Privacy Policy

This Privacy Policy (the “Policy”) governs the collection, use, storage and disclosure of personal information by GENTSHUB TRADING L.L.C (“GENTSHUB”, “we”, “us” or “our”) in connection with the website operated at gentshub.com (the “Site”) and any related services, including in-store and customer-care interactions (collectively, the “Services”).

By accessing the Site, creating an account, placing an order, or subscribing to our communications, you acknowledge that you have read, understood and agreed to the practices described in this Policy. If you do not agree with any part of this Policy, please do not use the Services.

This Policy is issued in accordance with the laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “UAE PDPL”) and its implementing regulations, as well as any other applicable data-protection laws.

GENTSHUB TRADING L.L.C is a limited liability company duly licensed in the Emirate of Dubai, United Arab Emirates, and is the data controller responsible for the personal information processed through the Site and the Services.

Where we engage trusted partners to process personal information on our behalf — for example payment providers, logistics carriers, analytics platforms and customer-care tooling — such partners act as our data processors under written agreements that require them to safeguard your information to the same standards described in this Policy.

We collect personal information from you directly, automatically through your use of the Site, and occasionally from third parties acting on our behalf. The categories below describe the information we may hold about you.

1. Information you provide to us

• Account information — the name, email address, password, telephone number, country and language preferences you supply when you create or update an account.
• Order information — billing and shipping addresses, the products you select, gift messages, delivery instructions and any other detail you submit to complete a purchase.
• Payment information — payment is processed by our PCI-compliant payment providers. We do not store full card numbers on our servers; we receive only the truncated number, card type, expiry month and transaction reference necessary to manage your order.
• Customer-care information — the content of any correspondence you send us by email, WhatsApp, contact form or in-store, and recordings of voice calls where notice is given.
• Marketing preferences — your subscription status for our newsletter, SMS or WhatsApp campaigns, including the date you subscribed or withdrew consent.
• Reviews and content — any rating, review, image or comment you choose to submit publicly through the Site.

2. Information we collect automatically

• Device and connection data — IP address, device type, operating system, browser version, screen resolution, language and the network or carrier you are using.
• Usage data — the pages and products you view, the items you add to your cart or wishlist, the duration of your visit, the referring website and the actions you take on the Site.
• Cookies and similar technologies — see section Cookies, Analytics & Tracking Technologies for full detail.

3. Information from third parties

• Social sign-in — if you choose to authenticate using a third-party identity provider, we receive the limited profile information you authorise that provider to share with us.
• Fraud-prevention partners — we may receive risk indicators from payment processors and fraud-prevention services for the sole purpose of protecting transactions.
• Delivery partners — our logistics partners share delivery status updates, attempted-delivery notes and proof-of-delivery records.

We process personal information only for clearly identified, lawful purposes. These include:

• To create and manage your account, including authenticating you on return visits and securing your sign-in.
• To process and fulfil your orders — from accepting payment, generating invoices and arranging shipment, through to handling returns, refunds and after-sales support.
• To communicate with you about your order status, delivery, customer-care enquiries and any administrative matter related to the Services.
• To send you marketing communications about products, collections, editorial stories and offers where you have given your consent or where we are otherwise permitted to do so under applicable law.
• To personalise your experience on the Site, including remembering your preferences, suggesting complementary products, and tailoring editorial content.
• To operate, maintain, secure and improve the Site and the Services, including diagnosing technical problems, preventing fraudulent or abusive activity, and developing new features.
• To comply with our legal, regulatory and accounting obligations, including the retention of transaction records required by UAE law.
• To establish, exercise or defend our legal rights, including in connection with disputes, claims or regulatory enquiries.

Legal bases for processing

Depending on the activity, we rely on one or more of the following legal bases under the UAE PDPL: consent (for marketing communications and optional cookies), performance of a contract (to fulfil your order and account services), compliance with a legal obligation (such as tax and consumer-protection record-keeping), and our legitimate interests (such as fraud prevention, network security and improving our Services), provided that those interests are not overridden by your rights and freedoms.

We do not sell your personal information. We share it only with trusted parties who help us deliver the Services, and only to the extent strictly necessary for the purpose disclosed:

• Payment providers — to securely process your payment, verify the transaction and detect fraud.
• Logistics and delivery partners — to deliver your order to the address you provide, attempt re-delivery and arrange returns.
• Technology service providers — including hosting, content-delivery, search, analytics, email-delivery, customer-care and security providers that operate on our behalf.
• Marketing platforms — to send commercial communications to which you have subscribed and to measure their performance.
• Professional advisers — including lawyers, auditors, accountants and insurers, bound by professional duties of confidentiality.
• Government and regulatory authorities — where we are legally required to disclose information, in response to a valid legal request, or where necessary to protect our rights, property or safety, or those of our customers or the public.
• Successor entities — in the event of a corporate restructuring, merger, acquisition or sale of assets, personal information may be transferred to the successor entity, subject to confidentiality undertakings and continued protection under this Policy.

The Site uses cookies and similar technologies — including local storage, pixels, tags and software development kits — to operate correctly, remember your preferences and understand how the Services are used.

Types of cookies we use

• Strictly necessary cookies — required to operate the Site, maintain your session, secure your sign-in and remember the contents of your cart. These cannot be switched off.
• Functional cookies — remember your language, currency and display preferences so you do not need to reset them on each visit.
• Analytics cookies — help us measure how visitors discover and use the Site so that we can improve performance, content and the buying journey. These cookies collect information in aggregated form.
• Marketing cookies — used by us and by our advertising partners to show you relevant editorial content and product recommendations on the Site and on other websites and applications, and to measure the effectiveness of those campaigns.

Where required by law, we will request your consent before placing non-essential cookies on your device. You can change your cookie preferences at any time using the cookie banner or your browser settings. Please note that disabling certain cookies may affect the functionality of the Services.

With your consent, we may send you newsletters, product launches, editorial features, event invitations and personalised offers by email, SMS, WhatsApp or push notification.

You are in control of these communications at all times. You may:

• Unsubscribe instantly using the link or instruction included in every commercial message we send;
• Update your preferences from within your account dashboard; or
• Contact our Privacy team using the details at the foot of this Policy.

Even if you opt out of marketing communications, we will continue to send service messages necessary to operate your account or fulfil an order — for example order confirmations, delivery updates and security alerts.

We take the security of your personal information seriously and implement organisational, technical and physical safeguards designed to protect it against unauthorised access, alteration, disclosure or loss. These safeguards include encryption of data in transit using industry-standard TLS, restricted access to production systems on a need-to-know basis, regular security reviews and ongoing staff training on data-protection responsibilities.

No method of transmission over the internet or method of electronic storage is fully secure, however, and we cannot guarantee absolute security. You also play an essential role: please keep your account password confidential, use a unique and strong password, and notify us immediately if you suspect any unauthorised access to your account.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting or reporting requirements.

• Account data is retained for the lifetime of your account and for a reasonable period thereafter to permit account reactivation and to defend against potential claims.
• Order, invoice and tax records are retained for the period required by UAE commercial and tax legislation, currently a minimum of five (5) years from the date of the transaction.
• Marketing preferences and consent records are retained for as long as you remain subscribed and for a reasonable period thereafter to evidence prior consent.
• Customer-care correspondence is retained for the period necessary to resolve your enquiry and to maintain a service history.

When personal information is no longer required, we will either securely delete it or anonymise it so that it can no longer be associated with you.

Subject to the conditions and exceptions set out in the UAE PDPL and other applicable law, you hold the following rights in relation to your personal information:

• Right of access — to obtain confirmation of whether we process personal information about you and, if so, to receive a copy of that information.
• Right of rectification — to request that we correct any inaccurate or incomplete personal information we hold about you.
• Right of erasure — to request the deletion of your personal information where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.
• Right to restrict processing — to request that we limit the way we use your personal information in certain circumstances.
• Right to object — to object to processing carried out on the basis of our legitimate interests or for direct-marketing purposes.
• Right to data portability — to receive your personal information in a structured, commonly used and machine-readable format, and to request that it be transmitted to another controller where technically feasible.
• Right to withdraw consent — at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• Right to lodge a complaint — with the competent supervisory authority in the United Arab Emirates if you believe that our processing of your personal information infringes applicable law.

To exercise any of these rights, please contact the Privacy team using the details at the foot of this Policy. We may ask you to verify your identity before we act on a request, and we will respond within the period required by law.

Some of our service providers may process personal information in countries outside of the United Arab Emirates. Where we transfer personal information internationally, we ensure that an adequate level of protection is maintained — for example by selecting providers in jurisdictions recognised by UAE authorities as offering an adequate level of protection, by entering into approved contractual safeguards, or by relying on another lawful transfer mechanism.

By using the Services, you acknowledge that your personal information may be transferred to and processed in countries outside of the United Arab Emirates for the purposes described in this Policy.

The Services are intended for individuals aged eighteen (18) years and above. We do not knowingly collect personal information from children. If you believe that a child has provided personal information to us, please contact our Privacy team and we will take prompt steps to investigate and, where appropriate, delete the information.

We may update this Policy from time to time to reflect changes in our practices, in technology, in legal requirements or for other operational reasons. When we make a material change, we will indicate the new effective date at the top of this Policy and, where appropriate, provide a more prominent notice by email or through the Site.

We encourage you to review this Policy periodically so that you are always aware of how we protect your personal information.