Datenschutz- & Cookie-Richtlinie

KARMA WEAR ("we," "us," "our") respects your privacy. This policy explains what personal data we collect when you visit or shop on this website, why we collect it, how long we keep it, and what rights you have over it.

1. Who we are

KARMA WEAR
Karma Wear FZC LLC — a company registered in the United Arab Emirates
Ground Floor, Entrance No. 2, Al Zahia Area, Sheikh Mohammed Bin Zayed Rd, Sharjah, United Arab Emirates
hello@karmawear.co

We are the data controller for the personal data described in this policy.

EU representative (Article 27 GDPR): Domiluxe OÜ, Sõpruse pst 225-32, 13414 Tallinn, Estonia — nele@karmawear.co

2. What we collect

Information you give us directly

• Contact details you enter at checkout: name, email address, shipping address, postal code, country.
• Messages you send us via email or a contact form, including anything you choose to tell us in them.
• Newsletter sign-up: your email address, and the fact that you subscribed.

Information collected automatically

• IP address and approximate location (country/region level).
• Device and browser type, operating system, screen size.
• Pages visited, referring page, time spent on site, links clicked.
• Cookie identifiers and similar technologies — see the Cookies section below for the full list and your controls.

Information collected during checkout

• Order contents, order value, and order history.
• Billing/shipping details you provide. We do not store full payment card numbers — card data is processed directly by our payment processor (Shopify Payments), which has its own privacy policy.

3. Cookies and similar technologies

A cookie is a small text file placed on your device when you visit a website. Cookies let a site remember your actions and preferences, or recognize your device across visits.

Some of the items listed below are stored in your browser's local storage rather than as traditional cookies. Local storage has no built-in expiry date; where we show a duration (for example, 180 days for your cookie preferences), that period is enforced by the site itself. You can clear all of these at any time by clearing this site's data in your browser.

Essential (always on) — required for the site to function; you can't opt out of these, because the site can't work properly without them.

Functional — enable enhanced, non-essential functionality (e.g. remembering that you've dismissed a banner).

Analytics — help us understand how visitors use the site, so we can improve it. Only set if you accept this category.

Marketing — used to show you relevant ads on this and other sites, and measure ad performance. Only set if you accept this category.

Your cookie choices:

• EU/UK visitors: non-essential cookies are blocked until you actively accept them. Use the cookie banner or "Your Privacy Choices" in the footer at any time to change your choice.
• US visitors: analytics/marketing cookies may load by default; you can opt out at any time via "Your Privacy Choices" in the footer. If your browser sends a Global Privacy Control (GPC) signal, we honor it automatically and skip showing the banner.
• You can also block or delete cookies via your browser settings at any time — see your browser's help pages for instructions.

4. Why we collect it (legal basis)

5. How long we keep it

• Order and billing records: kept for 7 years to comply with UAE tax and accounting law (5 years minimum under UAE VAT law, 7 years under UAE Corporate Tax law).
• Newsletter subscriber data: kept until you unsubscribe.
• Analytics/marketing cookie data: the cookies last as long as stated in the Cookies section above (Google Analytics cookies up to 2 years). Google Analytics keeps the visit data linked to them for 14 months, then deletes it.
• Customer service correspondence: kept for 2 years from your last contact with us.

6. Who we share it with

We do not sell your personal data. We share data only with:

• Payment processors, to complete your transaction.
• Shipping/courier partners, to deliver your order.
• Email delivery providers, to send our newsletter and the email that confirms your sign-up.
• Analytics and marketing tool providers, only if you've consented to those cookie categories (see the Cookies section above).
• Authorities, where required by law.

Any processor we use is contractually required to protect your data and use it only for the purpose we've instructed.

Our store runs on Shopify. Shopify may use information about your purchase and how you use our store, together with information from other Shopify stores, to improve its services, prevent fraud, and recognize you when you shop with other Shopify merchants. For this use, Shopify acts independently of us. See Shopify's Privacy Policy for details.

7. International transfers

We are based in the United Arab Emirates, and some of the partners who help us fulfill your order (including order-fulfillment and warehousing providers) are located in China. This means that when you shop with us from the EU, EEA, or UK, your personal data (such as your name and delivery address) is transferred to and processed in countries outside the EU/EEA and UK that have not received an "adequacy" decision from the European Commission or the UK government.

Where we make such a transfer, we rely on an approved safeguard to protect your data — for transfers out of the EU/EEA, the European Commission's Standard Contractual Clauses; for transfers out of the UK, the UK International Data Transfer Agreement (or the UK Addendum to the SCCs) — together with additional measures where appropriate. You can ask us for a copy of these safeguards using the contact details below.

8. Security

We use reasonable technical and organizational measures (encrypted connections, access controls, restricted staff access) to protect your data against unauthorised access, loss, or misuse. No online system is 100% secure, but we take this seriously.

9. Your rights (general / EU & UK residents)

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data ("right to be forgotten").
• Object to or restrict certain processing.
• Data portability (receive your data in a portable format).
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at hello@karmawear.co. We will respond within the timeframe required by applicable law (typically 30 days under GDPR). The sections below add specific rights and disclosures for a few other regions we ship to.

10. Additional rights for California residents

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the following rights in addition to those listed above:

• Right to Know — request that we disclose the categories and specific pieces of personal information we've collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties we've disclosed it to, in the preceding 12 months.
• Right to Delete — request that we delete personal information we've collected from you, subject to certain exceptions (e.g. completing a transaction, legal compliance, security, fraud prevention).
• Right to Correct — request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale/Sharing — we do not sell personal information for money. Our marketing/advertising cookies (only set if you've consented to that category) may count as "sharing" for cross-context behavioral advertising under the CPRA's broad definition. You can opt out at any time via "Your Privacy Choices" in the footer, or automatically by sending a Global Privacy Control (GPC) signal from your browser.
• Right to Limit Use of Sensitive Personal Information — we do not collect sensitive personal information as defined by the CPRA (e.g. government ID numbers, precise geolocation, health data) beyond what's necessary to fulfill and ship your order.
• Right to Non-Discrimination — we will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised any of these rights.

Categories of personal information collected in the preceding 12 months: identifiers (name, email, address, IP address), commercial information (order history), internet/device activity (browsing behavior, cookie identifiers) — see Section 2 for detail. We have not sold personal information for monetary consideration in the preceding 12 months.

How to exercise these rights: email hello@karmawear.co with your request. We may need to verify your identity first (typically by confirming details matching an order you've placed with us). You may designate an authorized agent to make a request on your behalf.

11. Additional rights for Virginia, Colorado, and other US state residents

If you are a resident of Virginia, Colorado, Connecticut, or another US state with a comprehensive consumer privacy law, you have rights similar to those described for California residents above, which typically include:

• Right to access/know — confirm whether we process your personal data and obtain a copy of it.
• Right to correct inaccuracies in your personal data.
• Right to delete personal data we hold about you.
• Right to opt out of (a) targeted advertising, (b) the "sale" of personal data, and (c) certain profiling. We do not sell your personal data for money; if you have accepted marketing cookies, that activity may be treated as "targeted advertising" or a "sale/share," and you can opt out at any time via "Your Privacy Choices" in the footer, or automatically by sending a Global Privacy Control (GPC) signal from your browser.
• Right to appeal — if we decline your request, you may appeal by replying to our decision; we will respond within the time your state's law requires.

We do not use your personal data for decisions producing legal or similarly significant effects. To exercise any of these rights, contact us at hello@karmawear.co.

12. Additional rights for Australian residents

If you are located in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to how we handle your personal information, in addition to the rights in Section 9:

• Access and correction — you can request access to the personal information we hold about you, and request correction if it's inaccurate, out of date, incomplete, or misleading (APP 12 and 13).
• Overseas disclosure — some of the providers we use (payment processing, hosting, analytics — see Section 6) may be located outside Australia, including in the EU. Where required, we take reasonable steps to ensure these recipients handle your information consistently with the APPs.
• Complaints — if you're not satisfied with how we've handled a privacy complaint, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

13. Additional rights for Canadian residents

If you are located in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to how we handle your personal information, in addition to the rights in Section 9:

• Consent — we collect, use, and disclose your personal information only with your knowledge and consent, except where permitted or required by law.
• Access and correction — you can request access to the personal information we hold about you and ask us to correct any inaccuracies.
• Withdrawing consent — you can withdraw consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions (for example, we can't complete an order without billing/shipping details).
• Complaints — if you're not satisfied with our response, you can file a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.
• Quebec residents — Law 25 (Act Respecting the Protection of Personal Information in the Private Sector) gives you additional rights, including data portability and the right to be informed of any automated decision-making that significantly affects you.

14. Children's privacy

This site is not directed at children under 16, and we do not knowingly collect data from them.

15. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will reflect the most recent revision. Material changes will be communicated via the site or by email where appropriate.

16. Contact

Questions about this policy or your data: hello@karmawear.co / Ground Floor, Entrance No. 2, Al Zahia Area, Sheikh Mohammed Bin Zayed Rd, Sharjah, United Arab Emirates.