PRIVACY POLICY

Effective date: 11 August 2026

We may collect identifiers and contact details; account and order information; delivery and customs information; payment status and limited transaction data (full card details are handled by payment providers); customer-service communications; device, cookie and usage data; marketing preferences; and information you choose to provide.

We process this information to take steps at your request and perform our contract (orders, payment, delivery, returns and support); comply with tax, customs, product-safety and other legal obligations; pursue legitimate interests such as fraud prevention, service security, analytics and improvement where those interests are not overridden; and, where required, on the basis of consent for marketing, targeted advertising and non-essential cookies. You may withdraw consent without affecting earlier lawful processing.

We do not sell personal data for money. We share only what is reasonably necessary with Shopify and hosting providers; payment and fraud-prevention providers; couriers, fulfilment partners and customs authorities; IT, security and customer-service providers; analytics and advertising partners where permitted and consented to; professional advisers; regulators; and a buyer or successor in a lawful business transaction.

Some US privacy laws define certain advertising disclosures as “sale” or “sharing” even where no money changes hands. Where applicable, we provide the required opt-out mechanism, including recognition of legally required preference signals. Service providers are contractually restricted where required.

Because we serve the UAE and the other GCC countries (Bahrain, Kuwait, Oman, Qatar and Saudi Arabia), the United Kingdom, the United States and India, data may be transferred outside the country where it was collected. Where required, we use recognised safeguards such as adequacy decisions, approved contractual clauses, transfer assessments or another lawful mechanism, and apply supplementary security measures where appropriate. Contact us to request information about relevant safeguards.

Strictly necessary technologies support security, checkout and preferences. Analytics, personalisation and advertising technologies are used only where permitted and, where required, after consent. You can accept, reject or manage non-essential categories and later withdraw consent through the cookie settings link. See our Cookie Policy. US residents may also use any “Your Privacy Choices” mechanism provided where required.

We keep personal data only as long as reasonably necessary for the stated purpose, legal compliance, disputes and enforcement. Retention varies by record: order, tax and accounting records are kept for the applicable statutory period; customer-service and fraud records for a proportionate period; marketing data until opt-out or earlier deletion where appropriate; and cookie/analytics data for the periods shown in the cookie settings tool. We then delete or anonymise data securely. Replace any fixed retention claim with a verified schedule before publication.

We apply technical and organisational measures to protect your personal data, including:

a. Encryption of sensitive information.
b. Firewalls and secure servers.
c. Access controls and employee confidentiality obligations.
d. Vendor due diligence before sharing data.

Despite these measures, no system is completely secure, and we cannot guarantee absolute security of your data.

You are responsible for keeping your account credentials and devices secure. We are not liable for unauthorised access caused by your failure to safeguard this information.

Depending on where you live and subject to legal exceptions, you may have rights to access, correct, delete or erase, restrict or object to processing, obtain portability, withdraw consent, opt out of targeted advertising/sale/sharing, appeal a refusal, and complain to a regulator. UK users may complain to the Information Commissioner’s Office. India users may use our grievance mechanism and, where available under applicable law, complain to the Data Protection Board of India. UAE and US rights apply as provided by the relevant law.

To submit a request, email customer.service@vimijoshibeauty.com. We may verify identity and authorised-agent requests. We will respond within the period required by applicable law and will not unlawfully discriminate for exercising a right.

You may complete a purchase without creating an account. In such cases, your personal and payment details will still be collected and processed in accordance with this Privacy Policy.

Our store is intended for adults. We do not knowingly collect personal data from children in a manner prohibited by applicable law. Where consent of a parent or guardian is required, including under applicable Indian law, we will obtain verifiable consent before processing. If you believe a child has provided data unlawfully, contact us so we can investigate and delete it where required.

We may update this Privacy Policy from time to time to reflect legal, operational, or technological changes. The most recent version will always be available on our website. If changes are material, we will notify you via email or website notice.

We comply with applicable privacy laws based on our activities and the individual’s location, which may include the UAE Personal Data Protection Law, UK GDPR and Data Protection Act 2018, applicable US state privacy laws, and India’s Digital Personal Data Protection framework as and when its provisions apply. A UAE governing-law clause does not remove mandatory privacy rights or regulatory remedies available elsewhere.

If you have concerns about how we process your data, please contact us first at customer.service@vimijoshibeauty.com. If we cannot resolve your concern, you also have the right to raise a complaint with the UAE Data Office.

We will respond to all valid data subject requests within 30 days, or longer where permitted by law, and may request verification of your identity before fulfilling your request.