1. Data Controller
The data controller responsible for your personal data is:
- The French Facialist by Céline
- Location: United Arab Emirates
- Email: contact@thefrenchfacialist.ae
This Privacy Policy explains how we process personal data in connection with our Website, online store, treatment bookings, and customer communications, in accordance with applicable data protection laws, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) where applicable.
2. Personal Data We Collect
We may collect the following categories of personal data:
2.1 Data you provide directly
- Identity & contact: name, email address, phone number, delivery and billing address;
- Account: login credentials (password stored in encrypted form);
- Orders: purchase history, product preferences, wishlist items;
- Bookings: treatment preferences, appointment details, location, skin concerns, and messages exchanged via WhatsApp;
- Communications: messages sent via contact forms, email, or WhatsApp;
- Refund requests: reason for return, supporting information.
2.2 Data collected automatically
- Technical data: IP address, browser type, device information, operating system;
- Usage data: pages visited, time spent, referral source, click behaviour;
- Cookies & similar technologies: see Section 8 below.
2.3 Payment data
Payment card details are processed directly by Stripe, our payment service provider. We do not store your full card number or CVV on our servers. We may retain transaction references, payment status, and billing metadata.
3. How We Use Your Data
We use your personal data for the following purposes:
- Processing and fulfilling product orders;
- Managing treatment appointments and sending confirmations or reminders;
- Creating and managing your customer account;
- Processing payments and refunds;
- Providing customer support and responding to enquiries;
- Sending transactional emails (order confirmations, shipping updates, refund notifications);
- Improving our Website, products, and services;
- Detecting and preventing fraud or abuse;
- Complying with legal and regulatory obligations;
- Sending marketing communications — only where you have given consent or where permitted by law (you may opt out at any time).
4. Legal Basis for Processing
Depending on the context, we process your data on the basis of:
- Contract performance: to process your orders and bookings;
- Legitimate interests: to improve our services, prevent fraud, and ensure Website security;
- Legal obligation: to comply with tax, accounting, and regulatory requirements;
- Consent: for marketing communications and non-essential cookies, where required.
6. International Data Transfers
Your data may be processed in the United Arab Emirates and in other countries where our service providers operate (including the European Union and the United States). Where data is transferred outside the UAE, we ensure appropriate safeguards are in place as required by applicable law.
7. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including:
- Account data: for the duration of your account, plus a reasonable period after closure;
- Order & transaction records: as required for tax, accounting, and legal compliance (typically up to 7 years);
- Marketing preferences: until you withdraw consent or object;
- Support communications: up to 3 years after resolution.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption (SSL/TLS), access controls, and secure payment processing via Stripe.
However, no method of transmission over the Internet is completely secure. While we strive to protect your data, we cannot guarantee absolute security.
10. Your Rights
Subject to applicable law, you may have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Delete your data (subject to legal retention obligations);
- Restrict or object to certain processing;
- Data portability — receive your data in a structured format;
- Withdraw consent at any time for consent-based processing;
- Opt out of marketing communications.
To exercise your rights, contact us at contact@thefrenchfacialist.ae. We will respond within the timeframe required by applicable law. You may also have the right to lodge a complaint with the relevant data protection authority in the UAE.
11. Children's Privacy
Our Website and services are not directed at individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, please contact us immediately and we will delete it.
12. Third-Party Links
Our Website may contain links to third-party websites (e.g. social media, WhatsApp). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this page periodically.
14. Contact Us
For privacy-related enquiries or to exercise your rights:
- Email: contact@thefrenchfacialist.ae
- Subject line: "Privacy Request — [Your Name]"