Privacy Notice · Zohoor

1Who is responsible

1.1I T D Innovation Information Technology L.L.C, Garhoud Views Building, 7th Floor, Office 711-01, Dubai, United Arab Emirates, is the controller of the personal data described in this notice. Privacy questions and requests: info@zohoor.ae (subject "Privacy"). The person responsible for data protection can be reached at the same address.

1.2Partner shops that fulfil your order receive your delivery details and are separately responsible for them as independent controllers, as explained in section 7.

2What we collect

2.1

Customers:

aaccount details: name, email address, mobile number, password (stored only as a salted hash), language, the "offers by email" choice, and the date you accepted the Terms and this notice;
bconfirmation codes sent by email and WhatsApp, with the time and the number of attempts;
corders: the items, prices, promo code and bonus points, the recipient's name, phone number and address, the optional map pin, the delivery date and slot, the card message, the surprise option, and the order's history;
dpayments: the payment status, the last four digits and brand of the card used, refunds and declines, as reported by Stripe; never your full card number;
esaved addresses, favourites, saved events (birthdays and anniversaries you choose to add), waiting-list items, reviews, reports and blocks, support messages and complaints;
fZohoor Studio designs, design requests, uploaded design pictures and quotes;
gconversations with the Zohoor assistant (section 6).

2.2

Partner shops:

athe shop's legal and trading name, licence number and expiry, licensing authority, company type, address, map pin, opening hours and delivery settings;
bthe owner's or manager's name, email, mobile number, passport and Emirates ID copies, and the memorandum of association where required;
cbank name, account name, IBAN and bank proof; TRN and VAT certificate;
dproducts, photos, promotions, orders, quotes, payouts, invoices, messages with the Zohoor team and the account's history of changes.

2.3

Recipients of gifts:

athe name, phone number and address the sender gives us, used only to deliver the gift and, if the recipient has a Zohoor account with that number, to show them that a delivery is on its way (without the price or, for surprises, the card message).

2.4

All visitors:

atechnical data: IP address, browser and device type, pages requested, time and errors, kept in server and security logs; the cookies and local storage described in the Cookie Policy (language, chosen emirate, approximate location if you allow it, bag, session);
bthe details you type into the coming-soon or contact forms, and messages you send us by email or WhatsApp.

2.5We do not ask for data about your religion, health, ethnicity or other sensitive categories. A card message or a saved event may reveal such information; it is used only to fulfil the order or the reminder you asked for.

3Why we use it and on what basis

3.1

We process personal data for the following purposes, on the legal bases the PDPL provides:

ato run your account, confirm your contact details, take and deliver your orders, process payments and refunds, issue invoices and pay partner shops: performance of the contract with you;
bto verify partner shops, keep tax and accounting records, respond to regulators and courts, and prevent fraud: compliance with our legal obligations under UAE commercial, tax and consumer protection law;
cto send transactional emails and WhatsApp messages about your account and orders, answer support requests and handle complaints: performance of the contract and our legitimate interest in running the service;
dto keep the Platform secure (rate limits, sign-in lockouts, security logs) and to improve it using aggregated usage data: our legitimate interests;
eto send marketing by email or WhatsApp, to use your approximate location to show nearby shops, and to use the AI assistant: your consent, which you can withdraw at any time (sections 5 and 6);
fto publish reviews with your first name and to show recipients that a gift is on its way: performance of the contract and our legitimate interest in a trustworthy marketplace.

3.2We do not sell personal data and do not use it for automated decisions with legal or similarly significant effects. Bonus points, promo-code checks and fraud checks are rule-based calculations on your own orders.

4Payments and saved cards

4.1Card payments, Apple Pay and Google Pay are processed by Stripe Payments Europe Ltd. and its affiliates ("Stripe") on Zohoor's account. Your card details are entered into Stripe's secure form and go directly to Stripe; Zohoor receives only a token, the card brand, the last four digits and the outcome. Stripe is a PCI DSS Level 1 certified processor and acts as our processor and, for its own fraud prevention and regulatory duties, as an independent controller under its own privacy policy (stripe.com/privacy).

4.2If you choose to save a card, Stripe stores it against your Zohoor customer record so it can be offered at your next checkout. You can remove a saved card in your account or by asking support; Zohoor records only that it was removed.

5Marketing and messages

5.1Transactional messages (confirmation codes, order updates, payout notices, replies to your messages) are sent by email from our zohoor.ae mailboxes and, for codes and some order updates, by WhatsApp from Zohoor's WhatsApp Business number. They are part of the service and are sent whether or not you opted in to marketing.

5.2Marketing emails (offers, seasonal collections, news) are sent only if you ticked "send me offers by email" or subscribed later. Every marketing email has an unsubscribe link and supports one-click unsubscribe; you can also switch offers off in your account. Marketing emails contain an open pixel and tracked links so we know which campaigns are read; transactional emails do not.

5.3WhatsApp marketing is sent only to numbers that opted in, using message templates approved by Meta. Reply STOP to any WhatsApp message from us to opt out; your number is then excluded from campaigns. Replies you send to our WhatsApp number are stored in our customer relationship system so our team can follow up.

5.4Partner shop sign-ups, contact messages, WhatsApp chats and large orders may be recorded as leads in our internal CRM so that our team can follow up on them. You can ask us to stop at any time.

6The Zohoor assistant and AI features

6.1The Zohoor assistant is powered by a third-party large language model chosen by Zohoor (one of Anthropic Claude, OpenAI, Google Gemini or an open-source model hosted by a provider). When you chat with it, the messages you type, the conversation so far and the results of the tools it uses on your behalf (for example your order list, product search results or your saved addresses) are sent to that provider to generate the reply. Our contracts with these providers do not allow them to use the data to train their models.

6.2Please do not type card numbers, passwords or other people's private details into the assistant. Conversations are stored with your account (or, for guests, under an unguessable conversation id kept in your browser) so you can continue them, and can be read by the Zohoor team to handle a complaint or improve the service. Anything the assistant proposes that changes your account or an order is done only after you press Confirm.

6.3In Zohoor Studio, the words you type to describe a design and the design on screen may be sent to the same AI provider to suggest a design. Suggestions are only suggestions; the final design and any quote come from you and the partner shop.

7Who we share data with

7.1

We share personal data only as needed to run the service:

aPartner shops: for each order, the recipient's name, phone number, address and map pin, the delivery date and slot, the card message, your name and, where needed, your phone number. The shop uses them only to prepare, deliver and handle complaints about that order and is bound by the Partner Terms to delete copies afterwards.
bStripe: payment processing, saved cards, refunds and fraud prevention (section 4).
cHostinger International Ltd.: the mail server that sends and receives our email; a copy of each email we send is kept in our own log.
dMeta Platforms (WhatsApp Business Platform): delivery of confirmation codes and WhatsApp messages; Meta receives your phone number and the message content under its own terms.
eAmazon Web Services (AWS Lightsail): hosting of the Platform and its database (section 8).
fCloudflare, Inc., where enabled: a network layer in front of the website that filters attacks and caches pages; it sees IP addresses and requests in transit.
gThe AI provider chosen for the assistant (section 6).
hOdoo, where we use it for accounting: customer and partner contact details, orders, invoices and payouts are copied to our accounting system.
iOpenStreetMap (Nominatim) for address lookup when you place a map pin, and OpenStreetMap tile servers for the maps in our apps: these receive the address text or map area you look at and your IP address.
jGoogle Fonts, which the website loads for its typefaces; Google receives your IP address with the font request.
kProfessional advisers, banks (for payouts to partner shops), and authorities, courts or regulators where the law requires or allows it, including the UAE Data Office, the Federal Tax Authority and consumer protection authorities.

7.2If the business is sold or merged, data may be transferred to the new owner under the same commitments. We use no third-party advertising networks, analytics trackers or social media pixels on the website or in the apps.

8Where data is stored and cross-border transfers

8.1The Platform and its database are hosted on Amazon Web Services (Lightsail) in the Mumbai region, India, with encrypted backups in the same region. Stripe, Meta, Google, Cloudflare, Hostinger and the AI providers process data in their own regions, which may include the European Union and the United States.

8.2These are transfers of personal data outside the UAE. Under Articles 22 and 23 of the PDPL we make them on the basis of contracts with each provider that require a level of protection equivalent to the PDPL (including data processing terms and, where offered, standard contractual clauses), the provider's security certifications, and, for providers you interact with directly (Apple Pay, Google Pay, WhatsApp), your request for that service. You can ask us for more information about these safeguards.

9How long we keep data

9.1

We keep personal data only as long as needed for the purpose it was collected for:

aaccount details: while the account is open and for up to 12 months after it is closed, unless an order record requires longer;
borders, invoices, payments, refunds, commission invoices and payouts: 5 years after the end of the year concerned, as required by UAE VAT and commercial law;
cpartner verification documents: while the shop is on the Platform and 5 years after it leaves, for the same reasons; rejected documents are deleted once replaced;
dconfirmation codes: one hour; sign-in attempt records: 24 hours; security events (rate limits, lockouts): 30 days; server and access logs: up to 90 days;
esent emails and WhatsApp message logs: 24 months; marketing consent and unsubscribe records: for as long as needed to honour your choice;
fassistant conversations: 12 months from the last message, or until you ask us to delete them;
greviews: while the shop and the order record exist; reports and complaints: 3 years after closure.

9.2When an account with orders is closed we disable it and remove what we can (saved cards, addresses, favourites, events, marketing consent) while keeping the order and invoice records the law requires, with access restricted to finance and legal needs.

10How we protect data

10.1All traffic to the website, the apps and the API is encrypted with TLS. Passwords and confirmation codes are stored only as salted hashes. API keys and tokens for third-party services are stored encrypted. Access to the admin console is limited to named Zohoor staff with individual accounts, and every change made from it to a customer or partner account is logged. Sign-ins are rate-limited and locked after repeated failures; a daily security summary goes to the team. Backups are encrypted. Partner shops see only their own orders, and customers only their own data.

10.2No system is completely secure. If a breach of personal data is likely to harm you we will inform the UAE Data Office and you as the PDPL requires.

11Your rights

11.1

Under the PDPL you have the right to:

aaccess the personal data we hold about you and receive a copy, including in a structured, machine-readable format (portability);
bcorrect inaccurate or incomplete data; most of it you can change yourself in your account;
cask us to delete your data, subject to the records we must keep by law (section 9);
drestrict or object to processing, including to direct marketing at any time;
ewithdraw consent (marketing, location, AI assistant) without affecting processing done before;
fnot be subject to decisions based solely on automated processing that affect you legally or significantly;
glodge a complaint with the UAE Data Office if you believe we have not handled your data lawfully.

11.2To exercise a right, email info@zohoor.ae from the address on your account, or write to our office. We may ask you to confirm your identity. We answer within 30 days; complex requests may take longer, and we will tell you if so. Requests are free unless they are clearly repetitive or excessive.

12Children

12.1The Platform is for adults. You must be 18 or older to create an account or order. We do not knowingly collect data from children; if you believe a child has given us personal data, contact us and we will delete it.

13Changes to this notice

13.1We update this notice when our practices, providers or the law change. The date at the top shows the version in force; material changes are announced by email or a notice on the Platform before they take effect.

14Contact

14.1I T D Innovation Information Technology L.L.C, Garhoud Views Building, 7th Floor, Office 711-01, Dubai, United Arab Emirates. Privacy requests: info@zohoor.ae. General enquiries: info@zohoor.ae.