Policies
On this page
Who controls your data
What we collect
Why we use it, and on what basis
Who we share it with
Data leaving the UAE
How long we keep it
Your rights
Security
Children
Automated decisions
Changes
Complaints
Privacy policy
Last updated 27 October 2026
Operated by Shobra Outlet Trading L.L.C., trading as ATIR.ae
Ajman DED licence No. 109480
VAT: Shobra Trading of Ready Garments LLC, TRN 100479414300003
This policy explains what personal data Atir collects, why, who we share it with, and what you can do about it. It is written to meet Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
Who controls your data
This website is operated by Shobra Outlet Trading L.L.C., trading as ATIR.ae, licensed by Ajman DED, licence No. 109480. Showroom No. 11, Nuaimeya 1, Ajman, United Arab Emirates.
We are the controller of the personal data described here. Contact us about anything on this page at info@atir.ae.
What we collect
When you create an account. Your name, email address and password. The password is handled by our authentication provider and we never see it.
When you order. Email, delivery address, phone number, the items you bought, the amount, and your order history. If you use the map, we also receive the pin coordinates, formatted address and Google place identifier. We send a one-time code to your phone number to confirm it, by WhatsApp or by text message, and check what kind of line the number is. This applies whether you use an account or guest checkout. We share your name, email and order with Trustpilot so it can invite you to review the order.
When you pay by card. Our payment processor handles the card. We receive confirmation that payment succeeded, the last four digits, and the card type. We never receive or store your full card number. If you are signed in and choose to save a card, Stripe keeps it for your next order.
When you message us on WhatsApp, Instagram or Messenger. Your name and number or account as that app shows it to us, your messages and our replies, and any order you place in the chat. Replies may come from an automated assistant that answers about our products and passes the chat to a person when needed.
When you use the site. IP address, device and browser type, pages viewed, and what you did on them. PostHog, Google Analytics, Vercel analytics and the TikTok and Meta pixels record this only when you switch on Analytics or Advertising in Cookie settings. See Cookie policy.
When you contact us. Whatever you put in the message, and our reply.
When you tell us your taste. The notes you like or avoid, your budget, the occasions you buy for and similar choices, used to suggest perfumes.
When you get our marketing email. Which links you click.
When you ask us to tell you about a bottle. Notify me keeps your email and the bottle until it is back. Atir Circle keeps your points, rewards and goals. Shopping reminders keep your email and whether you turned them off.
We keep only what each of these needs, and each is optional.
We do not collect data about your health, religion, politics, or anything else the law treats as sensitive. Please do not send us any.
Why we use it, and on what basis
UAE law requires a lawful basis for each use. Not everything runs on consent, and we have separated them so you can see which is which.
To perform your order. Taking payment, packing, delivering, invoicing, handling returns and refunds. Basis: performance of the contract with you. This one has no opt-out, because we cannot deliver a parcel without an address.
To run your account. Signing you in, holding your basket, showing your order history. Basis: performance of the contract.
To meet legal obligations. Tax invoices and VAT records, which we keep for five years, and corporate tax records, which we keep for seven. Basis: legal obligation.
To keep the service working and secure. Error monitoring, fraud prevention, and spotting abuse. Basis: our legitimate interest in a service that works and is not defrauded. We configure our error monitoring to strip out personal data.
To send you marketing. Three separate kinds of email. Atir Letters, about products and offers, goes only if you join: by ticking an unticked box or signing up. Basis: your consent. Atir Circle offers, such as a gift from Atir, go to Circle members. Shopping reminders, about a bag you left or a bottle you saved or asked about coming back, are on for accounts from the start; a guest gets them only after confirming their email. You can stop any of them at any time, from the link in each email, from your account settings, or by emailing us. Stopping one does not stop the others, and stopping Circle offers keeps your Circle membership and points. We will never make marketing consent a condition of buying anything.
Service email continues whatever you choose: sign-in codes, order, delivery, refund, return and exchange updates, replies to your messages, notices about changes to our terms, and news about a Circle reward you chose, such as a complimentary bottle goal selling out.
To run the shop. Product analytics through PostHog: pages, taps, session replay, heatmaps, bag and checkout. Google Analytics, Vercel Web Analytics and Speed Insights. The TikTok and Meta pixels for ads. Basis: your consent, given and withdrawn in Cookie settings. Inputs in a PostHog replay are masked. Cookie policy names every tool.
Who we share it with
We use service providers to run the store. They process data on our instructions and cannot use it for their own purposes.
Provider
What it does
Where it processes data
Clerk
Accounts and sign-in
Outside the UAE
Convex
Database, carts, orders
Outside the UAE
Sanity
Product content and images
Outside the UAE
Stripe
Card payments, refunds and cards you choose to save
Outside the UAE
Resend
Order, account and marketing email, and clicks in marketing email
Outside the UAE
Vercel
Website hosting
Outside the UAE
Sentry
Error monitoring
Outside the UAE
PostHog
Product analytics, with your consent
Outside the UAE
Google Analytics
Website analytics, with your consent
Outside the UAE
Google Maps
Address search, map and location pin
Outside the UAE
Cloudflare Turnstile
Bot check at checkout
Outside the UAE
Meta (WhatsApp)
One-time codes that confirm your phone number
Outside the UAE
Infobip and Twilio
Text messages that confirm your phone number, when sent by text
Outside the UAE
Twilio Lookup
Checks what kind of line a phone number is
Outside the UAE
Trustpilot
Review invitations after an order
Outside the UAE
Vercel Web Analytics and Speed Insights
Page views and performance, with your consent
Outside the UAE
TikTok
Advertising, with your consent
Outside the UAE
Meta (Meta Pixel)
Advertising, with your consent
Outside the UAE
Meta (WhatsApp, Instagram, Messenger)
Chat messages and order links
Outside the UAE
We also share delivery details with Century Express, the courier that carries your parcel in every emirate, for delivery only. When it carries a cash on delivery order, it also receives the amount to collect from you.
We book that courier through our affiliate company, MONZA OUTLET FASHION L.L.C., which holds the contract, so it receives the same delivery details.
We use the phone number and email on a cash on delivery order to apply the cash limit and to record refused parcels, as described in Payment and pricing.
We disclose data to a government authority or court where the law requires it.
We do not sell your personal data. We never have and we do not intend to.
Data leaving the UAE
Every provider above processes data outside the United Arab Emirates. There is no practical way to run a modern storefront otherwise, so rather than hide it we have listed them.
We transfer data only to providers who commit contractually to protect it to a standard consistent with UAE law, and we rely on the transfer conditions in Federal Decree-Law No. 45 of 2021.
How long we keep it
Data
Kept for
Account details
Until you delete your account; deleted 7 days after you ask
Order records and invoices
5 years for VAT, 7 years for corporate tax
Marketing consent records
While you are subscribed, then 3 years
Analytics data
24 months
Support emails
3 years
Chat messages
3 years
Tax law fixes some of these and we cannot shorten them, even if you ask us to delete everything. When you delete your account we keep your orders, invoices and refunds without your email, phone or account: only the name and address on the invoice, what you bought and what you paid. We keep a record that a deletion happened, with no personal data in it.
Your rights
Under UAE data protection law you can ask us to:
·
Tell you what we hold about you, and give you a copy.
·
Correct anything wrong.
·
Delete your data, where we are not required to keep it.
·
Stop processing it, or object to a particular use.
·
Send it to you or someone else in a portable format.
·
Withdraw consent at any time, for marketing or analytics. Atir Letters, Circle offers and Shopping reminders each have a switch in your account settings.
·
Delete your account from your account settings. We email you, and delete it 7 days later. Signing in before then keeps it. If a refund, return or delivery is still open, we wait until it is settled and tell you.
Email info@atir.ae. We respond within 30 days. We will ask you to confirm who you are first, because handing your data to the wrong person would be worse than being slow.
You never have to pay to exercise a right, and we will not treat you differently for using one.
Security
Data is encrypted in transit. Card details never reach our servers. Access to customer data is limited to staff who need it, and our drivers see only the delivery information for the parcels they are carrying.
No system is perfect. If a breach affects your data we will tell you and the regulator, as the law requires.
Children
This site is for people aged 18 and over. We do not knowingly collect data about children. If you think a child has given us data, email us and we will delete it.
Automated decisions
We do not make automated decisions with legal or similarly significant effects. Stripe may review a card payment for fraud prevention. Atir does not make the fraud decision automatically; staff review the payment in Stripe before a manual delivery request is sent to the courier.
Changes
We update this policy from time to time. Material changes get 14 days notice by email before they take effect, and if a change materially alters how we use your data we will ask for your consent again rather than assume it.
Complaints
Talk to us first at info@atir.ae. If we cannot resolve it, you can complain to the UAE Data Office. Contact and complaints has the details.