal data without proper authorisation should contact us.

4.13 Third-Party Websites

The Website may contain links to third-party websites or services. Their privacy practices are governed by their own policies, and we are not responsible for their independent processing activities.

4.14 Privacy Complaints

Privacy questions or complaints should first be submitted to misswhenceae@gmail.com.

Customers may also exercise any right to complain to the competent UAE data-protection or regulatory authority where available under applicable law.