9YAARDS FOR ONLINE SHOPPING
Website: www.9yaards.com
Effective date: [2nd Jul 2025]
Version: 1.0
Last reviewed: [1st August 2026]
Who we are
This Privacy Policy is issued by 9Yaards for Online Shopping (“9Yaards”, “we”, “us”, “our”), a company licensed by the Department of Economy and Tourism, Dubai, United Arab Emirates under trade licence number 1524187
We operate the website www.9yaards.com (the “Website”), through which we sell sarees and related apparel sourced from India to customers located in the United Arab Emirates.
For the purposes of applicable data protection legislation, 9Yaards is the Data Controller of the personal data described in this Policy.
Data protection contact: namaste@9yaards.com
2. Scope and applicable law
This Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and what rights you have.
We process personal data in accordance with:
- Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the “PDPL”)
- Federal Decree-Law No. 44 of 2021 establishing the UAE Data Office
- Federal Decree-Law No. 14 of 2023 on Trading by Modern Technological Means (the “E-Commerce Law”)
- Federal Law No. 15 of 2020 on Consumer Protection and its Executive Regulation, Cabinet Decision No. 66 of 2023
- Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services
- Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes
- Federal Decree-Law No. 20 of 2018 on Anti-Money Laundering and its implementing regulations
- Any implementing regulations, decisions and guidance issued under the above from time to time
This Policy applies to the Website, to our customer service channels (email, telephone, WhatsApp and social media), and to any order you place with us. It does not apply to third-party websites or services that we link to.
3. Personal data we collect
3.1 Data you give us directly
| Category | Examples |
|---|---|
| Identity data | Full name, salutation, date of birth (where voluntarily provided) |
| Contact data | Delivery address, billing address, email address, mobile number |
| Account data | Username, password (stored in hashed form), saved addresses, wishlist, saved preferences |
| Order data | Products ordered, order value, order history, delivery instructions, gift messages |
| Payment data | Payment method selected, cardholder name, last four digits and card type, transaction reference. We do not collect or store full card numbers, expiry dates or CVV/CVC codes — see Section 6. |
| Communications data | Correspondence with our customer service team, complaint records, call notes, chat transcripts |
| Content data | Product reviews, ratings, photographs you upload, survey responses, competition entries |
| Return data | Reason for return, condition notes, rider confirmation, photographs taken at the doorstep |
3.2 Data we collect automatically
- Device and technical data: IP address, device type and identifiers, browser type and version, operating system, screen resolution, language and time-zone settings
- Usage data: pages viewed, products viewed, search terms, time spent, click paths, referring and exit pages, cart and checkout behaviour
- Cookie and similar technology data: see Section 10
3.3 Data we receive from third parties
- Payment service providers — Ziina, and (once onboarded) Tabby and Tamara: transaction status, authorisation and decline codes, fraud-screening outcomes, refund status
- Delivery partners and riders: delivery status, timestamps, proof of delivery, doorstep return confirmation, recipient signature or OTP confirmation
- Analytics and advertising platforms: aggregated and pseudonymised audience and campaign data
- Social media platforms: profile information you choose to share when you interact with our pages or use social login
3.4 Sensitive personal data
We do not seek to collect sensitive personal data (as defined in the PDPL), including data revealing racial or ethnic origin, religious or philosophical beliefs, political opinions, health, biometric or genetic data. Please do not submit such data to us. Where you voluntarily disclose it — for example, in a message to customer service — we will process it only as necessary to respond to you, and will delete it once that purpose is complete.
3.5 Children
The Website is not intended for individuals under 18 years of age, and we do not knowingly collect personal data from them. If we become aware that we hold data relating to a person under 18 without verified parental or guardian consent, we will delete it. Contact namaste@9yaards.com if you believe this has occurred.
4. Why we process your personal data, and our lawful basis
Under the PDPL, consent is the default basis for processing, subject to the statutory exceptions set out in the law. We rely on the following:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account | Performance of a contract with you |
| Processing, fulfilling and delivering your order | Performance of a contract with you |
| Taking payment and processing refunds | Performance of a contract; compliance with legal obligations |
| Managing the doorstep inspection window, returns and refunds | Performance of a contract; compliance with the Consumer Protection Legislation |
| Customer service and complaint handling | Performance of a contract; compliance with legal obligations |
| Fraud prevention, payment screening and platform security | Protection of our legitimate interests; compliance with legal obligations |
| Tax invoicing, VAT records and statutory bookkeeping | Compliance with legal obligations |
| Responding to requests from courts, regulators and government authorities | Compliance with legal obligations |
| Direct marketing (email, SMS, WhatsApp, push) | Your consent, which you may withdraw at any time |
| Personalising product recommendations and site content | Your consent |
| Analytics, service improvement and A/B testing | Your consent; our legitimate interests where permitted |
| Product reviews and user-generated content | Your consent |
| Establishing, exercising or defending legal claims | Protection of our rights and legitimate interests |
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawing consent for marketing does not affect our ability to send you service messages relating to an order you have placed.
5. Automated decision-making
We use automated fraud and risk screening at checkout, operated by us and by our payment service providers. This may result in an order being declined or held for manual review. Instalment payment providers (Tabby, Tamara) carry out their own automated credit and eligibility assessments under their own terms.
You have the right to object to a decision made solely by automated means that produces a legal effect or similarly significant effect on you, and to request human review. Write to namaste@9yaards.com.
6. Payments — what we do and do not see
Payments on the Website are processed by:
- Ziina — card payments (credit and debit)
- Tabby and Tamara — instalment / buy-now-pay-later options *(onboarding in progress; these options will appear at checkout once live)*
Card details are entered directly into the payment provider’s secure, PCI-DSS-compliant environment. 9Yaards does not receive, process or store your full card number, expiry date or CVV/CVC. We receive only a transaction reference, the outcome of the transaction, the payment method type, and a masked card identifier.
When you choose an instalment option, the relevant provider becomes an independent data controller for the data you submit to it. Its assessment, collection and credit-reporting activities are governed by its own privacy policy and terms, which you should read before proceeding. We share with that provider only the data necessary to create and settle the transaction — typically your name, contact details, delivery address, order contents and order value.
7. Who we share your personal data with
We do not sell your personal data. We share it only as set out below, and only to the extent necessary:
- Delivery partners and riders — name, delivery address, contact number, order reference and delivery instructions, so your order can be delivered and any doorstep return collected
- Payment service providers — Ziina, Tabby, Tamara, and acquiring banks, for payment authorisation, settlement, refunds, chargebacks and fraud screening
- Technology and hosting providers — website hosting, cloud storage, database, CRM, email and SMS delivery, customer service ticketing and analytics providers
- Marketing and advertising partners — where you have consented, for campaign delivery and measurement
- Professional advisers — auditors, lawyers, accountants and insurers, under duties of confidentiality
- Government and regulatory authorities — including the UAE Data Office, the Ministry of Economy, the Department of Economy and Tourism (Dubai), the Federal Tax Authority, customs authorities, law enforcement and the courts, where we are legally required or permitted to do so
- Corporate transactions — a purchaser or prospective purchaser in connection with a sale, merger, restructuring or transfer of our business
Every processor we appoint is bound by a written agreement requiring it to process personal data only on our documented instructions, to apply appropriate technical and organisational security measures, to impose equivalent obligations on any sub-processor, and to delete or return the data at the end of the engagement.
8. Cross-border transfers
Some of our suppliers, service providers and technology infrastructure are located outside the UAE, including in India (product sourcing and supplier coordination), the European Union, the United Kingdom, the United States and Singapore (cloud hosting and software services).
Where we transfer personal data outside the UAE, we do so only where one of the following applies:
- the receiving jurisdiction has an adequate level of protection recognised under the PDPL; or
- the transfer is governed by a contract containing appropriate safeguards and enforceable data-subject rights; or
- you have given your explicit consent to the transfer; or
- the transfer is necessary for the performance of a contract with you, for the establishment or defence of legal claims, or otherwise falls within an exception permitted by the PDPL.
You may request details of the safeguards applied to a specific transfer by writing to namaste@9yaards.com.
9. How long we keep your data
| Data | Retention period |
|---|---|
| Account data | For as long as your account is active, plus 12 months after your last interaction with us |
| Order, invoice, VAT and payment records | 7 years from the end of the relevant financial year, or such longer period as UAE tax and commercial legislation requires |
| Delivery and return records | 3 years from the date of delivery |
| Customer service correspondence and complaints | 3 years from closure of the matter |
| Marketing consents and preferences | Until consent is withdrawn, plus 2 years as evidence of the consent record |
| Fraud and security incident records | 5 years from the date of the incident |
| Website analytics and cookie data | Up to 24 months, or the period stated in our Cookie Notice |
| CCTV, call recordings and chat transcripts (where applicable) | 90 days, unless required for an active dispute or investigation |
Where data is retained beyond the operational period for legal, tax or evidentiary reasons, access is restricted to personnel who require it for that specific purpose. At the end of the retention period, data is securely deleted or irreversibly anonymised.
10. Cookies and similar technologies
We use cookies, pixels, SDKs and local storage to operate the Website, remember your cart and preferences, measure performance, and — where you consent — to personalise content and deliver advertising.
- Strictly necessary cookies are required for the Website to function (session management, cart, security, load balancing) and cannot be switched off
- Functional, analytics and advertising cookies are set only after you give consent through our cookie banner
You may change or withdraw your cookie preferences at any time via the cookie settings link in the Website footer, or through your browser settings. Disabling certain cookies may affect checkout and site functionality.
11. Marketing communications
Where you have consented, we may send you offers, new arrivals, restock alerts and promotional content by email, SMS, WhatsApp or push notification.
You may opt out at any time by using the unsubscribe link in any email, replying STOP to any SMS or WhatsApp message, adjusting your account preferences, or writing to namaste@9yaards.com. We will action your request without undue delay.
We will continue to send transactional and service messages relating to your orders — order confirmation, dispatch, delivery, return and refund notifications — as these are necessary to perform our contract with you.
12. Data security
We apply technical and organisational measures appropriate to the risk, including:
- TLS/HTTPS encryption of data in transit across the Website
- Encryption of personal data at rest in our production databases
- Role-based access control, unique user credentials and multi-factor authentication for administrative systems
- Segregation of production and non-production environments
- Logging, monitoring and alerting on access to personal data
- Outsourcing of all card data handling to PCI-DSS-compliant payment providers
- Confidentiality obligations and periodic data protection training for staff and contractors
- Written data processing agreements with all vendors that handle personal data on our behalf
- A documented incident response procedure, tested periodically
No transmission or storage system is completely secure. You are responsible for keeping your account password confidential and for all activity carried out under your credentials. Notify us immediately at namaste@9yaards.com if you suspect unauthorised access to your account.
13. Personal data breaches
If a personal data breach occurs that may prejudice the privacy, confidentiality or security of your personal data, we will notify the UAE Data Office and, where required, affected individuals, without undue delay and in accordance with the PDPL. Our notification will describe the nature of the breach, its likely consequences, the measures taken to address it and mitigate its effects, and the contact point for further information.
14. Your rights
Subject to the conditions and exceptions in the PDPL, you have the right to:
- Be informed about how your personal data is processed and to obtain a copy of it
- Request data portability — receive your data in a structured, commonly used, machine-readable format, or have it transmitted to another controller where technically feasible
- Request correction of inaccurate, incomplete or outdated data
- Request erasure of your data, where the conditions for erasure are met
- Request restriction of processing in defined circumstances
- Object to processing, including processing for direct marketing and profiling
- Object to automated processing that produces legal or similarly significant effects, and request human intervention
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with the UAE Data Office
How to exercise your rights
Send your request to namaste@9yaards.com with the subject line “Data Subject Request”. Include your full name, the email address or mobile number registered with your account, and a clear description of the right you wish to exercise.
We will verify your identity before acting, and will respond within 30 days of receipt of a valid request. Where a request is complex or where we receive multiple requests from you, we may extend this period and will inform you of the extension and the reasons for it. We do not charge a fee, unless a request is manifestly unfounded, repetitive or excessive.
Certain rights are qualified. We may decline a request where we are required to retain data for legal, tax, accounting, fraud-prevention or dispute-resolution purposes, or where the request would adversely affect the rights of others. Where we decline, we will explain why.
15. Complaints
If you are dissatisfied with how we have handled your personal data, contact us first at namaste@9yaards.com so we can try to resolve the matter.
You may also lodge a complaint with:
- UAE Data Office — the federal supervisory authority for personal data protection
- Department of Economy and Tourism, Dubai — Consumer Protection: 600 545 555 / consumerrights.ae
- Ministry of Economy — Consumer Protection Department: 600 522 225
16. Third-party websites
The Website may contain links to third-party sites, plug-ins and applications. We do not control these and are not responsible for their privacy practices. Review the privacy policy of every site you visit.
17. Changes to this Policy
We may update this Policy to reflect changes in our operations, technology or legal obligations. The current version is always published at www.9yaards.com/privacy-policy with the effective date shown at the top. Where a change materially affects your rights, we will notify you by email or through a prominent notice on the Website before it takes effect.
18. Contact us
9Yaards for Online Shopping
Data protection contact: namaste@9yaards.com