Privacy Policy

How we collect, use and protect your personal data.

🔒 Our commitment

We collect only what we need to serve you, we never sell your data, and we handle everything in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). This policy covers our website and mobile app, and explains what we collect, why, and the choices you have.

📋 What we collect

• You give us: name, email, phone number, delivery address, and your order and return history.
• Date of birth: collected when you register an account, to confirm that you are 18 or older.
• Collected automatically: device and browser type, approximate location, pages viewed, and cookie identifiers used to keep your cart and improve the store.
• We never store your full card number. Card details go directly to our payment providers (Stripe, Tabby, Tamara) — we only receive a confirmation and the last four digits.

🎯 Why we use it

• To process, deliver and support your orders, including returns and warranty claims.
• To contact you about your order by email or WhatsApp.
• To operate our rewards and referral program if you take part.
• To improve the store, prevent fraud, and meet our legal and tax obligations.
• To send offers — only if you opt in, and you can unsubscribe at any time.

🤝 Who we share it with

We share the minimum necessary with the partners who make your order possible:

• Aramex — name, address and phone number, to deliver your parcel.
• Stripe, Tabby, Tamara — to process your payment securely.
• Hostinger, our hosting provider — to run the website.
• Analytics, advertising and newsletter tools — listed in the next section.
• UAE authorities — only where the law requires it.

We do not sell or rent your personal data to anyone.

📊 Analytics and advertising tools

We use these tools to understand how the store is used and to measure our ads:

• Google Analytics 4 — website usage statistics.
• Google Ads tag — measuring the results of our Google ads.
• Meta Pixel (Facebook & Instagram) — measuring and improving our Meta ads.
• TikTok Pixel — measuring our TikTok ads.
• Mailchimp — sending our newsletter, only if you subscribe.

You can refuse analytics and advertising cookies, or change your choice at any time, through the cookie banner on our site. You can unsubscribe from the newsletter using the link in any of our emails. More details in our Cookie Policy.

🌍 Where your data is stored

Our website and databases are stored on secure servers operated by our hosting provider, Hostinger. Some service providers (for example payment, analytics and advertising providers) may process data outside the UAE under their own contractual and legal safeguards. We handle all personal data in line with the UAE Personal Data Protection Law (PDPL).

🛡️ How we protect it

• The whole site runs over encrypted HTTPS (TLS).
• Payments are handled entirely by our payment providers on PCI DSS compliant systems — no card data touches our servers.
• Access to customer data is limited to team members who need it for their work.
• We keep our platform and plugins updated and monitor our systems regularly.

⏳ How long we keep it

• Order and invoice records: 5 years, as required by UAE tax law.
• Account details: until you ask us to delete your account.
• Marketing consent: until you unsubscribe.
• Cookies: see our Cookie Policy.

✅ Your rights under UAE PDPL

You may ask us to: access a copy of your data, correct it, delete it, restrict or object to how we use it, transfer it to another provider, or withdraw consent for marketing.

Email support@totot.ae or our data protection contact dpo@totot.ae with the subject “Data Request”. We verify your identity and respond within 30 days. If you are not satisfied with our answer you may contact the UAE Data Office.

🗑️ Account deletion

You can ask us to delete your account and its personal data at any time from our Account deletion page. We confirm your request and delete your account; order and invoice records that UAE tax law requires us to keep are retained for 5 years and then deleted.

👶 Children

totot.ae is intended for customers aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.