Privacy Policy

1. Who is responsible for your data

Brumodi Ventures [LEGAL ENTITY NAME] (the "Controller") is responsible for the personal data described in this policy, in line with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and its implementing regulations. Data protection contact: privacy@yourdomain.ae.

2. Data we collect

Account data: name, email address, password (stored hashed), and for business accounts company name, trade licence number and VAT TRN.

Order data: items purchased, delivery address and location, phone number, payment method and status, PO numbers. Card details are entered on our payment provider's page and are not stored by us.

Technical data: device and browser information, IP address and cookie identifiers, as described in the Cookie Policy.

Seller data: business name, trade licence and payout details collected during seller onboarding and verification.

3. Why we use it and our legal basis

To create and manage your account and fulfil orders (performance of a contract). To deliver goods quickly — including using your location to estimate delivery speed (your consent, where location is requested). To prevent fraud and meet legal obligations such as tax invoicing and record-keeping. To send service messages about your orders. To send marketing only where you have given consent, which you can withdraw at any time.

4. Who we share it with

Sellers (only what is needed to fulfil your order), delivery partners, payment service providers, cloud hosting providers, and authorities where required by law. We do not sell your personal data.

5. International transfers

Our infrastructure is hosted on Microsoft Azure. Where data is transferred or stored outside the UAE, we do so only as permitted by the PDPL, for example to jurisdictions with adequate protection or under appropriate safeguards. Hosting region: [AZURE REGION, e.g. UAE North].

6. How long we keep it

We keep personal data only as long as needed for the purposes above and to meet legal requirements (for example, tax and accounting records are retained for the period required by UAE law). Account data is deleted or anonymised after you close your account, subject to those obligations.

7. Your rights

Under the PDPL you may request access to your data, correction, deletion, restriction of processing, data portability, and object to certain processing, including automated decision-making and direct marketing. You may also withdraw consent at any time. To exercise a right email privacy@yourdomain.ae; we will respond within the period required by law.

If you are unhappy with our response you may lodge a complaint with the UAE Data Office.

8. Security

We use technical and organisational measures including encrypted connections, hashed passwords, role-based access control and logging. No system is perfectly secure; we will notify you and the authorities of a data breach where the law requires.

9. Children

The marketplace is not directed at children under 18 and we do not knowingly collect their data.

10. Changes

We will post updates here and, for material changes, notify you.