Privacy Policy

PRIVACY POLICY — COLOUR CLOSET

Last updated: 22nd September 2026

  1. WHO WE ARE

Colour Closet (“Colour Closet”, “we”, “us” or “our”) is a UAE-based, licensed e-commerce business offering fashion, accessories and other products through www.colourcloset.com.

The website is operated by:

Registered legal entity: ColourCloset
Trading name: Colour Closet
Registered business address: cs@colourcloset.com
Privacy contact: cs@colourcloset.com

For the activities described in this Privacy Policy, the entity identified above is responsible for determining how and why your personal information is processed, except where another organisation independently determines its own processing purposes.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you browse our website, create an account, place an order, contact us, subscribe to communications or otherwise interact with our services.

It also covers information you provide through customer-service channels, including email, social media and messaging services such as WhatsApp, where used.

  1. APPLICABLE PRIVACY LAWS

We handle personal information in accordance with the privacy and data-protection laws applicable to our business and the relevant processing activity. These may include UAE Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data, where applicable, and other applicable UAE legislation.

Depending on your location and our activities, additional laws may apply, including the European Union General Data Protection Regulation (“EU GDPR”), the United Kingdom General Data Protection Regulation (“UK GDPR”) and other applicable national or state privacy laws.

Nothing in this Privacy Policy limits any mandatory rights or protections available to you under applicable law.

This Privacy Policy provides information about our practices. Visiting our website or reading this policy does not, by itself, constitute consent to processing for which separate consent is legally required.

  1. PERSONAL INFORMATION WE COLLECT

The information collected depends on how you interact with us and the services you use. It may include:

• Identity and contact information: your name, email address, telephone number, billing address, delivery address and country.

• Account information: information associated with your customer account, preferences, saved addresses and account activity.

• Order and transaction information: products purchased, sizes, quantities, order history, delivery instructions, transaction references, payment status, returns, refunds and customer-service records.

• Payment-related information: information needed to facilitate and reconcile payments, such as the payment method, transaction identifier and limited payment details made available by the payment provider.

• Custom-order information: measurements, sizing preferences, personalisation instructions and photographs or other materials you choose to provide for a customised product.

• Communications: information contained in enquiries, emails, messages, complaints, feedback and correspondence with our team.

• Marketing preferences: subscription choices, consent records, unsubscribe requests and communication preferences.

• Reviews and submissions: reviews, ratings, photographs and other content you submit for publication or otherwise authorise us to use.

• Technical and usage information: IP address, browser and device information, operating system, approximate location derived from technical information, referring pages, pages viewed and interactions with the website.

• Cookie and similar technology information: identifiers and preferences associated with cookies, pixels, local storage and similar technologies, subject to applicable consent requirements.

You can browse the website without creating an account. However, this does not necessarily mean your visit is anonymous: technical information may still be processed to operate, secure and, where permitted, measure or personalise the website.

Please do not send passwords, complete payment-card details, identity documents or sensitive information through ordinary email, social media or messaging services unless we specifically identify a lawful need and an appropriate secure method.

  1. HOW WE RECEIVE INFORMATION

We receive personal information:

• Directly from you when you place an order, create an account, complete a form, subscribe, submit content or contact us.

• Automatically through your interactions with our website and its technologies, subject to applicable law and your privacy choices.

• From service providers involved in payments, delivery, fraud prevention, website operation or customer support.

• From a person placing an order or arranging a delivery on your behalf.

• From a participating brand or vendor where necessary to manage your order, customisation, delivery, return or enquiry.

If you provide another person’s information, such as a gift recipient’s contact details, please ensure you are entitled to do so and direct them to this Privacy Policy. We use that information for the relevant service and do not treat its provision as that person’s consent to marketing.

  1. WHY WE USE PERSONAL INFORMATION

We use personal information, as applicable, to:

• Receive, process and fulfil orders.
• Arrange payments, deliveries, customs formalities, returns and refunds.
• Coordinate products and customisation requests with relevant brands or vendors.
• Create and administer customer accounts.
• Respond to enquiries, complaints and support requests.
• Send service communications, including order confirmations and delivery updates.
• Maintain and secure the website and investigate suspected fraud or misuse.
• Understand website performance and improve our products and services.
• Provide permitted personalisation and advertising, subject to required choices and consent.
• Send marketing communications where lawfully permitted.
• Manage reviews, promotions or competitions that you choose to participate in.
• Maintain appropriate business, accounting and compliance records.
• Comply with legal obligations and establish, exercise or defend legal claims.

We do not treat placing an order, making an enquiry or entering a competition as automatic consent to unrelated marketing.

  1. LEGAL GROUNDS FOR PROCESSING

The legal grounds we rely on depend on the applicable law and the purpose of processing.

Where UAE Federal Decree-Law No. 45 of 2021 applies, we obtain consent where required or rely on an applicable statutory exception, including processing necessary to enter into or perform a contract with you, comply with legal obligations, or establish, exercise or defend legal claims.

Where the EU GDPR or UK GDPR applies, our legal grounds may include:

• Contract: processing necessary to fulfil your order, provide a requested service or take steps at your request before entering into a contract.

• Legal obligation: processing necessary to meet applicable legal requirements.

• Consent: processing for optional activities where consent is required, including relevant marketing and tracking activities.

• Legitimate interests: where permitted, processing necessary for interests such as protecting the business against fraud, securing our services and improving customer support, after assessing those interests against your rights and freedoms.

We do not rely on legitimate interests to replace consent where consent is legally required.

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

If information is necessary to fulfil an order or meet a legal obligation, we will explain this where appropriate. Without that information, we may be unable to provide the relevant service.

  1. WHO WE SHARE INFORMATION WITH

We disclose personal information where necessary for the purposes described in this policy and where permitted by law. Depending on the service, recipients may include:

• Shopify and website service providers supporting hosting, checkout, accounts, technical maintenance and related store functions.

• Payment providers and financial institutions processing payments, instalments, refunds, disputes or fraud checks.

• Brands, vendors and customisation partners involved in preparing, supplying or supporting your purchased products.

• Couriers, logistics providers and customs-related service providers arranging delivery and returns.

• Customer-support, communications and business-system providers supporting our operations.

• Analytics and advertising providers, where used and subject to applicable consent and opt-out requirements.

• Professional advisers, including accountants, auditors, insurers and legal advisers, where necessary for their work.

• Public authorities, regulators, courts or other parties where disclosure is legally required or otherwise lawfully necessary.

• Parties involved in a proposed or completed business restructuring, acquisition or transfer, subject to appropriate confidentiality and data-protection safeguards.

Information disclosed should be relevant and limited to the purpose involved. Where a provider processes information on our behalf, we require appropriate contractual protections and instructions where required by law.

Some recipients, such as payment providers or couriers, may independently process information for their own legal and operational purposes. Their own privacy notices may also apply.

  1. SHARING WITH BRANDS AND VENDORS

Colour Closet works with participating brands and vendors, including businesses located in Pakistan.

Where necessary for your order, we may provide the relevant vendor with order details, sizing or customisation instructions and the contact or delivery information needed to prepare, fulfil or support that order.

Sharing information for fulfilment does not, by itself, authorise a vendor to use it for unrelated marketing. Any separate marketing use must have its own valid legal basis and meet applicable notice and consent requirements.

If you contact or buy from a vendor independently of Colour Closet, that vendor’s privacy practices apply to its independent activities. This does not remove our responsibilities for disclosures we make.

  1. SHOPIFY AND PAYMENT SERVICES

Our online store is hosted on Shopify.

Shopify processes personal information to operate and support the store. Depending on the services involved, Shopify may process information on our behalf or for purposes for which it is independently responsible.

Where enabled, Shopify’s enhanced services, including Shopify Network Intelligence, may use information from interactions with our store together with information from interactions with Shopify and other merchants to provide services such as personalisation, performance improvements and advertising-related features, subject to applicable settings, legal requirements and privacy choices.

Further information is available in the Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/consumers

You can also access Shopify’s privacy portal:
https://privacy.shopify.com/

Payments are handled through the payment services offered at checkout or through the payment method separately agreed with you. Those providers process the information required to complete the transaction and may conduct their own security, fraud or eligibility checks.

We may receive transaction confirmations, payment status and limited payment information for order management and reconciliation. The relevant provider’s privacy notice explains its own processing and retention practices.

  1. COOKIES, ANALYTICS AND ADVERTISING

Our website uses cookies and similar technologies for functions such as maintaining your shopping session, remembering preferences and protecting the service.

Depending on the tools enabled, these technologies may also support analytics, personalisation, advertising and measurement of advertising effectiveness.

Where required by law, we obtain consent before using technologies that require it. Essential technologies necessary to provide a service you request may operate without that consent where legally permitted.

You can manage available choices through the website’s cookie controls, where displayed, and your browser settings. You may also contact us for assistance. Blocking certain technologies can affect website functionality.

Where we use advertising partners, they may process identifiers and information about website activity to measure campaigns or deliver relevant advertising. Under some privacy laws, certain disclosures for advertising may be classified as a “sale”, “sharing” or targeted advertising even where no money is exchanged.

Where applicable, you may opt out through the privacy controls provided on the website or by contacting us. We honour legally recognised opt-out preference signals where required.

This policy does not itself provide consent for advertising or tracking.

  1. MARKETING COMMUNICATIONS

We may send promotional communications through the channels you select or where otherwise permitted by applicable law.

You can stop marketing emails by using the unsubscribe link. For marketing through other channels, follow the opt-out instructions provided or contact cs@colourcloset.com.

Withdrawing marketing consent or opting out of marketing does not prevent us from sending necessary service communications, such as order updates, payment information, security messages or responses to your enquiries.

We may retain a limited record of an opt-out request to ensure your preference continues to be respected.

  1. REVIEWS, PHOTOGRAPHS AND PUBLIC CONTENT

When you submit content for public display or authorise its publication, that content and the agreed accompanying information, such as your display name, may be visible to other people.

Private customer-service messages and photographs are not automatically treated as permission to publish them for promotional purposes.

Please avoid including personal information you do not want made public in reviews or public submissions.

You can contact us regarding content we publish about you. We will assess removal or correction requests in accordance with applicable law. Copies made independently by other people or services may remain outside our control.

  1. INTERNATIONAL PROCESSING AND TRANSFERS

Although Colour Closet is based in the UAE, personal information may be processed outside the UAE by participating vendors, Shopify and other service providers.

This may include processing in Pakistan and other countries where relevant providers or their authorised personnel operate. Data-protection laws in those countries may differ from those in your location.

Where a transfer is subject to legal restrictions, we use an applicable lawful transfer mechanism and safeguards as required. Depending on the relevant law and destination, these may include recognised adequacy arrangements, approved contractual protections or another permitted transfer ground.

For transfers subject to EU or UK requirements, this may involve appropriate contractual clauses and additional safeguards where required.

You may contact us for information about safeguards relevant to your personal information and, where applicable, how to obtain a copy, subject to lawful confidentiality restrictions.

Using our website is not treated as blanket consent to unrestricted international transfers.

  1. HOW LONG WE KEEP INFORMATION

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting, dispute-resolution and recordkeeping requirements.

Retention depends on the type of information:

• Order and transaction records are retained for order administration, returns, disputes and applicable accounting or legal requirements.

• Account information is retained while needed to provide the account and for any necessary period following closure.

• Customer-service records are retained for handling enquiries, resolving complaints and related legitimate recordkeeping needs.

• Customisation information is retained as needed to fulfil and support the relevant order or an agreed ongoing service.

• Marketing information is retained while there is a valid basis for the communications, with limited suppression records retained to respect opt-outs.

• Technical information is retained according to its security, operational or measurement purpose.

A legal requirement, investigation or dispute may require longer retention of particular records.

When information is no longer required, we delete it or anonymise it. Information in backups may remain until the applicable backup cycle ends and is subject to appropriate restrictions in the meantime.

  1. SECURITY

We use reasonable technical and organisational measures appropriate to the nature of the information and the risks involved to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

Access should be limited to people who need it for authorised purposes.

No website, communication method or storage system can be guaranteed completely secure. This does not limit our legal duties to protect personal information.

If a personal-data breach occurs, we will assess and respond to it and notify the relevant authorities and affected individuals where required by applicable law.

Please contact us promptly if you suspect unauthorised use of your account or information associated with an order.

  1. YOUR PRIVACY RIGHTS

Depending on the law that applies, you may have the right to:

• Obtain information about how your personal information is processed.
• Request access to your information and a copy of it.
• Correct inaccurate or incomplete information.
• Request deletion of information.
• Restrict or object to certain processing.
• Receive eligible information in a portable format.
• Withdraw consent where processing relies on consent.
• Object to direct marketing.
• Opt out of certain advertising-related processing or disclosures.
• Request applicable protections concerning significant decisions based solely on automated processing.
• Complain to a competent data-protection authority.

These rights are subject to applicable conditions and exceptions. For example, we may need to retain particular transaction records even after a deletion request.

To make a request, email cs@colourcloset.com with the subject “Privacy Request” and explain what you would like us to do.

We may request proportionate information to verify your identity or an authorised representative’s authority. Please do not send sensitive identity documents unless we request them through an appropriate process.

We respond within the time required by applicable law. Where EU or UK GDPR time limits apply, this is normally within one month, subject to permitted extensions. If an extension is necessary, we will explain the reason within the applicable initial period.

Requests are generally handled without charge. Any permitted fee or refusal will be explained and applied only as allowed by law.

We will not unlawfully discriminate against you for exercising your privacy rights.

  1. AUTOMATED TOOLS AND DECISIONS

Our services and providers may use automated tools for purposes such as fraud screening, security, product recommendations and advertising.

If a processing activity involves a decision based solely on automated processing that produces legal or similarly significant effects on you, we will provide the information and safeguards required by applicable law.

Where applicable, you may request human intervention, express your point of view and challenge the decision.

Independent payment or instalment providers may make their own eligibility decisions. Their privacy notices explain those activities and the relevant ways to exercise your rights.

  1. CHILDREN’S INFORMATION

Our purchasing and account services are intended for adults aged 18 or over. Products intended for children are offered for purchase by adults.

Where a parent or guardian supplies a child’s measurements or other information for a product, we ask that they provide only what is necessary for that request and are authorised to provide.

We do not seek children’s personal information for direct marketing.

If you believe a child has independently provided personal information to us, please contact cs@colourcloset.com. We will assess the circumstances and take appropriate steps, including deletion where required.

  1. EXTERNAL WEBSITES AND SOCIAL PLATFORMS

Our website may contain links to external websites, social networks or third-party services.

Those organisations’ privacy notices govern their independent collection and use of information. We encourage you to read those notices before providing information.

This section does not exclude our responsibility for the personal information we process or disclose through integrations used in our own services.

  1. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in our services, practices or legal requirements.

The updated version will be published on this page with a revised “Last updated” date. Where required, we will provide additional notice of material changes and obtain consent before introducing processing that requires new consent.

Changes to this policy do not remove rights that you already have under applicable law.

  1. CONTACT AND COMPLAINTS

For privacy questions, requests or complaints, contact:

Privacy Team — Colour Closet
Email: cs@colourcloset.com

Please provide sufficient information for us to understand and respond to your concern.

You may also complain directly to the competent data-protection authority where applicable. Depending on the relevant jurisdiction, this may include the UAE Data Office, a competent UAE free-zone authority, an EU/EEA supervisory authority or the UK Information Commissioner’s Office.

You do not have to contact us first where applicable law allows you to complain directly to an authority.