This Privacy Policy explains how Aruzas collects, uses, shares, stores and protects personal data when you visit aruzas.com, create or use an account, place or receive an order, request delivery or a return, contact Customer Care, or otherwise interact with our UAE online store.

It applies to the United Arab Emirates market and should be read with our Terms and Conditions and Cookie Policy. A Product, payment provider, courier or other third-party service may also give you its own privacy information when it independently decides how to process personal data.

Aruzas Trading L.L.C-FZ (“Aruzas”, “we”, “us” or “our”) is the controller of the personal data described in this Policy, except where another organisation tells you that it acts as a separate controller.

Registered office: Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates.
Trade licence: 2542689.01, issued by Meydan Free Zone.
Privacy email: info@aruzas.com
Customer Care: +971 50 384 0328

Use the subject line Privacy Request when contacting us about personal data or exercising a privacy right.

Depending on how you interact with us, we may process the following categories:

• Identity and contact data: name, username, email address, telephone number, billing and delivery addresses, country or region, preferred language and communications.
• Account data: account identifier, protected password credential, saved addresses, preferences, account activity and sign-in or verification records.
• Order and transaction data: Products, quantities, prices, discounts, currency, order status, invoices, payment status, transaction references, refunds, chargebacks and related correspondence.
• Payment data: payment method, billing details and a provider token or limited card information such as brand and last digits where supplied by the payment provider. Full card credentials are ordinarily entered into the provider’s secure service and are not made available to Aruzas.
• Delivery, return and service data: recipient and address details, delivery instructions, courier tracking, proof or status of delivery, return reason, inspection outcome, warranty or defect information, photographs you submit and Customer Care records.
• Website and device data: IP address, browser and device information, approximate country inferred from network data, cookie or session identifiers, cart activity, pages and Products viewed, referring page, campaign or source attribution, and technical or security events.
• Preference and marketing data: country, language, communication choices, consent records, unsubscribe status and responses to communications where a marketing feature is enabled and you choose to use it.
• Compliance and fraud-prevention data: identity or transaction checks, suspected misuse, sanctions or fraud indicators, disputes, legal claims and information required by a competent authority.

We receive personal data directly from you when you complete a form, create an account, order, pay, request support, return a Product or communicate with us. We also collect limited information automatically from your browser or device through necessary cookies, session tools, server records and similar technologies.

We may receive information from payment and fraud-prevention providers, banks, couriers, fulfilment or return partners, website and hosting providers, communications platforms, accounting or invoicing services, and another person who orders for you or provides your details as a recipient.

If you provide another person’s personal data, such as a gift recipient’s delivery details, you must be authorised to do so and should make this Policy available to them.

Fields marked as required, and information reasonably necessary to verify payment, deliver an order, comply with law or resolve a request, must be provided for the relevant service. Without them, we may be unable to create an account, accept or fulfil an order, process a return or answer a request.

Other information is optional. You may browse without creating an account, shop as a guest where available, and decline optional marketing. Withdrawing an optional consent does not affect processing already carried out lawfully and does not prevent us from sending necessary service, security, order, delivery or legal messages.

Our store is not designed to collect sensitive personal data such as health, biometric, religious or political information. Please do not send it unless we specifically request it for a lawful and necessary purpose, for example to consider an accessibility need or investigate a safety incident.

If sensitive information is provided, we will limit its use, access and retention and obtain consent or rely on another basis expressly permitted by applicable law.

We use identity, contact, account, device and preference data to provide and operate the Website, create and secure accounts, remember your selected country and language, maintain your Bag and session, authenticate access, display account information and improve the reliability and accessibility of customer journeys.

Your country selection is a commercial and delivery preference. Network location may suggest a default, but you can change it. The delivery address entered at Checkout remains the final address used to test whether an order can be fulfilled.

We use order, transaction, payment, identity and contact data to present Checkout, verify availability and price, accept or reject an order, authorise and record payment, issue an invoice or credit note, send order messages, manage cancellation, refund or chargeback activity, and maintain financial and tax records.

Payment providers and banks use payment data to authorise, settle and refund transactions and may conduct their own fraud, regulatory or identity checks. Aruzas receives the result and information needed to reconcile the order, but we will never ask for your card PIN, online-banking password or one-time banking code.

We use recipient, address, contact, order and tracking information to select a delivery service, create shipment records, provide delivery updates, obtain delivery confirmation, investigate delay, loss or damage, and apply our Shipping and Delivery Policy.

We use order, return, condition, image, payment and communication data to assess eligibility, arrange or record a return, inspect a Product, provide repair, replacement or another remedy, issue a refund and apply our Returns and Refunds Policy.

We use contact, account, order and communication data to answer questions, authenticate a customer where necessary, resolve complaints and maintain a record of advice, decisions and agreed actions.

If you contact us by telephone, email or WhatsApp, the relevant telecommunications or communications provider processes routing and account information under its own terms. Messages sent through WhatsApp may be processed outside the UAE by WhatsApp and its service providers. Do not send card credentials, passwords, banking codes or unrelated sensitive data through Customer Care channels.

We process account, device, transaction and compliance data to protect customers and the Website, prevent unauthorised access, payment abuse, fraud or prohibited resale, investigate incidents, enforce our Terms, establish or defend legal claims, meet tax and accounting duties, respond to lawful authority requests, and comply with sanctions, consumer-protection and other applicable requirements.

Checks may be performed by Aruzas or specialist providers. We do not make a decision producing legal or similarly significant effects about you solely by automated means unless we tell you, have a lawful basis and provide the safeguards and review rights required by law.

If a newsletter or promotional communication feature is enabled and you choose to subscribe, we use the contact details and consent record you provide to send the selected communication. We may use limited engagement information to understand whether communications are useful only where this is permitted and any required consent has been obtained.

You can unsubscribe through the link in a marketing message or contact info@aruzas.com. We may retain a minimal suppression record so that we continue to respect the choice. Service messages about an account, order, delivery, return, security or legal change are not marketing and may still be sent.

We do not sell or rent personal data. We do not activate optional personalised advertising or marketing tracking unless it is disclosed and any consent required by applicable law has been obtained.

Necessary cookies and similar local-storage or session technologies support security, account sign-in, Bag contents, Checkout and other functions you request. When you deliberately apply a country or language choice, a preference cookie stores that requested setting.

With Analytics consent, the Website may measure pages and interactions and record the referring page, landing page or campaign source associated with a visit or order so that we can understand Website use and how the customer journey began. Optional analytics, advertising or personalisation technologies are described in the Cookie Policy and controlled through Cookie Settings before they are used where consent is required. Browser controls may delete or block cookies, but blocking necessary technologies can prevent Account, Bag or Checkout features from working.

Depending on the purpose and applicable law, we process personal data: with your consent where consent is required; to take steps you request or perform a contract with you; to comply with a legal or regulatory obligation; to protect you or another person in an emergency; to establish, exercise or defend legal claims; and for proportionate business and security purposes or another exception expressly permitted by applicable law.

Where we rely on consent, it must be specific and informed and may be withdrawn. Where we rely on a non-consent ground, we limit processing to what is necessary for that ground and apply the safeguards required by the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other applicable rules.

We disclose only the information reasonably needed for a defined purpose to the following categories of recipient:

• website, hosting, cloud, security, database, account and e-commerce service providers;
• analytics and Website-performance providers, including Google Analytics 4, only when the corresponding consent is active;
• payment processors, banks, card networks and fraud-prevention or identity-verification providers;
• couriers, fulfilment, tracking, return, repair and delivery-service providers;
• accounting, invoicing, tax, audit, insurance and professional advisers;
• email, telephone, WhatsApp and other customer-communication providers;
• regulators, courts, law enforcement, tax or other public authorities where disclosure is required or lawfully requested; and
• a purchaser, investor, lender or professional adviser involved in a genuine reorganisation, financing, merger or sale, subject to confidentiality and applicable law.

Providers acting for Aruzas may process data only for agreed services and under appropriate privacy, security and confidentiality obligations. Some payment, communications or public bodies may act as independent controllers for their own legal purposes.

Aruzas does not sell or rent personal data to data brokers or unrelated organisations. We do not disclose customer data to another brand for that brand’s own direct marketing unless you separately request or consent to it.

Using a service provider to operate our Website, deliver an order, process payment or support a customer is not a sale of personal data. Those disclosures remain limited to the relevant service and legal requirements.

Aruzas is based in the UAE, while some technology, payment, communications, cloud, professional or logistics providers may process personal data in other countries. Those countries may have different privacy laws.

Before a restricted transfer, we use a method permitted by applicable UAE law, such as transfer to a jurisdiction recognised as providing adequate protection, approved contractual and organisational safeguards, your explicit consent where appropriate, or another lawful exception. We also limit access and require security and confidentiality appropriate to the information and service.

We retain personal data only for as long as reasonably necessary for the purpose described, including service delivery, accounting, tax, fraud prevention, dispute resolution and legal compliance. In particular:

• account and preference data is kept while the account is active and for a reasonable closure period, while order and legal records are retained separately where required;
• orders, invoices, payments, refunds and related tax or accounting records are normally retained for at least seven years after the relevant tax period, or longer where law, an audit, investigation or claim requires;
• delivery, return, warranty, complaint and Customer Care records are kept until the matter is resolved and then for the period reasonably needed for quality, fraud, claim and legal purposes;
• marketing contact data is used until you withdraw consent or unsubscribe; a minimal suppression record may be retained to honour that choice; and
• technical and security records are kept for the shortest operational period appropriate to security, diagnostics and incident investigation.

When information is no longer needed, we delete it, anonymise it, or isolate it until secure deletion from backups occurs through the normal backup cycle.

We use proportionate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, destruction, access or disclosure. Measures include access control, role and provider restrictions, protected credentials, encrypted transport where supported, system updates, backups, monitoring and incident-response procedures.

No internet or storage system can be guaranteed completely secure. You should use a unique password, protect devices and verification codes, and tell us promptly if you suspect unauthorised account activity. If a personal-data breach creates a notification duty, we will notify the competent authority and affected individuals in the manner and timeframe required by applicable law.

Subject to applicable conditions and exceptions, you may have the right to:

• obtain information about our processing and request access to or a copy of personal data;
• correct or complete inaccurate personal data;
• request erasure where data is no longer required or processing is otherwise unlawful;
• restrict, stop or object to particular processing, including direct marketing;
• receive or transfer personal data in a portable form where the legal conditions apply;
• withdraw consent at any time for future consent-based processing;
• request human review and object to a solely automated decision producing legal or similarly significant effects, where applicable; and
• raise a complaint with the competent UAE data-protection authority or seek another remedy available under law.

Privacy rights are subject to the conditions and lawful exceptions in applicable legislation. Nothing in this Policy limits a right that cannot lawfully be limited.

Email info@aruzas.com with the subject Privacy Request, or use Contact Us. Describe the request, the account or order involved, and the country from which you used our service.

To protect you, we may ask for information reasonably necessary to verify identity or authority. Do not send a password, card PIN or banking code. An authorised representative must provide evidence of authority. We will respond within the period required by applicable law and ordinarily do not charge a fee, except where a lawful fee is permitted for a manifestly unfounded, excessive or repeated request.

If you remain concerned after our response, you may complain to the competent UAE data-protection authority or use another complaint or court route available to you. Contacting us first is encouraged but does not remove a statutory right.

Privacy rights are subject to the conditions and lawful exceptions in applicable legislation. Nothing in this Policy limits a right that cannot lawfully be limited.

The Website and online purchasing services are intended for adults aged 18 or over. We do not knowingly create customer accounts for, sell online directly to, or intentionally collect personal data from a child who cannot lawfully provide it.

If you believe a child supplied personal data without the necessary parent or guardian involvement, contact info@aruzas.com. We will investigate and delete or otherwise address the information where required.

The Website may link to a payment provider, courier, social or communications platform, map, manufacturer or another external service. When you leave our Website or use a service that determines its own purposes and means, that organisation’s privacy notice applies.

We are not responsible for an external organisation’s privacy practices. Review its notice before providing personal data, especially when opening an account or completing payment outside the Aruzas Website.

We may update this Policy when our services, providers, technology, legal obligations or processing activities change. The current version and effective date will remain available on this page. We will provide a prominent notice or seek fresh consent before a material change where applicable law requires it.

This version applies to the UAE market. Before Aruzas opens another country for ordering, we will publish or link the applicable market supplement describing the local controller or representative, rights, currency, service providers, transfers, regulator and other country-specific information.

For questions about this Policy, contact info@aruzas.com, call +971 50 384 0328, or use Contact Us.