Privacy notice

Last updated: 21 October 2026

This notice explains how we use your personal data when you visit commercelia.com or buy from us, and the rights you have under UAE data protection law (Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, the "PDPL").

Who we are

Commercelia is run by Commercelia, a company in the SPC Free Zone, Sharjah, United Arab Emirates. Commercelia is the controller of your personal data.

What we collect

When you place an order

• Your name, email address and delivery address.
• Your UAE mobile number. It is required, because UAE addresses have no postcode and the courier phones you before delivering, and it is passed to the courier for that.
• Any delivery note you type at checkout.
• What you ordered and paid, any discount code or store credit used, and how your order is progressing.
• The internet (IP) address and browser details your order was placed from, kept with the order to help us spot and investigate fraud.

When you pay

• We never see or store your full card number. Card payments are handled by Stripe, which tells us only limited details such as the card type and last four digits.

If you create an account

• Your email address, first name and a password, which we store only in a scrambled (hashed) form that cannot be read back.
• Anything you add later: surname, phone number, saved addresses (up to ten), wishlist, product reviews and return requests.
• The products you look at while signed in ("Browsing history"), kept for 90 days. You can remove items or clear it in your account. We keep no browsing history for shoppers who are not signed in.
• Your store credit balance and how it was earned and spent.

When you search, track an order or sign in

• The words you search for and how many results they returned. If you are signed in, the search is linked to your account.
• To protect accounts and the order tracker from guessing attacks, we record the email address and IP address of sign-in attempts (kept for 7 days) and of order-tracking attempts (kept for 1 day).

When you contact us

• Whatever you send us, such as your email address, message and any photos.

Basket reminders, stock and price alerts, and review requests

• Basket reminders: if you are signed in and leave items in your basket, we may send one reminder (at most two) with what is in it and a link back to it. As a guest you get one only if you tick "Email me a reminder if I don't finish" at checkout; the box starts unticked, and nothing is stored unless you tick it. We then keep your email address with that basket.
• Back-in-stock and price-drop alerts: if you ask on a product page, we keep your email address, the item and (for a price alert) its price at the time. We email you once to confirm; nothing else is sent unless you confirm. Then we email you once when the item is back or cheaper, and the alert ends.
• Review requests: about a week after your order arrives we may email you once, asking for an honest review of what you bought. The link lets you review those items without signing in. We never offer anything in return for a review, and every review is checked the same way whatever its rating.
• Photos with a review: if you add photos to a review, we keep them with the review. We remove location and camera details (EXIF data) from them, and they appear only once our staff have approved them.
• Every one of these emails has an unsubscribe link, and you can choose which you get on the email preferences page linked from each email, or in Account settings. Emails about your orders always come.

Visitor statistics

We count visits with our own software on our own server. We do not use Google Analytics or any other outside analytics service, and we set no cookie for it.

• For each page view we record the page address (without anything after a "?"), the type of device (phone, tablet or computer), the name of the website that sent you and whether the visit looks automated.
• To count visits without following you, we turn your IP address and browser details into a one-way code that changes every day, so your visits on different days cannot be linked.
• We look up the town your internet address belongs to, on our own server, using a location database file kept on that server. The address is not sent anywhere for this. We keep only the country, the town and the town's approximate position. The address itself is not kept.
• These statistics are kept for up to about 400 days and then deleted.

Why we use it, and on what basis

• To take payment and deliver your order, run your account, and handle returns, refunds and store credit: performing our contract with you (or taking steps at your request before one).
• To reply to your messages: because you asked us to, or performing our contract where it concerns an order.
• To prevent fraud and keep the shop and accounts secure (order IP addresses, sign-in and tracking attempts): protecting our customers and our business, as part of providing the service you asked for, and where the law requires it.
• Visitor statistics and search words, to understand how the shop is used and improve it: using the minimum of data described above, and without identifying you.
• Keeping accounting and tax records: our legal obligations.
• Publishing your product review and its photos: performing our agreement with you when you choose to submit one.
• Basket reminders: for signed-in customers, as part of the account you created with us, with a free way to say no in every email and in Account settings; for guests, your consent, given by ticking the box at checkout.
• Back-in-stock and price-drop alerts: your consent, confirmed from the first email (double opt-in). You can withdraw it at any time with the link in the email.
• Review requests: to hear what customers think of what they bought, with a free way to say no in every email.

We do not send newsletters, and we do not make decisions about you by automated means that have legal or similarly significant effects.

Who we share it with

Only with those who help us run the shop, and only what each needs:

• Stripe, which processes card payments.
• Product Healer (producthealer.tech), the order-management service we use to pass orders to our suppliers. For items sent straight from a supplier, it receives the items ordered and your name, delivery address, phone number and email address, and deletes that address 30 days after the item is sent or the order is cancelled.
• Our suppliers and couriers, who receive what they need to pack and deliver your parcel.
• Our hosting and email providers, who store our data and deliver our emails.
• Professional advisers, the UAE Federal Tax Authority and other authorities, where the law requires it, to establish or defend legal claims, or to prevent fraud.
• A buyer of our business, if it is ever sold, who would have to use your data in line with this notice.

We do not sell your personal data, and we do not run advertising pixels, ad networks or social media tracking on this shop.

Transfers outside the UAE

Some of the companies above, such as payment providers and suppliers, may process your data outside the United Arab Emirates. Where they do, we aim to transfer it only as the PDPL allows, for example to a country with adequate data protection, under a contract that requires the recipient to protect it, or, for a supplier sending your order, where the transfer is necessary to perform our contract with you. Contact us for more detail.

Links and content from other sites

Tracking links open the courier's own website or 17TRACK, a parcel-tracking service. Some product pages have a supplier's video, loaded from the supplier's server only when you press play, which (like any website) sees your IP address. These sites have their own privacy notices.

Cookies

We use only essential cookies and browser storage, for example to keep your basket and sign-in working. See our Cookie policy for the full list.

How long we keep it

• Orders: for as long as UAE accounting and tax law requires us to keep them.
• Your account: until you ask us to close it. We then delete your account details, saved addresses, wishlist and browsing history, and keep only the order records above.
• Browsing history: 90 days. Sign-in attempts: 7 days. Order-tracking attempts: 1 day. Visitor statistics: about 400 days.
• Basket reminders: your email address is kept with the basket for the basket's lifetime (30 days), then removed; only the counts (sent, used, turned into an order) are kept.
• Stock and price alerts: unconfirmed requests 7 days; other alerts until they are sent or stopped, then 90 days, then deleted.
• Your email choices: if you unsubscribe, we keep your email address on our "do not send" list so that we can honour it.
• Reviews and their photos: while the review is shown on the shop, or until you ask us to remove it.
• Messages to us: as long as needed to deal with your query and any follow-up.

How we protect it

The site is served only over an encrypted (HTTPS) connection, passwords are stored hashed, card details never reach our servers, and only staff who need it can use our admin area.

Your rights

You have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data erased, where we no longer need it or have no legal basis to keep it;
• restrict how we use it in certain circumstances;
• object to, or ask us to stop, our use of it in the cases the law allows, including direct marketing;
• data portability: receive data you gave us, for a contract, in a machine-readable format.

We may ask you to confirm your identity, for example by writing from the email address on your account or orders. We aim to reply within one month, and will tell you if we need longer. There is normally no charge.

Complaints

If you are unhappy with how we have used your data, please contact us first so we can try to put it right. You may also have the right to complain to the UAE Data Office, the federal data protection authority under the PDPL.

Children

Our shop is not aimed at children, and we do not knowingly collect data from anyone under 13.

Changes to this notice

If we change this notice, we will publish the new version here with a new date.