Saffron Lane Boutique collects only the personal data needed to sell, deliver and alter your pieces, answer your questions and improve our shop. We do not sell your data. This policy explains what we collect, why, who handles it, how long we keep it and how to exercise your rights under UAE law.
Who is responsible for your data
The data controller is Saffron Lane Boutique (a demonstration business operated on SmartPOS Hub), with stores at Villa 21, Jumeirah Beach Road, Jumeirah 1, Dubai, and Shop 9, Ground Floor, Al Barsha Boulevard Plaza, Al Barsha 1, Dubai. You can reach us through the form on our contact page or on WhatsApp at +971 4 349 2210.
We process personal data in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the UAE PDPL) and, for purchases, the UAE Federal Law No. 15 of 2020 on Consumer Protection.
What we collect
We collect data you give us and a small amount of data created when you use the site.
- Order details: name, mobile number, email, delivery address, chosen store for click & collect, the pieces you order, sizes and abaya lengths, gift notes and order notes.
- Payment information: the payment method you choose, and proof of payment if you pay by bank transfer and upload it on your order page. Where online card payment is enabled, card details are entered with the payment provider; we do not store full card numbers.
- Account details: if you create an account at /account, your profile, saved addresses, wishlist, reviews, questions you ask about products and loyalty points where enabled.
- Form entries: messages from the contact form and styling appointment requests from /styling, including the service, store, preferred date and time, and any sizes or notes you share.
- Website activity: pages and products viewed, searches and orders, recorded first-party in SmartPOS, our own point-of-sale system. Campaign source (UTM) and an anonymous visitor ID are recorded only after you accept analytics cookies.
- Technical data: browser type, device and the security information needed to keep the site safe and to prevent duplicate orders.
We do not ask for Emirates ID, passport numbers or health information, and we ask you not to send them.
Why we use it
| Purpose | Data used | Basis |
|---|---|---|
| Taking, delivering and collecting orders | Order, contact and payment details | Performing our contract with you |
| Alterations, styling and made-to-measure appointments | Form entries, sizes, notes | Your request and our contract |
| Exchanges, refunds and invoices | Order and payment records | Contract and legal obligations |
| Answering questions | Contact form entries, WhatsApp messages | Your request |
| Improving the shop (popular pieces, search terms) | Website activity | Legitimate interest, consent-aware |
| Campaign measurement | sf_utm, sp_vid, analytics tags |
Your consent |
| Security and fraud prevention | Technical data | Legitimate interest and legal obligations |
We send marketing messages, such as The Edit newsletter, only if you subscribe, and every message lets you unsubscribe.
Who we share it with
We share personal data only where it is needed to serve you:
- SmartPOS Hub, which hosts our shop, stores, orders and customer records.
- Delivery couriers, who receive your name, mobile number and address to deliver or collect a parcel in the UAE.
- Payment providers, where online card payment is enabled.
- Our own tools, to which form entries may be delivered by secure webhooks so a stylist can reply.
- Authorities, where UAE law requires it.
We never sell or rent personal data. Analytics and marketing tags (such as Google Analytics or Meta) load only after you consent; none are configured on this demo store by default.
How long we keep it
We keep order and invoice records for as long as UAE commercial and tax rules require. Account data is kept while your account is open and deleted or anonymised after you close it, except records we must keep. Form entries are kept for as long as needed to handle your request and any follow-up. Website activity is kept in aggregated or pseudonymous form for improving the shop.
How we protect it
Data is transmitted over encrypted connections. Account sign-in uses an httpOnly session cookie that page scripts cannot read. Access inside SmartPOS is limited to staff who need it for their role, and payment card data stays with the payment provider.
International transfers
Our service providers may process data on servers outside the UAE. Where that happens, we rely on the safeguards permitted under the UAE PDPL, such as countries with adequate protection or contractual protections.
Your rights
Under the UAE PDPL you may ask to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Delete data we no longer need, unless we must keep it by law.
- Restrict or object to certain processing, including direct marketing.
- Receive your data in a structured, commonly used format.
- Withdraw consent at any time, for example by changing your cookie choice.
Many details can be updated directly in your account. For anything else, send a request through our contact page or on WhatsApp. We may ask you to confirm your identity, and we reply within the time the law allows. If you are not satisfied, you may complain to the UAE Data Office.
Cookies and local storage
We use a small set of essential cookies, plus analytics only with your consent. The full list is in our Cookie Policy.
Children
Our shop is intended for adults. We do not knowingly collect data from children under 18; a parent or guardian should place orders on their behalf.
Changes to this policy
We update this policy when our practices or the law change. The date at the top shows the latest version. Significant changes are shown on the site before they take effect.