Privacy Notice

Who is responsible for your data

ECLA VITA is the data controller responsible for the personal data described in this notice. We are a fragrance house operating in Riyadh, Saudi Arabia.

For anything in this notice you can reach us at info@ecla-vita.com.

Information we collect

We collect the information needed to take and fulfil an order, operate an account, provide customer care and run the rewards programme, and we collect no more than we need for those purposes. The categories below describe what that covers in practice.

• Account data: your name, email address, mobile number and sign-in credentials.
• Order data: what you ordered, delivery and billing addresses, order value and order status.
• Payment information: the payment method and transaction records needed to process and refund a payment. Card details are handled by our payment provider, not stored by us.
• Delivery information: recipient name and phone number where an order is a gift, and delivery addresses.
• Gift-recipient information: the recipient's name, contact details and any personal message supplied by the sender.
• ECLA Circle data: membership activity, points earned and redeemed, and purchase history used to calculate rewards.
• Website and device data: technical information such as your approximate location, device and browser type, and the pages you visit.
• Support data: the messages you send us and the requests you make.

Cookies and local storage

We use the minimum needed to make the storefront work. Your cart, wishlist, theme and selected market are kept in your browser's local storage so they survive a page reload, and we set an essential session cookie to keep you signed in when you have an account.

We also measure site usage with first-party analytics. Our analytics respects Global Privacy Control and Do Not Track signals, uses a session-only anonymous identifier, and is not used for advertising. We do not run third-party advertising or tracking pixels on this site.

Why we process your data

• To create and manage an account that you open with us.
• To accept, process, pay for and deliver your order.
• To provide customer care, handle returns and resolve issues.
• To operate the ECLA Circle rewards programme.
• To keep the storefront secure and prevent fraud or misuse.
• To send marketing where you have chosen to receive it.
• To meet our legal and regulatory obligations.

Service providers

We share personal data with service providers who help us run the storefront, only as needed to perform their task and under appropriate confidentiality and security obligations.

• Payment providers: we use Tap Payments to process payments securely. Available payment methods are shown during checkout.
• Delivery partners: we use a delivery partner to carry orders to the addresses you provide. No courier partner is named here because none is finalised yet.
• Technology providers: the platforms that host, store and operate the site and our communications.

International transfers

Some service providers may process personal data outside Saudi Arabia. Where that happens, we take steps to ensure the transfer and processing meet the requirements of the Saudi Personal Data Protection Law, including appropriate safeguards and contractual protections.

How long we keep data

We keep personal data only as long as necessary for the purposes it was collected for, or to meet a legal or regulatory obligation. Saudi law does not set a single universal retention period, so the period depends on the type of data and why we hold it. Order and payment records are kept for the periods required by Saudi tax, accounting and consumer-protection rules. Account data is kept while your account is open, and marketing preferences are honoured until you change them.

When data is no longer needed, we delete it or irreversibly anonymise it.

Your rights under the Saudi PDPL

Subject to the Saudi Personal Data Protection Law, you have the right to:

• Know what personal data we hold about you and why.
• Access your personal data.
• Obtain a copy of your personal data in a clear and readable format.
• Request correction of inaccurate or incomplete data.
• Request destruction of data that is no longer needed, subject to legal retention requirements.
• Withdraw consent at any time where our processing is based on your consent, without affecting processing already carried out.

Marketing preferences

You choose which marketing emails, SMS and WhatsApp messages you receive from your account's notification settings, and every marketing message includes a way to opt out. Messages about an order, delivery, return or account security are transactional and are not marketing.

Security

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit and role-based access for our team. Card details are handled by our payment provider rather than stored by us. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Privacy requests and complaints

Send privacy requests to info@ecla-vita.com from the address linked to your order or account. We will verify your identity and respond as required by the Saudi PDPL.

If you are not satisfied with our response, you may lodge a complaint with the Saudi Data and AI Authority (SDAIA), which oversees the application of the Personal Data Protection Law in Saudi Arabia.

Updates to this notice

We may update this notice as our services or the law change. The date at the foot of this page shows when it was last revised, and material changes will be communicated where appropriate.