Privacy Policy

1. Definitions

In this Privacy Policy, the following terms have the meanings set out below. Capitalised terms used but not defined here have the meaning given in our Terms and Conditions.

• "Personal data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
• "Platform" or "Galeries.shop" means our SaaS software, APIs, dashboards, merchant tools, customer-facing shop pages, WhatsApp and bot integrations, and related services operated by us.
• "Merchant" means a business or individual that registers for a Galeries.shop account to create and operate an online shop.
• "Shop customer" or "Customer" means an individual who browses, orders from, or communicates with a Merchant shop hosted on or connected to the Platform.
• "Affiliate" means a participant in the Galeries.shop affiliate or referral program.
• "Processor" means a third party that processes personal data on our instructions, such as hosting, payment, messaging, or analytics providers.
• "Applicable law" includes, where relevant, the UAE Personal Data Protection Law, the EU General Data Protection Regulation (GDPR), the UK GDPR, and other data protection laws applicable to you or to us.

2. Roles and Responsibilities

CUBE DESIGN SOFTWARE HOUSE is the controller of personal data we collect directly from Merchants, Affiliates, website visitors, and Platform account holders for account administration, billing, platform security, and service delivery.

When a Merchant uses Galeries.shop to sell to Customers, the Merchant is generally the controller of Customer personal data collected through their shop, and we act as a processor processing that data on the Merchant's behalf to provide the Platform. Merchants are responsible for providing their own privacy notices to Customers, determining lawful bases for their processing, and honouring Customer rights requests relating to shop data, unless we are legally required to respond directly.

Some integrated services, such as payment processors (Stripe, PayPal), subscription and wallet billing (FastSpring), WhatsApp messaging infrastructure, and live chat on our marketing site (Crisp), may act as independent controllers for certain processing activities. Their privacy policies govern those activities.

3. Scope of This Policy

This Privacy Policy applies to personal data processed through galeries.shop, our merchant dashboards, registration and authentication flows (including WhatsApp one-time password verification), affiliate pages, support channels, and related communications.

It does not apply to third-party websites, apps, or services linked from the Platform or from Merchant shops, including Merchant-owned domains, social media pages, or payment pages operated solely by third-party providers. Those services are governed by their own privacy policies.

If you interact with us only as a Customer of a Merchant shop, the Merchant's privacy policy is primary for shop-specific processing. This Policy still describes how we handle data as a platform provider and processor.

4. Personal Data We Collect

The personal data we collect depends on how you use Galeries.shop. We collect data you provide directly, data generated through your use of the Platform, and data we receive from third parties where permitted.

• Account and profile data: name, email address, phone number, business name, shop details, language preferences, and authentication credentials or verification codes.
• Merchant and shop content: product listings, orders, customer messages routed through the Platform, shop configuration, branding, and operational settings.
• Billing and subscription data: plan selection, invoices, wallet balance, transaction references, and billing contact details processed through FastSpring and related payment systems. We do not store full payment card numbers.
• Shop customer data (on behalf of Merchants): names, delivery addresses, phone numbers, order history, payment method selections, and communications sent via web checkout, WhatsApp, or bot channels.
• Affiliate data: referral identifiers, commission records, payout details, and performance metrics.
• Technical and usage data: IP address, device and browser type, operating system, log files, session identifiers, pages viewed, feature usage, error reports, and security signals.
• Communications: messages you send to us via email, support tickets, Crisp chat on our marketing site, or other channels; and records of our responses.
• Marketing preferences: newsletter subscriptions and campaign interaction data where you have opted in.

5. Legal Bases for Processing

Where the GDPR or similar laws apply, we rely on one or more of the following legal bases. Merchants must establish their own lawful bases for Customer data they control.

• Contract: processing necessary to register your account, provide the Platform, process subscriptions and wallet transactions, enable shop operations, and deliver support you request.
• Legitimate interests: operating, securing, and improving Galeries.shop; preventing fraud and abuse; analysing aggregated usage; communicating about service updates; and managing our affiliate program, balanced against your rights and freedoms.
• Consent: where required for non-essential cookies, certain marketing communications, or optional features. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Legal obligation: complying with applicable laws, regulatory requests, tax and accounting requirements, and lawful orders from authorities.
• Vital interests: in rare cases, to protect the safety of an individual where permitted by law.

6. How We Use Personal Data

We use personal data for the purposes described below and as otherwise disclosed at the time of collection.

• Providing and maintaining the Platform, including shop creation, product management, order handling, WhatsApp and bot sales channels, and merchant dashboards.
• Authenticating users, including sending WhatsApp one-time passwords and security notifications.
• Processing subscriptions, renewals, wallet top-ups, and billing through FastSpring and related systems.
• Enabling Merchants to accept customer payments via Stripe, PayPal, cash on delivery (COD), and other supported methods configured by the Merchant.
• Operating the affiliate program, tracking referrals, calculating commissions, and processing payouts.
• Providing customer support through email, in-product tools, and Crisp chat on our marketing website.
• Monitoring performance, diagnosing errors, conducting analytics, and developing new features.
• Detecting, investigating, and preventing security incidents, fraud, spam, and violations of our Terms.
• Sending service-related notices, such as account confirmations, billing receipts, and material policy changes.
• Sending marketing communications where permitted and based on your preferences.
• Establishing, exercising, or defending legal claims and enforcing our agreements.

7. Service Providers and Processors

We use carefully selected third-party providers to help deliver Galeries.shop. These providers process personal data only on our documented instructions and subject to contractual safeguards, unless they are independent controllers.

Categories of providers include cloud hosting and infrastructure, email and messaging delivery, WhatsApp Business API partners, payment and subscription processors (including FastSpring, Stripe, and PayPal), customer support and live chat (Crisp), analytics and monitoring, fraud prevention, and professional advisers.

Merchants may enable additional integrations or payment methods that involve third parties acting under the Merchant's configuration. Those providers process data according to their own terms and privacy policies.

We maintain an internal record of key subprocessors and assess their security and data protection practices. We may update subprocessors from time to time as our services evolve.

8. International Data Transfers

Galeries.shop is operated from the United Arab Emirates. Our service providers may process personal data in the UAE, the European Economic Area, the United Kingdom, the United States, and other countries where they or their subprocessors maintain facilities.

Where personal data is transferred from the EEA, UK, or Switzerland to countries not recognised as providing an adequate level of protection, we implement appropriate safeguards such as Standard Contractual Clauses approved by the European Commission or UK authorities, supplemented by additional measures where required.

Merchants who transfer Customer data internationally remain responsible for ensuring lawful transfer mechanisms are in place for their own processing activities.

You may contact [email protected] for more information about transfer safeguards relevant to your data.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, unless a longer period is required or permitted by law.

Account and billing records are generally retained for the duration of your relationship with us and for a reasonable period thereafter to resolve disputes, enforce agreements, and meet legal retention obligations.

Shop and order data processed on behalf of Merchants is retained according to the Merchant's subscription status and our data retention settings. After account closure, we may retain certain data in backup systems for a limited period before secure deletion or anonymisation.

Technical logs and security records may be kept for shorter or longer periods depending on operational and legal requirements.

When data is no longer needed, we delete or anonymise it using commercially reasonable methods.

10. Your Privacy Rights

Depending on your location and applicable law, you may have the rights described below regarding your personal data. We will respond to verified requests within the timeframes required by law. To exercise a right, email [email protected] with sufficient information to verify your identity and describe your request. We may need to ask for additional details to protect your account and personal data.

Shop customers should generally direct requests relating to orders and shop interactions to the relevant Merchant first. We will assist Merchants in fulfilling such requests where we act as processor.

• Access: request confirmation of whether we process your personal data and obtain a copy.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of personal data in certain circumstances.
• Restriction: request that we limit processing in specific situations.
• Portability: receive personal data you provided in a structured, commonly used, machine-readable format where applicable.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time.
• Complaint: lodge a complaint with a supervisory authority. UAE residents may contact the UAE Data Office. EEA residents may contact their local data protection authority.

11. Security Measures

We implement technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include access controls, encryption in transit, secure development practices, monitoring, and staff training.

No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for configuring appropriate security settings for your shop.

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and relevant authorities as required by applicable law.

12. Children's Privacy

Galeries.shop is intended for use by Merchants and individuals aged 18 or older, or the age of legal majority in their jurisdiction. We do not knowingly collect personal data from children under 16 (or under 13 where applicable law sets a lower threshold only with parental consent) through our own registration flows.

Merchants must not use the Platform to sell products or services to children in violation of applicable law. If you believe we have collected personal data from a child without appropriate authority, contact [email protected] and we will take appropriate steps to delete the data.

13. Automated Decision-Making and Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning individuals, except where permitted by law and with appropriate safeguards.

We may use automated systems to detect fraud, prevent abuse, recommend platform features, or analyse aggregated usage trends. These activities do not replace human review where required for significant decisions affecting your account.

Merchants are responsible for any automated decision-making they implement in their own shops or marketing activities using Platform tools.

14. Cookies and Similar Technologies

We use cookies, local storage, pixels, and similar technologies on our marketing website and Platform to enable core functionality, remember preferences, measure performance, and support security.

Essential cookies are necessary for the site and Platform to function and cannot be switched off in our systems. Analytics and marketing cookies are used only where permitted by law and, where required, with your consent.

You can manage cookie preferences through our cookie banner and your browser settings. Disabling certain cookies may affect functionality. For more detail, see our cookie notice and the choices presented when you first visit our marketing site.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or industry practices. The "Last updated" date at the top indicates when this Policy was last revised.

If we make material changes, we will provide notice through the Platform, by email, or by other appropriate means before the changes take effect where required by law.

We encourage you to review this Policy periodically. Continued use of Galeries.shop after an update constitutes acceptance of the revised Policy, except where further consent is required by law.