Privacy policy

Who We Are

KAŠTEL is owned and operated by Kastel Studio FZ LLC ("we," "us," "our"), operating the online store at kastel.ae. This policy outlines how we collect, process, store, and protect your personal data when you visit or make a purchase from our storefront, in compliance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL).
For any privacy-related inquiries or to exercise your statutory rights, contact our Data Privacy Lead at concierge@kastel.ae.

Personal Data We Collect

We collect personal data directly from you and automatically through your interaction with our storefront:

Order & Delivery Information: First and last name, shipping address, mobile phone number, and email address. We collect this to fulfill, process, and deliver your orders.
Payment Information: We do not store or collect raw credit card or payment credentials. All payment transactions are processed securely via our PCI-DSS compliant payment gateway, Stripe (see Section 4).
Technical & Browsing Information: IP address, browser type, device identifiers, operating system, and site usage data (pages viewed, cart additions). This data is collected automatically via cookies and tracking technologies.

Legal Grounds & Purposes of Processing

Under the UAE PDPL, we process your personal data under the following lawful bases:

Data Category	Purpose of Processing	Lawful Basis (PDPL)
Name, Delivery Address, Phone, Email	Fulfilling orders, logistics, transactional updates, customer support	Performance of Contract
Payment Credentials	Executing order payments and refunds	Performance of Contract (handled via Stripe)
Technical & Device Data	Website security, fraud prevention, site optimization	Legitimate Interest / Operational Security
Marketing Cookies & Analytics	Ad attribution, site performance measurement	Explicit Consent (via Cookie Banner)
Marketing Email / SMS	Sending newsletters, brand updates, and special offers	Explicit Consent (Opt-in at checkout/signup)

(Note: You may withdraw consent for marketing or non-essential cookies at any time as detailed in Sections 5 and 7).

Sharing & International Data Transfers

We do not sell, rent, or trade your personal data. We only share necessary data with trusted service providers who assist in operating our business:

Shopify: Our e-commerce platform provider, storing order and account records.
Stripe: Our payment processor. Payment credentials are directly encrypted and handled under Stripe’s PCI-DSS compliant infrastructure.
Designated Domestic Logistics Partners: We share your name, shipping address, and phone number with our local courier partners solely to schedule and complete door-to-door delivery and send status alerts.

International Transfers: Certain service providers (such as Shopify and Stripe) store and process data on cloud infrastructure located outside the UAE. Where international data transfers occur, they are executed in compliance with Articles 22 and 23 of UAE Federal Decree-Law No. 45 of 2021, using standard contractual clauses or recognized adequacy safeguards to ensure a comparable level of data protection.

Cookies & Tracking Technologies

We utilize the following cookie classifications on kastel.ae:

Essential Cookies: Necessary for core site functionality, including shopping cart maintenance and secure checkout. These cannot be disabled.
Analytics Cookies: Help us aggregate anonymized traffic patterns to improve site navigation and customer experience.
Marketing & Advertising Pixels: Allow us to deliver relevant advertising and measure campaign effectiveness across partner platforms (e.g., Meta, Google).

You can manage non-essential cookie preferences at any time via our site cookie banner or through your web browser settings. Disabling non-essential cookies will not impact your ability to place an order.

Data Retention Schedule

In accordance with UAE statutory mandates, we adhere to the following retention timelines:

Transaction & Tax Records: Retained for seven (7) years to comply with UAE Federal Tax Authority (FTA) requirements for VAT and Corporate Tax.
Customer Account & Marketing Profiles: Retained until consent is withdrawn or after three (3) years of continuous inactivity.
Technical & Security Logs: Retained for twelve (12) months for system security and fraud prevention audit trails.

Marketing Communications & Preferences

Transactional vs. Marketing Messages: Your mobile phone number and email address collected during checkout are used strictly for transactional communications (order receipts, shipping tracking). We will never send promotional SMS or phone calls unless you explicitly opt in.
Opting Out: You may unsubscribe from promotional emails at any time by clicking the "Unsubscribe" link at the bottom of any marketing email or by contacting concierge@kastel.ae. To opt out of promotional SMS, reply "STOP" to any marketing text.

Your Statutory Rights Under UAE Law

Subject to statutory exceptions under UAE Federal Decree-Law No. 45 of 2021, you possess the following rights regarding your personal data:

Right to Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete personal records.
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where retention is no longer legally required.
Right to Restrict or Object to Processing: Limit or object to data processing based on legitimate interests or automated decision-making.
Right to Data Portability: Receive your personal data in a structured, machine-readable format.
Right to Withdraw Consent: Revoke consent for marketing or non-essential cookies at any time without affecting prior lawful processing.

To submit a request, contact concierge@kastel.ae. We respond to all validated requests within thirty (30) days. You also maintain the right to lodge a complaint with the UAE Data Office if you believe your privacy rights have been infringed.

Data Security & Breach Notification

We employ industry-standard technical and organizational safeguards—including SSL/TLS encryption, restricted administrative access, and PCI-compliant payment integrations—to protect your personal information against unauthorized access, loss, or disclosure. In the unlikely event of a security breach impacting your personal data, KAŠTEL will notify affected individuals and the competent UAE authority in accordance with statutory PDPL timelines.

Minors

Our storefront is intended for adult consumers. We do not knowingly collect or process personal data from individuals under eighteen (18) years of age.

Amendments to This Policy

We may periodically update this Privacy Policy to reflect regulatory or operational changes. Updates take effect immediately upon posting, with the revised date noted at the top of the policy page.