Privacy Policy

Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website (“Website”) or use our services. Please read this Privacy Policy carefully. If you do not agree with its terms, you should not access or use our services. Where we rely on your consent to process personal data, we will obtain such consent separately through a clear affirmative action; your mere use of the Website does not constitute consent for those processing activities.

1. Scope of this Policy

This Policy applies to personal data we collect from users who sign up for an account with limbacosmetics.ae, whether from within or outside the United Arab Emirates. It explains our data processing practices, the lawful bases on which we rely, and your rights under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, “PDPL”).

2. Personal Data We Collect

Account Registration Information

Contact details: full name, company name, email address, phone number, address and VAT/tax number.

Credentials: username, password, and other information required to create an account.

Payment Information

Billing details: credit/debit cardholder name, partial card details (e.g., last four digits), and/or information related to other payment methods (PayPal, bank transfer, card type).

Note: We do not store your full credit card details. We store only tokens or references provided by our payment gateway, as required for recurring billing and to prevent fraudulent transactions.

Identity Verification (Sensitive Data)

To verify legitimate account ownership or payment, we may request a copy of your government-issued ID (e.g., Emirates ID or passport) and/or a “selfie” image. These data are considered sensitive personal data under the PDPL as they may reveal biometric information. We will only process such data after obtaining your explicit consent (for example, by asking you to tick a dedicated checkbox when uploading the documents), unless the processing is necessary to comply with a legal obligation. You may withdraw your consent at any time; however, this may affect our ability to complete the verification process.

Domain and Hosting-Related Information

Domain registration details: WHOIS or registry information that may include personal data such as name, address, email, and phone number, as required by domain registries.

Server logs and usage data: IP addresses, browser type, operating system, access times, and referring URLs for security and troubleshooting purposes.

Communication Data

Records of emails or other messages you send to us, including technical support requests, billing inquiries, and other interactions. This applies to all channels such as phone calls, support tickets, emails, WhatsApp chat, live chat, social network messages and any other official channel that we use.

Cookies and Tracking Technologies

We use cookies and similar technologies to enhance user experience, maintain session information, and analyze site usage. For non-essential cookies, we obtain your prior consent through a cookie consent management tool displayed when you first visit our Website. You can change your preferences or withdraw your consent at any time by clicking the “Cookie Settings” link on our Website. You may also control cookies via your browser settings, but disabling certain cookies may affect the functionality of the Website.

3. Lawful Bases for Processing

We collect and process personal data under the following lawful bases:

Consent: Where you have given clear, specific, and informed consent (e.g., by opting in to marketing communications or providing explicit consent for identity verification). For sensitive personal data, we rely on your explicit consent unless a legal obligation applies.

Contractual Necessity: Where processing is necessary to provide the services you request (e.g., domain registration, hosting services, account management).

Legitimate Interests: For activities such as fraud prevention, network and information security, and improving our services, provided these interests do not override your fundamental rights and freedoms.

Legal Obligations: Where we must comply with applicable UAE laws, regulations, or court orders.

4. How We Use Your Personal Data

Service Provision: To register domains, set up hosting accounts, process payments, and provide customer support.

Account Management: To send you important account updates, renewal notices, and customer service messages.

Verification and Security: To verify your identity (with your explicit consent where required), process payments securely, and protect against fraud or abuse.

Improving Our Services: To analyze performance, troubleshoot technical issues, and enhance the user experience.

Marketing Communications: Where you have consented, we may send you promotional materials or newsletters. You can opt out at any time by using the unsubscribe link or contacting us.

Legal Compliance: To comply with UAE laws, respond to lawful requests by public authorities, or as otherwise required by law.

5. Disclosure of Personal Data

We may share personal data only in the following circumstances:

Service Providers: With payment processors, domain registries, data center providers, or third-party tools needed to deliver our services. These parties process data on our behalf, subject to strict confidentiality obligations.

Legal or Regulatory Requirements: Where we are legally required to disclose or otherwise believe in good faith that disclosure is necessary to comply with legal processes, protect our rights, investigate fraud, or respond to lawful requests.

Business Transfers: If we undergo a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to the same confidentiality commitments.

We do not sell or rent your personal data to third parties.

6. International Data Transfers

Your personal data may be transferred and stored on servers located outside the UAE. We ensure that any cross-border data transfer complies with the PDPL by implementing appropriate safeguards (e.g., contractual clauses, technical security measures) to protect your personal data.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, in accordance with the following retention periods:

Account Data: Information associated with your account (e.g., contact details, credentials, communication records) will be deleted 180 days after account closure, unless a longer period is required by law or for the establishment, exercise, or defense of legal claims.

Transaction/Financial Records: Invoices, payment records and related financial data are retained for 5 to 10 years to comply with applicable financial, tax, and accounting regulations.

Marketing Data: Personal data processed for marketing purposes is retained until you withdraw your consent. Upon withdrawal, such data will be deleted from our marketing systems without undue delay.

Identity Verification Documents: Copies of IDs and selfies will be deleted as soon as the verification process is completed and no later than 90 days, unless retention is required by applicable laws.

When personal data is no longer required, we will securely delete or anonymize it.

8. Your Rights

Subject to applicable UAE law and any exemptions provided therein, you have the following rights:

Access: Request a copy of the personal data we hold about you.

Rectification: Ask us to correct any inaccurate or incomplete personal data.

Erasure: Request deletion of your personal data under certain conditions (e.g., where the data is no longer necessary for the purpose for which it was collected).

Object or Restrict: Object to certain processing or request that we restrict processing of your personal data.

Portability: Request to receive your personal data in a structured, commonly used and machine-readable format, and have it transferred to another controller where technically feasible.

Withdraw Consent: Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Lodge a Complaint: You have the right to lodge a complaint with the UAE Data Office or any other competent supervisory authority if you believe that our processing of your personal data infringes applicable data protection laws.

To exercise any of these rights, please contact us using the details provided below. We will respond to your request in accordance with the timelines and requirements set out in the PDPL.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These measures include:

Secure socket layer (SSL) encryption for data transmissions

Tokenized payment processing (we do not store full credit card details)

Restricted access to personal data on a need-to-know basis

Regular security audits and intrusion detection systems

However, no method of transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security.

10. Cookies and Tracking Technologies

We use cookies and similar technologies (e.g., web beacons, pixel tags) to collect information about how you interact with our Website, enhance your user experience, and personalize content. When you first visit our Website, a cookie banner will appear asking you to set your preferences. You can accept all cookies, reject non-essential cookies, or customize your choices. Necessary cookies (those required for the operation of the Website) are set automatically, while all other cookies are only activated after you grant your consent. You may change your settings or withdraw your consent at any time via the “Cookie Settings” link available on our Website. Please note that adjusting your browser settings to block all cookies may affect the functionality of certain features.

11. Third-Party Links

Our Website or services may contain links to third-party websites. We are not responsible for the privacy practices or content of these sites. We encourage you to review the privacy policies of any external sites you visit.

12. Minors’ Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can delete the data.

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or UAE legal requirements. We will post the revised Policy with an updated “Last Updated” date. Where changes materially affect your rights or the way we use personal data, we will notify you in advance. Your continued use of our services following such notification will be subject to the terms of the updated Policy.

Note: limbacosmetics.ae is a legal entity registered in the United Arab Emirates and we also maintain a GDPR/Cookie policy for our EU customers.

If you have any questions about this Privacy Policy, please contact our team via email, live chat or hotline.