Privacy Policy

Version 2026-10-16-v11

This Policy explains the personal data we process when you use THE RING store and services, why we use it, who receives it, and your rights and contact options.

1 Scope and company details

  • · 1.1 Scope — This Policy explains how HAYA VISION JEWELLERY L.L.C, trading as THE RING and referred to as we, us or our, collects, uses, discloses and protects personal data when you visit thering.ae, create an account, attempt a purchase, place an order or contact us. It also covers related fulfilment, delivery and customer-service processing.
  • · 1.2 Controller and contact — We are the controller of processing whose purposes and means we determine under this Policy. Our commercial licence number is 1642628, issued by the Dubai Department of Economy and Tourism. Our registered address is Office C1802-12, Ontario Tower, Business Bay, Dubai, United Arab Emirates. For privacy matters and rights requests, contact the THE RING team at support@thering.ae.
  • · 1.3 Law and consent — We observe the laws applicable to the processing, including UAE Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data. This Policy is a notice of our practices, not blanket consent to every use. Using the Website or accepting the sales terms does not replace separate consent required by law, and this Policy does not limit mandatory rights.

2 Data we collect

  • · 2.1 Contact and delivery — We collect name, email, telephone number, billing and delivery addresses, country and city, and state or region, postal code, building, apartment and delivery instructions where needed. Required fields vary by destination and service. Data may include another recipient you select or a person you authorise to receive delivery.
  • · 2.2 Account and preferences — When you create an account, we collect registration details, including your name, title, contact details, date of birth, sign-in and verification data, and country and language preferences. We process addresses you choose to save, orders linked to your account, communication choices, consents and changes. Our staff do not ask for your password, sign-in code or payment code.
  • · 2.3 Orders and checkout attempts — Data includes selected items, options, sizes and quantities, prices, discounts, shipping and totals, the version and time of accepted acknowledgements, order and payment-attempt references, and acceptance, preparation and delivery status. Contact, delivery and checkout-attempt data may be retained before payment is completed to operate or recover the attempt, address a fault or assistance you request, and prevent duplication and fraud.
  • · 2.4 Transactions and evidence — We process Stripe references, payment, refund and dispute status and transaction information needed for reconciliation and accounting, together with DHL waybill references, tracking, proof of delivery and necessary customs documents. Data includes invoices, correspondence, complaints, defect or non-conformity evidence you provide, and the packing videos described in this Policy.
  • · 2.5 Support and enquiries — We collect enquiry details, your message, chosen language and communication references when you use support forms, email or ask about a special quantity. You may provide further information to address your request, but do not send sensitive information, identity documents or payment-card images unless we request specific information for a lawful purpose through an appropriate channel.
  • · 2.6 Technical data — Technical data includes an IP address or derived value, device and browser type, connection, error and security information, event times, referral source and page use, to the extent collected by the relevant service. We also process basket and language state, sign-in or checkout continuity information and records of choices, consent and withdrawal.

3 Data sources and information about others

  • · 3.1 Collection sources — We obtain data from you when you use the Website or contact us; from the operation of Website, payment, delivery and security services; and from Stripe, DHL and providers involved in the transaction. We may receive information relating to a payment, dispute or legal duty from a bank, payment institution or competent authority, as necessary for the lawful purpose.
  • · 3.2 Authorised recipients and accuracy — If you provide another recipient’s details, supply only necessary information and inform them of its use for delivery and order-related communications. Their inclusion does not subscribe them to marketing. Provide accurate, current information and promptly report errors affecting an active order; original records may be preserved where needed by law or as evidence of a transaction or dispute.

4 Processing purposes and grounds

  • · 4.1 Orders and requested services — We use data to take steps you request concerning a purchase; register the order; verify payment and acceptance; arrange production, preparation, delivery, invoicing and related communications; and handle defects, non-conformity and refunds. We also use it to create, verify and service the account you request. The ground is necessity for contract performance or steps at your request concerning its conclusion, amendment or termination.
  • · 4.2 Compliance and legal rights — We process data needed to meet specific legal obligations, including records, invoices, tax and applicable verification, anti-money laundering and sanctions requirements, and to respond to competent authorities. We also process what is necessary to establish, exercise or defend legal claims and rights and for judicial or security proceedings permitted by law.
  • · 4.3 Security and assistance — We use proportionate data to secure accounts, payments and orders, prevent duplication and misuse, assess fraud indicators, document packing and investigate discrepancies. Reliance without consent is limited to what contractual necessity, a specific legal duty or permitted legal claims and proceedings allow; we obtain consent where required.
  • · 4.4 Choices and required information — Where an optional function relies on consent, it is separate from acceptance of sales terms and can be withdrawn through its associated method or our support email. Withdrawal does not affect earlier lawful processing or an independent lawful ground. Necessary data may be required to fulfil an order or mandatory check, but declining an optional use does not by itself prevent purchase.

5 Verification and automated checks

  • · 5.1 Verification information — We may request suitable proof of identity or connection with a payment method or address where risk indicators, a high-value order or a legal duty justify it. We explain the purpose, information required and submission method and limit collection and access to what is necessary. We do not request a full card number, CVC, password or one-time payment code.
  • · 5.2 Human review — Order and payment services use automated rules to check amounts, currency, capacity, duplication and risk status, and an order may be held for checks. An automated indicator is not proof of fraud. You may explain the circumstances and request human review of an automated decision affecting your order or rights, under applicable rights and safeguards. Law may prohibit disclosure of a particular report or proceeding.

6 Accounts payments and delivery

  • · 6.1 Guest purchase and order ownership — You may buy without an account. A matching email alone is insufficient to link a guest order to an account or disclose its details; reliable ownership verification and access authority are required. We use sign-in and secure guest-access information and may require proportionate further verification before changing sensitive information or fulfilling a rights request.
  • · 6.2 Stripe and card information — Payments are processed through Stripe Checkout, including its embedded interface where displayed, using cards, Apple Pay and Google Pay as available. Card information is entered through the payment provider’s interface, and we do not store full card numbers or CVC. We process transaction references, status and limited information needed for orders, reconciliation, refunds and disputes, and may receive risk or payment-method information from Stripe.
  • · 6.3 Payment data sharing — We share contact, order and necessary delivery information with Stripe to process payment and prevent fraud. Stripe, its relevant affiliates and financial institutions, including Network International, LLC for Visa and Mastercard transactions in the UAE, participate as applicable to the service. Some have independent purposes described in their notices; this Policy does not enrol you in a separate service or give them marketing consent.
  • · 6.4 Carrier and customs — We provide DHL, authorised delivery and clearance participants and competent authorities with necessary information, such as recipient name, telephone, address, shipment contents, value and documents. Where import charges are due in the destination country, those parties may process data to collect them directly from you. Our current store service does not collect or reconcile those charges.

7 Cookies and storage on your device

  • · 7.1 Scope and function — The Website uses cookies, local storage, session storage and identifiers to enable requested functions and security. A random or derived identifier can be linkable to a browser or order and is not anonymous merely because it omits a name. Server records, platform statistics and payment or security services are distinct from data stored directly on your device.
  • · 7.2 Checkout security cookie — ring_bid is set when an order is submitted to help prevent checkout abuse and card-testing attacks. It contains a random identifier whose derived value is used server-side for that purpose, not for marketing or advertising tracking. The cookie lasts up to 365 days and is subject to appropriate access and security controls.
  • · 7.3 Secure guest-order access — __Host-tr_order_access helps establish a guest browser’s authority to view its orders without an account. It contains opaque access tokens; an order number alone does not grant access. Its maximum duration is 120 days, and an individual order token may expire sooner or be revoked for security. Protect your private order links and access credentials.
  • · 7.4 Language basket and appearance — NEXT_LOCALE remembers a language choice in a cookie for up to 365 days, and the choice may also be saved locally. thering-cart-v1 stores basket selections and thering:theme an appearance preference. Local storage remains until replaced or cleared by you, your browser or the service; retaining a basket does not reserve items or lock a price.
  • · 7.5 Sign-in and checkout continuity — The sign-in service stores session information needed for continued authentication. thering:checkout:draft:v1 stores checkout details, such as contact, address and current step, for a maximum of two hours in session storage. thering:payment:attempt and thering:checkout:attempt support payment-attempt continuity and duplicate prevention, not storage of full card numbers or CVC; they are cleared according to completion, tab-session expiry or cleanup.
  • · 7.6 Your controls — You may delete or block cookies and storage through browser settings and contact us about a technology or withdrawal of consent. Blocking technology necessary for a requested function may prevent it from working. Browser controls do not necessarily prevent server records or processing required by law, and browsing alone is not treated as consent to an optional use.

8 Usage statistics and security services

  • · 8.1 Platform statistics — Our hosting platform provides Website-use statistics, such as visits, page views, referral source, device type and approximate country, to measure store performance and understand usability problems. An aggregate report does not mean every underlying data item is anonymous. We distinguish this measurement from necessary security records and advertising tracking.
  • · 8.2 Choices and separate purposes — Analytics and optional technologies are subject to the consent, objection and stopping requirements applicable to their technology and purpose; hosting-provider operation alone does not make them necessary. You may contact us about this processing or object where entitled. A new advertising or cross-site tracking use requires separate information, choices and the necessary lawful ground before your data is used for it.
  • · 8.3 Protection and error diagnosis — We use Cloudflare Turnstile to check automated abuse in relevant forms, and connection-protection and error-diagnosis services. These services may process browser, device and connection information and check results, and error reports reach the platform provider. Security data does not authorise offers or advertising-list sharing. Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/.

9 Communications and availability requests

  • · 9.1 Service messages — We may send verification, security, order-registration, acceptance, preparation, delivery, support, rejection and refund messages reflecting actual status, and messages needed to address a checkout fault or assistance you request. Not every service message requires a paid order, and an unpaid attempt is not represented as a completed purchase. A promotional reminder to complete a purchase is subject to the marketing rules in clause 9.3; it does not become a necessary service message merely because you entered an email or began checkout. Stopping marketing does not prevent messages necessary for an active service or legal duty.
  • · 9.2 Specific availability requests — If you ask us to notify you when a particular item becomes available, we use contact details and item selection for that request only. It does not reserve an item, price or purchase priority or subscribe you to brand news or offers. You may stop the notification free of charge through support@thering.ae with the relevant email and item, without creating an account.
  • · 9.3 Marketing and no sale of data — Accepting our Terms or buying a ring is never, by itself, consent to marketing. If you place an order, we tell you at checkout that we may email you occasional offers about similar products from THE RING; this applies only after a paid order, and every such email lets you unsubscribe free of charge. Any other marketing from THE RING is sent by email only with your separate, explicit consent, given through a choice that is never preselected. You may stop marketing at any time through the unsubscribe link in the message, your account, or by emailing support@thering.ae, without creating an account; we respect withdrawal across all marketing-email routes. Withdrawal does not prevent the necessary service messages described in clause 9.1. We do not sell your data or upload customer information to advertising platforms merely because you deal with us.
  • · 9.4 Sharing with HAYA VISION companies — Only if you tick the separate, optional box at checkout or switch it on in your account, we share your name and email address with companies and projects operating under the HAYA VISION name, so they can send you their own offers. Each recipient uses the data for that purpose only and must stop when you withdraw. We record when and how you chose. You may withdraw at any time through the unsubscribe link, your account or support@thering.ae; withdrawal stops further sharing and is passed on to recipients, and does not affect your orders.

10 Packing cameras and brand content

  • · 10.1 Packing videos — We record order preparation and packing to evidence contents and condition, control quality and investigate discrepancies, damage or claims. An order reference, shipping label, recipient name or address may appear if visible during recording. Access is limited to authorised team members and persons needed for a claim or legal proceeding; recordings are not used as advertising or public customer content.
  • · 10.2 Duration and premises security — Ordinary packing videos are kept for one year from packing. A particular recording may be kept longer for a legal obligation, claim or justified investigation. Premises-security CCTV has separate purposes, notices and retention requirements to protect people, premises and property; the one-year period does not apply to it automatically.
  • · 10.3 Brand photographs and messages — The physical photograph and letter from Haya and Anas included in the brand’s packaging experience are content we supply, not a customer-uploaded photograph or a customer-written personal message. The ring-purchase service does not include customer-image uploads, a customer-written gift message or engraving requests. You may still send ordinary support correspondence or evidence for a claim through an appropriate channel.

11 Order links and sharing

  • · 11.1 Private links — Your order page and associated access and tracking links are for the customer or authorised person subject to required verification. Protect access messages and private links and do not publish them. If brand materials include an available link or QR code to brand content, following it does not grant others access to your private order information. The destination’s own notice applies where a link opens an external service.
  • · 11.2 Sharing by choice — Where the Website offers sharing, you choose whether to share the brand text and public Website link using your device’s sharing function or to copy them for your own use. Acceptance does not cause us to publish on your behalf. The prepared sharing text and public link do not include your address, email, order number, price, size or private access tokens. Your chosen application handles what you send under its notice; any information you add or screenshot you take is your choice and responsibility.

12 Who receives data

  • · 12.1 Technology hosting and email — We exchange necessary data with Lovable Cloud, managed database, storage and authentication services using Supabase, and security and email providers involved in the service. Email routes include Lovable and Resend according to the channel used. Providers receive what is needed for hosting, authentication, message dispatch and delivery tracking or service protection; this does not authorise undisclosed advertising on our behalf.
  • · 12.2 Payments delivery and workshops — Recipients include Stripe and relevant financial institutions, DHL, delivery and clearance participants and competent authorities for the stated purposes. Production workshops receive the order reference, ring specifications, size and quantities needed; routine manufacturing instructions do not include the customer’s name, email, telephone or address. An order reference remains linkable in our records and is not anonymous for that reason.
  • · 12.3 Team advisers and authorities — Authorised team members access what their tasks require, and accountants, auditors, legal advisers and insurers may receive what is needed for their work. We disclose to authorities and courts where required or permitted by law. A lawful business or asset transfer involves only necessary disclosure with confidentiality and data protection and notice where required.
  • · 12.4 Recipients’ roles and notices — Where a provider processes data on our behalf, processing is restricted by purpose, instructions, confidentiality, security and appropriate access. A payment institution, carrier or authority may act as an independent controller for some activities. Using a provider does not remove our responsibility for processing or disclosure we determine. Provider-notice links do not give consent to processing unrelated to the requested service.

13 Processing outside the UAE

  • · 13.1 Countries and recipients — Our services are managed from the UAE. Technology, payment, email and delivery providers may host, access or process data outside it and, for international orders, in the destination country. A primary database location does not identify every support, backup or processing location. Stripe describes international processing, including in the United States and India, and Resend describes primary processing operations in the United States; other countries vary by service and provider.
  • · 13.2 Safeguards and information requests — Transfers use a ground permitted by law and safeguards required in the circumstances, such as recognised adequate protection, required contractual commitments, necessity for contract performance or legal claims, or explicit consent where reliance on it is permitted. This Policy is not blanket transfer consent. You may request information about countries, recipients and safeguards relevant to your data through support, subject to applicable rights and confidentiality.

14 Retention and deletion

  • · 14.1 Business and tax records — Records needed for corporate tax, including relevant order, invoice and transaction records, are kept for at least seven years after the end of the relevant tax period, or longer if another law or competent authority requires. This does not mean that all browsing, account or correspondence data is kept for the same period.
  • · 14.2 Other data — Account data is kept while the account is used; unnecessary data is removed following closure and request handling, while required records are separated. Support, uncompleted-checkout, verification and security data is reviewed according to its collection purpose, follow-up outcome, security risk and legal periods. We keep what is necessary and do not automatically turn an incomplete checkout into a permanent marketing record.
  • · 14.3 Packing availability and choices — The one-year period applies to ordinary packing videos as stated above. Availability-request data is kept while the request remains active, then unnecessary information is removed after fulfilment, withdrawal or the end of its purpose. A limited consent, withdrawal or suppression record may be retained to evidence and respect a choice, without using it to send messages the customer stopped.
  • · 14.4 Disputes and backups — Specific data may be retained longer for a claim, proceeding, justified investigation or competent-authority instruction, with access and use limited to that purpose. When the need and mandatory period end, data is deleted or genuinely anonymised. A restricted backup copy may remain until its retention cycle ends; it is not returned to ordinary use for a purpose incompatible with deletion, and appropriate restrictions are reapplied after restoration.

15 Your rights and how to exercise them

  • · 15.1 Applicable rights — Subject to legal conditions and exceptions, you may request information about processing, recipients, retention and safeguards; a copy, correction or completion of your data; deletion, restriction or stopping of processing; withdrawal of consent; and objection to marketing and related profiling. You may request a structured machine-readable copy or transfer where its conditions apply, and exercise rights relating to automated decisions.
  • · 15.2 Method and verification — Email support@thering.ae describing your request and the email associated with the record or an order reference that helps locate it. You do not need an account. We proportionately verify your identity and any representative’s authority before disclosing or deleting data. We request no more than needed and may use an appropriate alternative if you cannot access the original email.
  • · 15.3 Handling and timing — Our team assesses the request, gathers necessary data from connected services and carries out what you are entitled to under law using appropriate methods. Recording an account request, displaying receipt or signing out does not mean export or deletion is complete. We respond without unjustified delay within the legal period and explain a permitted exception or extension. Our three-working-day initial response target does not replace that period.
  • · 15.4 Accounts and continuing rights — Closing an account does not cancel an active order, invoice or claim or automatically erase records required by law or needed for a specific claim. If a request cannot be fulfilled wholly or partly, we explain the reason and available rights to the extent required by law. We do not penalise you merely for exercising a lawful right.

16 Security and incidents

  • · 16.1 Appropriate measures — We apply technical and organisational measures appropriate to the data and processing risks, including role- and need-based access, order and account ownership checks, and protection of access methods, storage and investigation records. Team membership alone does not give access to all customer data, and verification documents and packing videos are not published for public access.
  • · 16.2 Protecting access and responding — No system guarantees absolute security. Protect passwords, codes and order links and promptly report suspected unauthorised access. We investigate incidents affecting data, take appropriate steps to limit their effects and address their cause, and notify competent authorities and affected individuals when, how and within the periods required by law. This statement does not exclude an obligation or liability that cannot lawfully be excluded.

17 Minors

  • · 17.1 Age and capacity — The purchase service is intended for persons aged at least 18 calendar years with the capacity required under the Terms. Date of birth is collected during registration; account creation, entering a date or passing a registration check does not by itself establish capacity to purchase. We do not target children with personalised advertising or knowingly collect their data for it, and parental consent and additional safeguards apply where required by law.
  • · 17.2 Data inappropriate for the service — Contact us if you become aware that a minor provided data inappropriate for the service or without necessary authority. We assess the circumstances, stop impermissible processing and take suitable steps for deletion, restriction or communication with the legal representative under law, while preserving a record required for a specific legal reason.

18 Other laws and external services

  • · 18.1 International rights — Where another data-protection law applies to particular processing, we respect its mandatory rights, including those of individuals in the EEA or UK where their law applies. Residence elsewhere or use of an international provider alone does not make every law or purpose identical. You may contact us about relevant rights and transfer arrangements without prejudice to approaching the competent authority.
  • · 18.2 Provider notices — For relevant services and independent processing, see Stripe https://stripe.com/ae/privacy; DHL https://www.dhl.com/ae-en/home/footer/privacy-notice.html; Lovable https://lovable.dev/privacy; Supabase https://supabase.com/privacy; Resend https://resend.com/legal/privacy-policy; and Cloudflare https://www.cloudflare.com/privacypolicy/. A provider’s notice does not replace our responsibility for data we decide to collect or disclose.

19 Contact complaints and updates

  • · 19.1 Support and complaints — For questions, requests or complaints, email support@thering.ae or write to our registered address above. Support hours are Monday to Friday, 10 a.m. to 4 p.m. Dubai time, excluding public holidays, with an initial response target of three working days. You may complain to the competent data-protection authority, including the UAE Data Office within its remit, without having to accept our internal assessment.
  • · 19.2 Versions and changes — The Policy displays its version and update date. We may update it for a lawful change in services, providers or legal duties, with appropriate notice of a material change and fresh consent where required before a new use. An update does not retrospectively authorise an incompatible purpose for existing data, and continued browsing is not consent where an affirmative choice is required.
  • · 19.3 Languages and mandatory rights — The Arabic and English versions describe the same processing and rights. Any difference is interpreted to preserve the correct meaning, required information and mandatory rights; a translation difference does not remove protection or comprehensible information required by law.