Privacy Policy.

This Privacy Policy explains how personal data is collected, used, disclosed, stored and protected when you visit daralpashmina.com, request private assistance, place or receive an order, arrange delivery or an exchange, or otherwise communicate with Dar Al Pashmina. It should be read with the Terms & Conditions, Delivery & Exchange Policy and Cookie Policy.

The data controller is Dar Al Pashmina for Clothing, a Single-Member Limited Liability Company (LLC), trading as Dar Al Pashmina, Commercial Registration number 252747, registered in the State of Qatar. Privacy contact: social.daralpashmina@gmail.com and +974 7474 5160.

In this Policy, “House”, “we”, “us” and “our” mean that controller; “you” means the visitor, enquirer, purchaser, recipient or other individual whose data is processed; and “personal data” means information relating to an identified or reasonably identifiable individual.

We process personal data fairly, transparently and for specific lawful purposes. We seek to collect only what is relevant and proportionate, keep it accurate where reasonably possible, restrict access, retain it no longer than needed, and use safeguards appropriate to the nature and risk of the processing.

We do not sell or rent personal data. We do not use information collected for one purpose in a materially incompatible way without a lawful basis, appropriate notice and, where Qatar law requires it, consent.

Where processing depends on consent, the request will be distinguishable and you may withdraw consent without affecting processing that was lawful before withdrawal. Some data remains necessary to take steps at your request, fulfil an accepted order, meet a legal obligation, protect security or establish and defend legal rights.

Depending on your interaction, we may collect identity and contact data such as name, email, Qatar telephone number, billing or delivery address, preferred language and recipient details; transaction data such as the Piece, quantity, price, order and invoice number, payment status, delivery and exchange history; and correspondence such as enquiries, preferences, complaints, photographs or videos you choose to provide.

Technical and usage data may include IP address, approximate location derived from it, browser and device type, operating system, referral source, pages and products viewed, session identifiers, timestamps, security events, ordering activity, language choice and cookie preferences. Marketing records may include consent, source, date, channel, campaign interaction and opt-out status.

At launch, payment is arranged through Fawran or cash on delivery. We may record the agreed method, amount, payment status and a limited transfer reference or delivery-payment confirmation. Never send a banking password, one-time passcode, complete payment-card number or card security code through WhatsApp, email or a website form.

We receive data directly when you browse, change language, manage cookie choices, complete a form, use private assistance, begin or place an order, communicate through email or WhatsApp, request delivery or an exchange, or exercise a right.

We may receive data from a purchaser arranging a gift, an authorized representative, payment or fraud-prevention provider, courier, hosting or security service, email or messaging provider, analytics platform used with the required permission, social-media platform when you interact with the House, and public or official sources where lawful.

If you give us another person’s data, including a gift recipient’s name, address or number, you confirm that you are authorized to provide it and have given that person any notice required. Supply only what is necessary.

The Website is an online luxury boutique for adults and is not directed at children. We do not knowingly seek personal data from a child. A purchaser should provide only the minimum delivery information needed for a minor gift recipient and must have parental or guardian authority where required.

We do not ask clients to send data of a special nature—such as health, religion, ethnicity, children’s information or other categories specially protected by Qatar law—unless genuinely necessary and lawfully permitted. Do not include such information in free-text messages, photographs or documents unless we specifically request it for a stated lawful purpose.

If we learn that data was supplied without the required authority or permission, we will take reasonable steps to restrict, verify or delete it. Any planned processing of special-nature data must undergo a separate assessment and obtain consent, permission or regulatory authorization where required before it begins.

When you ask about a Piece, authenticity, fibre, colour, care, gifting, availability or another service, we use the details and message you provide to understand the request, respond, keep an appropriate service record and follow up where reasonably expected.

Private assistance may operate through email and WhatsApp. WhatsApp is an independent service whose own terms and privacy practices apply, and messages may be processed on its systems. Do not send complete payment-card details, passwords, identification documents or unnecessary sensitive information through WhatsApp or ordinary email.

An enquiry does not automatically subscribe you to marketing. If you do not place an order, the enquiry record will be retained only for the period set in the final retention schedule, subject to legal, security or dispute needs.

We use order and contact data to verify stock, create the order record, communicate acceptance or refusal, arrange Fawran or cash-on-delivery payment, issue a dated invoice, prevent unauthorized transactions, fulfil the contract and meet accounting, consumer-protection and record-keeping obligations. Where Qatar law requires a refund or another remedy, we use the minimum data necessary to provide it.

Selecting “Order with the House” opens WhatsApp with the Piece details ready to share. The message begins an enquiry; the House then confirms availability, the complete amount, delivery arrangements and the available payment method. We may carry out proportionate identity, address and fraud checks. At launch, the House does not make solely automated decisions that produce legal or similarly significant effects.

For Fawran, we retain only the sender details, limited transfer reference, amount and status reasonably needed for reconciliation, disputes and compliance. For cash on delivery, we record the amount due and payment status. Do not send passwords, one-time passcodes or complete payment-card details through WhatsApp or email.

At launch, the House delivers only to supported addresses in Qatar. We use the purchaser’s and recipient’s name, Qatar number, address, access instructions, order reference and delivery status to prepare the single signature presentation, coordinate complimentary delivery, confirm receipt, investigate a failed delivery and protect the Piece in transit.

We disclose only the information reasonably required to the appointed courier or delivery coordinator. A recipient may be contacted even if they are not the purchaser. The purchaser should tell the recipient to expect this and should not provide private notes unrelated to delivery.

Delivery proof may include timestamp, status, recipient confirmation, signature, access note or a photograph that avoids unnecessary personal detail. The final delivery-provider contract and retention schedule must define what evidence is collected, who can see it and when it is deleted.

We use order, communication, collection and evidence data to assess an exchange request, damage report, authenticity or material concern, care enquiry, mandatory remedy, payment dispute, complaint or legal claim. Photographs or videos should show only the Piece, packaging and relevant damage unless another detail is genuinely necessary.

Records may be shared with the payment provider, courier, insurer, textile or authenticity specialist, legal adviser, regulator or court where relevant, proportionate and lawful. An adviser receives only what is needed for the assessment and must be subject to appropriate confidentiality and data-protection controls.

A privacy request will not erase information that must be retained to complete an active exchange, provide a remedy required by law, protect mandatory consumer rights, investigate suspected fraud or establish, exercise or defend a legal claim, but unnecessary data will not be kept merely because a dispute is possible.

WordPress and WooCommerce technology may use identifiers and technical records to maintain sessions, remember language or saved-item state, secure forms and ordering functions, prevent abuse, diagnose errors, balance traffic and preserve service availability.

If accounts are enabled, you are responsible for protecting credentials and telling us promptly of suspected unauthorized use. We may use login history, device and security events to verify access, investigate an incident and protect clients and the House.

Technical records are not used to identify a visitor beyond what is reasonably needed for operations, security, analytics used with the required permission or a lawful investigation. The final data-flow audit must identify the hosting, security, backup and account-service providers and their processing locations.

Cookies and similar storage may be essential to security, ordering functions, session continuity, language and recorded privacy choices. Strictly necessary technologies are used only to provide the service or choice you request and should be limited to what is necessary.

Analytics, advertising, social-media or other non-essential technologies must not be activated until the required consent or other lawful permission has been obtained. The control must allow a genuine choice by category, make refusal as accessible as acceptance, record the choice and allow it to be changed later.

Our Cookie Policy explains the categories of technologies used on the Website, their purposes and the choices available to you. We keep that notice aligned with the technologies actually in use.

An order, enquiry or WhatsApp conversation does not by itself authorize unrelated marketing. Promotional email, SMS or WhatsApp is sent only where the consent or other permission required by Qatar law has been obtained and the sender is clearly identified.

Every marketing message must provide a practical way to stop that channel. You may withdraw consent or object at any time through the message control or the privacy contact. We keep a minimal suppression record so that an opt-out is respected and do not require you to receive marketing as a condition of buying a Piece.

Order acknowledgements, payment or security checks, delivery coordination, exchange updates, product-safety or authenticity alerts and legal notices are service communications rather than marketing. They may continue where necessary even after promotional messages are declined.

If you contact or mention the House through Instagram, TikTok or another platform, that platform processes data under its own terms. We may receive the profile name, public content, message and engagement information made available to us. Avoid posting order numbers, addresses or other private data publicly.

A review, testimonial, photograph or repost is used in House marketing only with the permission required for that use. Consent to answer a service message is not consent to publish it. Permission may be withdrawn for future use, although material already lawfully printed or archived may not be immediately recoverable.

We may moderate unlawful, abusive, misleading, infringing or privacy-invasive content on channels we control, preserve proportionate evidence and report serious conduct where required.

We may appoint carefully selected providers for website hosting, ecommerce, security, backups, payments, fraud prevention, email, WhatsApp or other messaging, delivery, customer support, analytics used with permission, accounting and legal services. They receive only data relevant to their task and must be governed by suitable instructions, confidentiality, security and data-protection obligations.

We may disclose data where reasonably necessary to comply with law, a binding request or court order; protect a person, the House or its rights; investigate fraud or a security incident; complete a corporate reorganization or business transfer with appropriate safeguards; or cooperate with a competent regulator. We assess the authority, scope and proportionality of a request where permitted.

We do not sell or rent client data. We review service providers before appointment, limit their use of personal data to the service instructed, and require appropriate confidentiality, security, retention and deletion safeguards.

Some technology, payment, communications, cloud, security or support providers may access, store or otherwise process data outside Qatar. The final data map must identify those destinations rather than using a general statement alone.

Before a cross-border arrangement is used, we assess whether it is lawful, necessary and subject to contractual, organizational and technical safeguards designed to maintain at least the protection required by Qatar law and prevent serious harm to privacy. We limit the data and access to what the service requires.

You may ask for information about the categories of overseas recipient and safeguards relevant to your data. Commercially confidential or security-sensitive details may be summarized rather than disclosed in a way that weakens protection.

We keep personal data only for the period reasonably necessary for the stated purpose and any applicable legal, accounting, consumer-protection, fraud, tax, warranty, dispute or regulatory requirement. We then securely delete, anonymize or isolate it unless continued retention is lawfully required.

Our retention schedule covers at least: enquiries and uncompleted order conversations 24 months after the last contact; orders, invoices and payment references up to 10 years, or longer where Qatar law requires; delivery proof 3 years after delivery; exchanges, complaints and claims 3 years after final resolution; security logs 12 months unless an incident requires longer retention; marketing records and suppression lists until consent is withdrawn or after 24 months of inactivity; and each cookie duration in the Cookie Policy.

Retention periods may be extended for a legal hold, active investigation or unresolved claim and shortened where data is no longer needed. Backup deletion may follow a controlled rotation cycle, during which restored data remains protected and is not returned to ordinary use.

We use proportionate administrative, technical and physical measures intended to protect confidentiality, integrity and availability. Measures may include role-based access, strong authentication, encryption where appropriate and supported, updates and patching, secure configuration, backups, logging, supplier assessment, incident procedures and confidentiality obligations.

Access is limited to people and providers who need it for an authorized purpose. We review access and seek to remove it promptly when no longer required. Payment data is handled through the selected payment architecture and should not be copied into ordinary messages or service notes.

No website, transmission or storage system can be guaranteed completely secure. You should use a unique password if accounts are enabled, protect your device and authentication codes, confirm that communications come from an official House channel and tell us promptly if you suspect fraud or unauthorized access.

If a suspected personal data breach occurs, we will activate an incident process to contain it, preserve evidence, assess the data and individuals affected, reduce harm, recover securely and document decisions. Relevant processors must notify the House and cooperate without undue delay under their contracts.

Where Qatar law requires it, we will notify the National Cyber Security Agency’s competent privacy function and affected individuals, providing the information and practical protective steps appropriate to the risk. A notification may be phased while facts are investigated.

Security, fraud, recall and breach communications are essential service messages and may be sent even where marketing is declined. We will not ask you by an unsolicited message to disclose a full password, one-time passcode or complete payment-card security information.

Subject to Qatar law and any applicable exception, you may request information about processing; access or review relevant personal data; correct inaccurate or incomplete data; object to processing; withdraw consent; request deletion; and notify us of an inaccurate or unlawful disclosure. You may also complain to the competent authority.

Send a request to social.daralpashmina@gmail.com or through Private Assistance, stating your name, contact detail, relationship to the House, the right requested and enough information to locate the relevant record. We may ask for proportionate identity or authority evidence and will not request more than needed. An authorized representative must prove authority.

We will acknowledge, assess and respond within the period required by Qatar law and the final rights procedure: within 30 calendar days where practicable, and otherwise within the period required by applicable law. If a request is restricted or refused, we will explain the reason and available complaint route where required. A right is not absolute where data must lawfully be retained or another person’s rights, security or legal proceedings would be adversely affected.

Please raise a privacy concern first with the House at social.daralpashmina@gmail.com so we can investigate and respond. This does not affect your right to complain to the Personal Data Privacy Protection function of Qatar’s National Cyber Security Agency or another competent authority. Current official guidance and complaint information are available through the NCSA guidance hub for individuals.

We may update this Policy prospectively when law, technology, providers or services change. We will publish the revised effective date and, where a change materially affects existing processing, provide an appropriate notice or seek renewed consent where required. Earlier versions should be archived so the notice applicable at a transaction date can be identified.

English and Arabic versions are provided for accessibility. This Policy is interpreted in accordance with the mandatory laws of the State of Qatar. Effective date: 3 October 2026. Version: 1.0.