Privacy Policy

0. Key Terms Explained (Simple Definitions)

To make this Privacy Policy easier to understand, especially for non-native speakers, here are simple explanations of key terms we use:

"Personal Data" or "Personal Information"

Any information that can identify you (for example: your name, email, phone number, or address).

"Processing"

Any action we do with your data, such as collecting, storing, using, or deleting it.

"Consent"

Your clear permission to let us use your data for a specific purpose (for example, sending marketing messages). You can withdraw your consent at any time.

"Opt-in"

Choosing "Yes" or ticking a box to agree (for example, agreeing to receive emails or WhatsApp updates).

"Opt-out"

Choosing "No" or unchecking a box to stop receiving marketing or other optional messages.

"Controller"

The company (us) that decides how and why your data is used.

"Processor"

A partner or service provider who helps us handle data safely under our control (for example, payment service providers, shipping carriers, or analytics providers).

"Cookies"

Small text files saved on your device to remember your preferences, improve the site, or show personalized content.

"Legal Basis"

The reason under law that allows us to use your data (for example, your consent, or because it’s needed for your order).

"Third Party"

A company or organization we work with to provide services (for example, payment or delivery partners).

"Opt-out Link"

A web link that lets you stop data sharing or marketing.

"Withdraw Consent"

Remove or change your permission anytime through "My Account" > "My Subscriptions".

"GDPR"

General Data Protection Regulation (EU law protecting personal data).

"PDPL"

Personal Data Protection Law (UAE federal data privacy law).

"CCPA"

California Consumer Privacy Act (U.S. privacy law for California residents).

"Privacy Contact"

The contact point you can use for questions or requests about your personal data.

"SCC"

Standard Contractual Clauses - legally binding contracts for safe international data transfers.

"DAA"

Digital Advertising Alliance - group that lets you opt out from many ad networks at once.

These definitions are simplified for easy understanding. If there is any conflict with official legal definitions, the legal meaning under applicable law will apply.

1. Personal Information We Collect

A. Automatically Collected (Device & Usage Data)

When you visit the Site, we automatically collect:

• Device information (browser type, IP address - Internet Protocol address, a unique identifier for your device, time zone, operating system).
• Cookies (small text files stored on your device) and similar technologies (see Section 5).
• Log data (pages viewed, referring sites, interaction patterns).

We call this "Device Information".

B. Provided by You (Order & Account Data)

When you register, place an order, or contact us, we collect:

• Name, company name, email, phone number, shipping/billing address.
• Payment information is processed securely by our payment service providers and banking partners. We do not store full payment card details.
• Account preferences and order history.

We call this "Order & Account Information".

"Personal Information" means both Device and Order & Account Information.

2. How We Use Your Personal Information

We never combine marketing consent with other terms - your opt-in is fully separate and voluntary.

3. Who We Share Your Data With

We share data only when necessary and under strict agreements:

We never sell your data.

4. International Data Transfers

We operate from the United Arab Emirates and work with service providers located in different countries. Your personal data may be processed in the UAE, the EU/EEA, the United States, and other countries where our trusted service providers operate.

These countries may have data protection laws that are different from those in your country of residence. Where required by applicable data protection laws, we use appropriate safeguards to protect international transfers of personal data.

These safeguards may include contractual data protection commitments, Standard Contractual Clauses or equivalent transfer mechanisms, adequacy decisions, and technical and organisational security measures.

We transfer personal data only when necessary for the purposes described in this Privacy Policy, such as order processing, payment processing, delivery, customer support, analytics, security, and marketing where you have given your consent.

5. Cookies & Tracking Technologies

We use non-essential cookies and similar technologies only with your consent where required by applicable law.

We use cookies (small data files on your device) for:

• Essential: Site functionality, cart, login.
• Statistics: analytics tools such as Google Analytics, where used (opt-in).
• Marketing: advertising tools such as Facebook Pixel or Google Ads, where used (opt-in).

Non-essential cookies will not be used until you give your consent.

Your choices:

• Cookie banner on first visit: Accept All, Reject Non-Essential, or Customize.
• Customize: Toggle Statistics / Marketing.
• Opt-out links:
  • Google Analytics: tools.google.com/dlpage/gaoptout
  • Facebook: facebook.com/settings/?tab=ads
  • DAA (Digital Advertising Alliance - industry group for ad self-regulation): optout.aboutads.info - opt out from 100+ ad networks at once.

6. Messaging & Marketing

• Transactional Emails: Order confirmations, shipping updates, and support replies (contract basis).
• Transactional SMS/WhatsApp or messaging app messages: Order confirmations, shipping updates, or support replies. Only with your explicit opt-in.
• Promotional Newsletter & Product Updates: Only with your explicit opt-in.
• Promotional SMS/WhatsApp or messaging app messages: Only with your explicit opt-in.
• We do not share your email or phone number with unrelated third parties.
• Unsubscribe: disable in My Account > My Subscriptions.

7. Your Rights

Depending on your location and applicable data protection law, you may have the right to:

We respond to verified privacy requests within the time required by applicable law.

Please note that some rights may be limited where we must retain or process certain data to complete pending orders, process payments, arrange deliveries, handle refunds, comply with tax, accounting, customs or other legal obligations, prevent fraud, or establish, exercise or defend legal claims. In such cases, we may restrict processing, remove personal identifiers, or anonymize/pseudonymize data where appropriate instead of fully deleting all records.

8. Data Retention

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law.

• Order, payment, delivery, tax, accounting and customs records: retained for as long as required or permitted by applicable legal, tax, accounting, customs and compliance obligations.
• Account data: retained while your account remains active or as needed to provide our services, manage your orders, resolve disputes, prevent fraud, and comply with legal obligations.
• Consents & Marketing preferences: retained for as long as needed to manage your preferences and demonstrate compliance, unless a longer period is required or permitted by law.
• Analytics and cookie data: retained according to our cookie settings and the retention settings of the analytics tools we use, where applicable.

When personal data is no longer needed, we delete it, anonymise it, or securely restrict its processing where deletion is not immediately possible, for example because of backup, legal, accounting, or technical requirements.

9. Security

We use:

• HTTPS (Hypertext Transfer Protocol Secure - encrypted web connection)
• Payment processing through secure third-party payment service providers
• Access controls, secure hosting, backups, and other appropriate technical and organisational measures

10. Children

Our Site is not intended for children under 16. We do not knowingly collect data from minors.

11. Do Not Track

We do not alter data practices based on browser DNT (Do Not Track - browser setting to request no tracking) signals.

12. Changes

We may update this policy from time to time. The updated version will be posted on this page with a new “Last updated” date.

13. Contact Us

Data Controller

Crystal House LLC
Shop 19-22, Al Hana Center, Al Mankhool Road,
Bur Dubai, United Arab Emirates

Privacy Contact

For questions about this Privacy Policy, our use of your personal data, or to exercise your privacy rights, please use our Privacy Request Form or contact us at: info@ecrystalhouse.com.

Complaints

We encourage you to contact us first so we can try to resolve your concern. If you are located in the EU/EEA and GDPR applies to our processing of your personal data, you may also have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or place of the alleged infringement.

• EU: Local DPA (Data Protection Authority - national privacy regulator) - edpb.europa.eu
• UAE: UAE Data Office - u.ae/en/about-the-uae/digital-uae/data/data-protection-laws
• U.S.: State Attorney General - consumerresources.org/file-a-complaint (NAAG - National Association of Attorneys General, resource for filing complaints across states).
• Brazil: ANPD - anpd.gov.br
• Canada: OPC - priv.gc.ca
• China: CAC - cac.gov.cn
• South Africa: POPIA Regulator - inforegulator.org.za