Privacy Policy

Soznikar is the operating name of Kashmiri Soznikar FZ-LLC (RAKEZ E-Commerce Licence No. 45002397, registered in Ras Al Khaimah, United Arab Emirates). The company holds the personal data of every buyer, every newsletter subscriber, and every visitor to the site. The policy below is a plain account of what is held, why, how long, and what the buyer can ask the company to do about it.

This policy reflects the requirements of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) and aligns with the broader privacy expectations of the European General Data Protection Regulation (GDPR).

What the studio collects

Three categories of personal data are collected.

Order data. When a buyer places an order, the studio collects: full name, billing address, shipping address, email, phone number, and the items in the order. Payment card details are not stored by the studio at any point; they are held by the payment processor (Tap Payments, Tabby, Tamara, or the equivalent), and the studio receives only a transaction reference and the last four digits of the card.

Account data. If a buyer creates an account on the site, the studio holds the email and a hashed password (never the password itself in readable form), along with the order history associated with the account.

Communications data. Emails sent to care@soznikar.com and messages on the studio WhatsApp line are held in the studio's inbox for the duration described in the retention section below. Newsletter subscriptions hold the subscriber's email and, optionally, first name.

The studio does not collect: religion, ethnicity, political opinions, health data, sexual orientation, criminal records, or any other category designated as "sensitive personal data" under the UAE PDPL.

What the studio collects automatically

Like any modern website, soznikar.com collects standard web analytics data: pages visited, time on site, country and city of the IP address (not the precise IP itself), browser type, and the source from which the visitor arrived (direct, search, referral, paid). This data is collected through Google Analytics 4 and Meta Pixel and is held in those platforms' standard formats.

This data is used to understand which pages buyers find useful, which products generate interest, and which marketing channels work. It is not used to identify individual visitors and is not sold or shared with third parties beyond the platforms above.

Cookies

The site uses three types of cookies:

Essential cookies required for cart, checkout, and account login. These cannot be disabled while using the site.
Analytics cookies from Google Analytics 4 and Meta Pixel, used as described above. The buyer can opt out at the cookie banner that appears on first visit.
Marketing cookies from Meta and Google, used for retargeting advertising to buyers who have visited the site. The buyer can opt out at the cookie banner.

Why the studio holds this data

Order data is held to fulfil the order, to issue VAT-compliant invoices required by UAE Federal Tax Authority regulations, and to provide post-purchase support including returns and warranty.

Account data is held to allow the buyer to track orders, view purchase history, and place future orders without re-entering their details.

Communications data is held to provide continuous customer support across multiple interactions.

Newsletter data is held to send the marketing emails the buyer has subscribed to.

Analytics and cookie data is held to operate and improve the site.

Who else sees this data

The studio shares personal data with the following service providers, each under a written data processing agreement:

Shopify - operates the storefront and the order system, holds order data and account data, encrypted in transit and at rest.
Tap Payments, Tabby, Tamara - process payments, hold payment data and transaction records, regulated by the UAE Central Bank.
Aramex - receives shipping address, name, and phone number to deliver the order.
Klaviyo - sends marketing emails to subscribers, holds email and first name; does not receive payment data.
Google (Analytics, Tag Manager) - holds anonymous analytics data as described above.
Meta (Pixel) - holds anonymous analytics and retargeting data.
The studio's accountant and the UAE Federal Tax Authority - for tax compliance, only the data required for tax purposes (order totals, VAT amounts, dates).

The studio does not sell personal data to any third party. The studio does not share personal data for marketing purposes with companies not listed above.

How long the data is kept

Order data is held for seven years from the date of the order, as required by UAE tax law for VAT records.

Account data is held for as long as the account remains active. If the buyer requests account deletion, all account data is removed within thirty days, except for the order history required for the seven-year tax retention above.

Communications data is held for two years from the date of the last interaction in the thread, then archived.

Newsletter data is held for as long as the subscription remains active. Unsubscribing removes the email from the active list immediately; the email is held for a further thirty days in a suppression list to prevent re-subscription by mistake, then deleted.

Analytics data is held in accordance with the standard retention settings of the relevant platforms (Google Analytics: fourteen months; Meta Pixel: as set by the platform).

The buyer's rights

Under the UAE PDPL and the broader principles of modern data protection, the buyer has the following rights:

Right of access. The buyer may request a copy of all personal data the studio holds on them. The studio responds within thirty days.
Right of correction. The buyer may request that incorrect or outdated data be corrected.
Right of deletion. The buyer may request that their data be deleted, subject to the seven-year retention required for tax records.
Right to object. The buyer may object to marketing communications at any time, by clicking the unsubscribe link in any email, by replying STOP to any SMS, or by writing to care@soznikar.com.
Right to portability. The buyer may request a copy of their data in a structured, machine-readable format.
Right to lodge a complaint with the UAE Data Office (the relevant supervisory authority under the PDPL).

To exercise any of these rights, write to care@soznikar.com. The studio responds within thirty days.

Security

Personal data is held on Shopify's encrypted infrastructure, which is PCI-DSS compliant for payment data and ISO 27001 certified for general information security. The studio's own systems (email, accounting software) are protected by two-factor authentication on every account. Access to personal data is limited to the founder and any staff member with a direct need to handle a specific order.

If the studio becomes aware of a personal data breach, the buyer is notified within seventy-two hours of discovery, in line with the UAE PDPL requirement, with a clear account of what was compromised and what the buyer should do.

Children

The Soznikar site and product line are intended for adults aged eighteen and above. The studio does not knowingly collect personal data from children under eighteen. If a parent or guardian discovers that a child has provided personal data to the site, write to care@soznikar.com and the data will be removed.

International transfers

Some of the service providers listed above (Shopify, Google, Meta, Klaviyo) hold data on servers located outside the United Arab Emirates, primarily in the European Union and the United States. Each is contractually bound to the standard of data protection that applies under the UAE PDPL and, where relevant, the EU GDPR. The studio reviews these contracts annually.

Changes to this policy

If this privacy policy changes, the change is announced at the top of this page and an email is sent to every newsletter subscriber and every active account. Continued use of the site after a change indicates acceptance of the updated policy.

Contact

All privacy questions and requests should be directed to care@soznikar.com. The studio responds within one business day for routine questions and within thirty days for formal data subject requests.

This policy was last updated on the date the page was published. The buyer may request a previous version of this policy from care@soznikar.com at any time.