Privacy Policy

Manna Oils Handicraft Works operates this website and online store, as well as related features, content, and tools, to provide you with our products and services (the “Services”). This Privacy Policy explains how we collect, use, process, disclose, and safeguard your personal information when you visit or use the Services, including when you make purchases, subscribe to marketing, engage with our social media channels, use our digital consultation services, or participate in our affiliate or influencer programs. This Policy is designed to comply with the UAE Personal Data Protection Law (PDPL), the European General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the UAE Consumer Protection Law, and UAE e‑commerce laws and regulations.

Please read this Privacy Policy carefully. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.

Personal Information We Collect or Process

The personal information we collect depends on how you interact with the Services and the choices you make.

Information you provide to us

  • Account & order information: full name and contact details, email address, phone number, billing and shipping addresses, date of birth (for age verification), order history, purchase preferences, and customer service communications.
  • Payment information: credit/debit card details (processed securely by third‑party processors), banking information for refunds, transaction history and payment records, and billing‑address verification.
  • Profile & preferences: account credentials and security information, communication preferences, product interests and wish lists, review and rating submissions, survey responses and feedback.

Information collected automatically

  • Technical data: IP address and device identifiers, browser type and version, operating system and device details, time zone and location data, referral source, and navigation events.
  • Website usage data: pages visited, time spent, interactions and click-throughs, search queries and filters, shopping‑cart activity, and session recordings (anonymized).
  • Cookies and similar technologies: essential cookies for site functionality, analytics cookies for performance measurement, marketing cookies for personalized advertising, and social‑media pixels and tracking tools.

Information from third parties

  • E‑commerce platforms and payments: Shopify account/order data, Amazon AE purchase history and preferences, payment‑gateway transaction records, and shipping/logistics updates.
  • Social media integrations: public profile information when you connect social accounts, user‑generated content when you tag or mention us, and influencer‑collaboration metrics.
  • Business partners: affiliate‑program performance data, marketing campaign analytics, and customer referral information.

Personal Information Sources

We collect personal information directly from you (e.g., account creation, purchases, consultations, support), automatically through cookies and similar technologies when you use the Services, and from service providers and partners.

How We Use Your Personal Information

We use personal information to:

Provide, tailor, and improve the Services. Process and confirm orders; process payments and refunds; arrange shipping and delivery; provide order tracking and updates; handle returns and exchanges; create, maintain, and manage your account; personalize content and product displays; remember preferences and items of interest; and enhance site performance and functionality.

Communicate with you. Send order confirmations and shipping notifications; provide customer support and technical assistance; respond to inquiries and feedback; notify you about account or security updates; and communicate policy updates and important notices.

Marketing and personalization. Send promotional offers and product recommendations; conduct market research and customer surveys; analyze behavior and preferences; and develop targeted advertising campaigns .

Security and fraud prevention. Authenticate accounts; maintain the security of the Services; prevent, detect, and investigate fraud and unauthorized access; and protect our rights and intellectual property.

Digital consultation services. Schedule and conduct wellness consultations; provide personalized product recommendations; maintain consultation records and follow‑ups; and process consultation bookings and payments.

Business operations and legal compliance. Maintain accurate records; conduct financial reporting and analysis; comply with tax, consumer‑protection, and other legal obligations; and support audits, incident response, and regulatory reporting.

Legal Bases for Processing (PDPL / GDPR)

Where PDPL and GDPR apply, we process personal data based on:

  • Consent: newsletter and marketing communications, cookie placement and tracking, social‑media integrations, voluntary surveys, and digital‑consultation bookings.
  • Contract performance: processing and fulfilling orders, providing customer support, managing accounts, and processing payments and refunds.
  • Legal obligations: UAE VAT and tax compliance, financial record‑keeping, consumer‑protection compliance, anti‑money‑laundering requirements, and data‑breach notification obligations.
  • Legitimate interests: fraud prevention and security, website optimization, business analytics and reporting, marketing to existing customers, and protection of intellectual property. You may object to processing based on legitimate interest s at any time.

How We Disclose Personal Information

We disclose personal information in the following circumstances:

Service providers and business partners (acting on our behalf):

  • E‑commerce & payments: WordPress, Hostinger, Shopify (website hosting and order management), Amazon AE (marketplace sales and fulfillment), Stripe, PayPal, other payment processors, and banking/financial institutions.
  • Logistics & shipping: UAE‑based couriers, international shipping providers, package tracking and delivery services, and customs/clearance agents.
  • Technology & analytics: Google Analytics and Search Console, social platforms (Meta, Instagram, TikTok), email marketing services (Mailchimp, Klaviyo), and customer‑support platforms.
  • Professional services: legal and compliance advisors, accounting and tax services, business‑insurance providers, and cybersecurity/data‑protection specialists.

Legal requirements

We may disclose information to UAE federal and emirate‑level authorities, in response to court orders and legal processes, to law enforcement, to meet regulatory and tax obligations, and as otherwise required by law.

Business transfers. If we undergo a merger, acquisition, or sale of assets, personal information may be transferred to the new entity subject to the same privacy protections.

Relationship with E‑commerce Platforms

We sell via our website and other marketplaces and fulfillment platforms. These platforms and related processors handle personal information as service providers that enable our Services (for example, transactions, order processing, and fulfillment), consistent with the disclosures above.

Third‑Party Services and Social Integrations

Parts of the Services integrate with third‑party tools and platforms—such as social‑media pixels and account connections. When you connect a social account or interact with our content (e.g., tags and mentions), we may receive public profile information and collaboration metrics, and we may use analytics and advertising tools to help measure performance and personalize marketing, as described in this Policy.

Children’s Data

The Services are intended for users aged 18 and above. We do not knowingly collect personal information from children under 18 without parental consent. If you believe a child under 18 has provided information to us. We will investigate and delete the data if confirmed and implement safeguards to prevent recurrence.

Security and Retention of Your Information

Security measures

We implement industry‑standard technical and organizational safeguards, including SSL/TLS encryption in transit; encrypted databases and secure server infrastructure; role‑based access controls and multi‑factor authentication; and network security measures such as firewalls, monitoring, and intrusion detection. Our framework includes staff training, data minimization, regular audits, and established incident‑response and breach‑notification procedures. In the event of a personal‑data breach, we will notify relevant supervisory authorities within 72 hours and affected individuals without undue delay where there is a high risk, and will provide details and mitigation steps.

How long we retain information. We retain personal information only as long as necessary for the purposes described in this Policy, including service provision, legal compliance, dispute resolution, analytics, fraud prevention, and security. Specific retention periods include:

  • Customer accounts: retained while active; inactive accounts deleted after 3 years; basic data for closed accounts retained 7 years for legal compliance.
  • Transactions: order and payment data retained 7 years (UAE tax law); refund and return records 5 years; consultation records 3 years or as required by law.
  • Marketing & analytics: email‑marketing data retained until consent is withdrawn; website analytics anonymized after 26 months; cookie durations as specified in our Cookie Policy.

Secure deletion. When retention periods expire, we permanently delete data from active systems, securely dispose of physical records, remove data from backups within a reasonable timeframe, and maintain deletion logs for audit purposes.

Your Rights and Choices

Depending on where you live and applicable law, you may have the following rights:

  • Access / Portability: request copies of your personal data and receive it in a structured, machine‑readable format.
  • Rectification: request correction of inaccurate or incomplete data.
  • Erasure: request deletion of your personal data (subject to legal requirements).
  • Restrict / Object: limit or object to processing in certain circumstances, including processing based on legitimate interests.
  • Withdraw consent: withdraw consent for activities like marketing, cookies, and social‑media integrations.
  • Communication preferences: unsubscribe from marketing emails via links in our messages; adjust cookie preferences via our cookie banner; opt out of SMS/WhatsApp marketing; and modify social‑media integration settings.

How to exercise your rights. Contact us via our official channels and we will respond to verified requests within 30 days, with possible extensions for complex requests.

International Transfers

Your personal data may be processed and stored outside the UAE, including via cloud hosting, e‑commerce platform servers, payment networks, and analytics/marketing providers. Where transfers occur to countries without an adequate level of protection, we implement safeguards such as EU Standard Contractual Clauses, Binding Corporate Rules for intragroup transfers, certification schemes and codes of conduct, and periodic security and compliance audits. We prioritize transfers to jurisdictions with recognized adequacy decisions where feasible.

Complaints

If you have concerns about how we process your personal information, contact us via our official channels. We will acknowledge your complaint within 5 business days, investigate and aim to resolve it within 30 days, and provide a written response outlining our findings and actions. You also have the right to file a complaint with the UAE Data Protection Authority.

Disputes may be addressed through good‑faith negotiations and internal procedures, mediation via recognized privacy organizations, the UAE courts under Dubai jurisdiction for UAE residents, and applicable international frameworks for cross‑border matters.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in privacy laws, our Services, technology, supervisory‑authority guidance, or other operational needs. When we make material changes, we will communicate them (for example, by email to registered users and prominent website notices) and update the “Last updated” date above. Continued use of the Services after an update constitutes acceptance of the revised Policy.

  • contact@mannaoils.com