Privacy and Data Protection Policy

✨ Privacy and Data Protection Policy – Elegance Store

At Elegance 🤍, we take the privacy of your personal data seriously and aim to protect and handle it transparently and responsibly in accordance with applicable laws and regulations in Saudi Arabia, including the Personal Data Protection Law and its implementing regulations.

This policy explains the types of personal data we may collect, how we collect, use, disclose, and retain it, and the rights of data subjects and how those rights may be exercised.

1. Controller and Contact Details

For purposes of this policy, Elegance determines the purposes and means of processing personal data associated with use of the store, purchases, and customer service.

2. Data We Collect

We collect data needed to provide and operate the store’s services, which may include:

  • Identity data: such as full name.
  • Contact data: such as mobile number and email address.
  • Shipping and billing data: such as delivery address and billing information where needed.
  • Order and transaction data: such as products ordered, order value and status, cancellations or returns, and transaction identifiers related to payment.
  • Payment data: such as payment method, payment status, and information needed to confirm a transaction. Sensitive payment data is processed by specialized payment providers, and Elegance does not ordinarily retain full payment-card numbers.
  • Account data: such as information and preferences associated with a customer account, where an account is created.
  • Correspondence data: such as inquiries, complaints, and customer-service communications.
  • Technical data: such as IP address, device and browser type, operating system, and technical identifiers.
  • Usage data: such as pages and products visited, interactions with the store, items added to cart, and certain data generated through cookies and similar technologies.
  • Marketing and privacy preferences: such as subscribing to or opting out of marketing communications.

Some information, including name, contact details, delivery address, and information needed to complete payment, is necessary to perform a purchase. We may be unable to complete or deliver an order if such information is not provided.

3. How We Collect Data

We may collect personal data in the following ways:

  • Directly from you: when you complete a purchase, create an account, subscribe to communications, contact us, or submit forms in the store.
  • Automatically: when you browse the store, through cookies and similar technologies, site logs, and performance-measurement tools.
  • From service providers: such as the commerce platform, payment and shipping providers, technical providers, and analytics providers, to the extent necessary to operate the service.
  • From other parties: where obtaining the data is necessary to provide the service or otherwise permitted by law.

4. Purposes and Legal Basis for Processing

We process personal data for lawful purposes connected with store services and on the appropriate legal basis for each processing activity.

  • Performing the customer order and contract: to process orders and payments, prepare products, arrange shipping and delivery, handle returns, and provide after-sales service.
  • Communications and customer service: to contact you about orders or accounts and respond to inquiries, complaints, and issues.
  • Legal obligations: to comply with applicable requirements, retain required records, and respond to valid legal or judicial requests where applicable.
  • Legitimate interests, where permitted: to help protect the store and customers against fraud and misuse and improve store security and performance while taking data-subject rights into account.
  • Consent, where required: for direct marketing, certain analytics or advertising technologies, or processing for which consent is legally required.

5. Sharing Data with Other Parties

We do not sell or rent your personal data. We may share the minimum data necessary with parties that help provide store services, including:

  • Shopify: to operate and host the store and manage orders, accounts, and related technical services.
  • Payment service providers: to process and verify payments and manage refunds.
  • Carriers and logistics providers: to deliver and track orders and perform delivery requirements.
  • Authorized supplier Tuscany Leather: to share data necessary to prepare an order and ship it from Italy to the customer’s address in Saudi Arabia.
  • Analytics, performance, and advertising providers: to measure store and campaign performance, understand site usage, and improve services according to applicable settings and legal bases.
  • Technical service and support providers: to the extent necessary to operate and maintain store services.
  • Competent government or judicial authorities: where a legal obligation or valid official request requires disclosure.

6. Transfers Outside Saudi Arabia

Some store services may require personal data to be transferred or processed outside Saudi Arabia, such as data necessary to fulfill orders prepared and shipped by an international supplier or data processed by international technology platforms or service providers.

This includes sharing data necessary to fulfill an order with the authorized supplier in Italy.

Transfers or disclosures outside Saudi Arabia are carried out in accordance with the Personal Data Protection Law and the regulations governing transfers outside the Kingdom, limited to the defined purpose, and subject to appropriate safeguards and measures according to the circumstances.

7. Data Security

We take appropriate technical, administrative, and organizational measures intended to protect personal data against unauthorized access, use, alteration, loss, or disclosure.

Store services use secure and encrypted connections to help protect data in transit. No electronic system, storage method, or transmission can be guaranteed absolutely secure, so measures are applied in proportion to the nature of the data and associated risks.

8. Data Retention and Disposal

We retain personal data for as long as necessary to achieve the purposes for which it was collected or processed, or as necessary to satisfy legal or contractual obligations or to address claims and disputes where required.

  • Order and transaction data: for the period necessary to fulfill orders, satisfy recordkeeping requirements, and address claims where needed.
  • Customer-service data: for the period necessary to handle the inquiry or complaint and related obligations.
  • Marketing data: until consent is withdrawn, subscription is cancelled, or the processing purpose ends, unless another legal basis permits retention.
  • Cookie and analytics data: retention periods vary by technology, configuration, and service provider.

When data is no longer needed and no legal basis requires retention, it is deleted, destroyed, or anonymized using appropriate methods intended to prevent unlawful access or recovery.

9. Your Rights as a Data Subject

Under the Personal Data Protection Law and applicable regulations, data-subject rights may include, depending on the circumstances:

  • Right to be informed: about the legal basis and purpose for collecting and processing personal data.
  • Right of access: to personal data we hold about you, subject to applicable controls.
  • Right to obtain a copy: of personal data in a clear and readable format, subject to applicable controls.
  • Right to correction, completion, and updating: of inaccurate, incomplete, or outdated data.
  • Right to request destruction: when the data is no longer needed, unless a legal basis permits or requires retention.
  • Right to withdraw consent: where consent is the legal basis for processing, subject to other applicable legal provisions.

To exercise any of these rights, contact support@shopcomx.com. We may need to verify the identity of the requester to the extent necessary before acting on the request.

We aim to process rights requests within the period prescribed by law, which ordinarily does not exceed 30 days from receipt of a complete request. The period may be extended where permitted by law, with notice to the data subject.

10. Cookies

The store may use cookies and similar technologies to operate the website, provide essential functionality, improve user experience, and measure performance.

  • Necessary cookies: for the cart, account, checkout, security, and essential functions.
  • Functional cookies: to remember certain preferences and improve the experience.
  • Analytics technologies: to measure store usage and performance and improve services.
  • Marketing or advertising technologies: to measure or personalize campaigns where such technologies are used and permitted on an appropriate legal basis.

Some cookies can be controlled through browser settings or privacy options available in the store where provided. Disabling necessary cookies may prevent some store functions from operating correctly.

11. Marketing and Email Communications

We may use contact information to send marketing messages or offers where permitted and after obtaining consent when legally required.

You may unsubscribe from marketing communications at any time through the unsubscribe link in a message or by contacting us.

Opting out of marketing does not affect necessary transactional communications concerning orders, payments, shipping, customer service, or other operational messages required to provide the service.

12. Children’s Data

Elegance does not specifically target children and does not intentionally seek to collect personal data from children in a manner inconsistent with applicable law.

If you believe a child’s data has been provided to us inappropriately, please contact us so that we can review the matter and take appropriate action.

13. Complaints Concerning Personal Data

If you have a complaint or objection concerning how your personal data is collected, used, protected, or how your rights are handled, please first contact us at:

support@shopcomx.com

We will review and address the complaint according to applicable laws and procedures. If the data subject is not satisfied with the outcome, the data subject may complain to the competent personal-data authority in Saudi Arabia through the official channels made available by the Saudi Data and AI Authority (SDAIA).

14. External Links and Services

The store may contain links to or services provided by independent third parties. Elegance does not control those parties’ privacy practices, so we recommend reviewing their privacy policies when navigating to them.

15. Privacy Policy Updates

We may update this policy when necessary because of legal, regulatory, operational, service, or technology changes.

The updated version will be published on this page and the last-updated date will be revised where appropriate.

16. Contact Us

For questions about this policy, more information about how your data is processed, or to exercise your rights, contact us through:

Last updated: August 22, 2026
This policy applies from the date it is published on the website and may be updated in the future to remain consistent with applicable Saudi regulations and the store’s actual practices.