Privacy Policy

How we collect, use and protect your personal data.

🔒 Our commitment

We collect only what we need to serve you, we never sell your data, and we handle everything in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). This policy explains what we collect, why, and the choices you have.

📋 What we collect

• You give us: name, email, phone number, delivery address, and your order and return history.
• Collected automatically: device and browser type, approximate location, pages viewed, and cookie identifiers used to keep your cart and improve the store.
• We never store your full card number. Card details go directly to our payment providers (Stripe, Telr, Tabby, Tamara) — we only receive a confirmation and the last four digits.

🎯 Why we use it

• To process, deliver and support your orders, including returns and warranty claims.
• To contact you about your order by email or WhatsApp.
• To operate our rewards and referral program if you take part.
• To improve the store, prevent fraud, and meet our legal and tax obligations.
• To send offers — only if you opt in, and you can unsubscribe at any time.

🤝 Who we share it with

We share the minimum necessary with the partners who make your order possible:

• Aramex — name, address and phone number, to deliver your parcel.
• Stripe, Telr, Tabby, Tamara — to process your payment securely.
• Hosting and analytics providers — to run and measure the site.
• UAE authorities — only where the law requires it.

We do not sell or rent your personal data to anyone.

🌍 Where your data is stored

Our website and databases are hosted on infrastructure located in the United Arab Emirates. Some service providers (for example payment and analytics providers) may process data outside the UAE under their own contractual and legal safeguards.

🛡️ How we protect it

• The whole site runs over encrypted HTTPS (TLS).
• Payments are handled entirely by our payment providers on PCI DSS compliant systems — no card data touches our servers.
• Access to customer data is limited to team members who need it for their work.
• We keep our platform and plugins updated and monitor our systems regularly.

⏳ How long we keep it

• Order and invoice records: 5 years, as required by UAE tax law.
• Account details: until you ask us to delete your account.
• Marketing consent: until you unsubscribe.
• Cookies: see our Cookie Policy.

✅ Your rights under UAE PDPL

You may ask us to: access a copy of your data, correct it, delete it, restrict or object to how we use it, transfer it to another provider, or withdraw consent for marketing.

Email support@totot.ae with the subject “Data Request”. We verify your identity and respond within 30 days. If you are not satisfied with our answer you may contact the UAE Data Office.

👶 Children

totot.ae is intended for customers aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.