Who we are — the controller of your data

The controller of your personal data is Lavin Fashion Company (LLC), unified number (commercial registration) 7054775312, based in Riyadh, Saudi Arabia, which runs the lavin.fashion store and the Lavin app. For anything about your privacy or your rights over your data: [email protected] — this is our dedicated privacy channel and our team answers it. We have not appointed a separate personal data protection officer, so the responsibility sits with management directly and is exercised through that address.

We process your data under the Personal Data Protection Law, issued by Royal Decree No. (M/19) dated 9/2/1443H and amended by Royal Decree No. (M/148) dated 5/9/1444H, together with its Implementing Regulation and the Regulation on Personal Data Transfer Outside the Kingdom; the authority supervising it is the Saudi Data and AI Authority (SDAIA). And under the E-Commerce Law and its regulations issued by the Ministry of Commerce.

The data we collect, and how we collect it

We collect the following, all of it directly from you — either because you type it or because you browse the store. We do not buy anyone’s data and we do not collect it from an outside broker:

• Identity and contact details (required for an order): name, mobile number, email address — you type them at checkout or when you create an account.
• Delivery details (required for an order): your city, your region and your Saudi short national address from Saudi Post (in the form ABCD1234) — a required field, because it identifies your location precisely and saves you writing out the street and district; the detailed address is optional after it.
• Order data: the items ordered, the order value, the payment method, your purchase history, your order note if you write one, and the internet (IP) address the order was placed from — the store keeps it with the order as evidence of the contract.
• Payment details: typed and processed at the payment gateway only. We never see your card numbers and never store them on our systems. What reaches us from the gateway is the payment method name, the transaction reference and its result.
• Account data (optional): your password stored hashed, never in clear text; your wishlist; and a saved address if you choose to save one.
• Browsing and measurement data (optional — only with your consent): your browser or device identifier, your internet address, and the pages and pieces you viewed or added to the basket. None of it is collected before you consent in the cookie notice.
• What you write to us: your message on the contact form, by email or on WhatsApp, and your question to the Lavin automated assistant.

We do not collect your national ID or iqama number, any image of an official document, health data, your precise location, or sensitive data as the Law defines it. The measurements you enter in “what is my size?” are used at that moment and never stored.

Why we process your data, and on what legal basis

• Fulfilling your order — completing it, collecting payment, buying the piece from the supplier, delivering it to you, issuing your invoice and handling a return or exchange. Basis: performance of the contract you are a party to (Personal Data Protection Law, Article 6(2)). This data is mandatory: without a name, an address and a number your order cannot be delivered.
• Serving and answering you — your questions, your complaints and tracking your shipment. Basis: performance of the contract, or our legitimate interest in answering someone who writes to us (Article 6(4)).
• Running and securing the store — hosting it, storing its data and backing it up, preventing abuse and fraud, and alerting our team to a stuck order. Basis: our legitimate interest (Article 6(4)), and to the minimum extent.
• Measuring the store and its advertising — learning what is used and bought, measuring the effect of our campaigns, and showing advertising closer to your interests. Basis: your consent alone (Article 5, and Article 26 for marketing purposes). None of those tools runs before it, and you can withdraw it at any time.
• New-arrivals emails and your basket reminder. Basis: your separate consent, which you choose yourself (Article 26 of the Law and Article 29 of the Implementing Regulation).
• Meeting our legal obligations — keeping trade invoices and their documents, and responding to a request from a competent authority. Basis: required by another law (Article 6(2)).

We do not process your data for a purpose incompatible with the one it was collected for, and if we need a new purpose we will tell you before we begin.

Where your data is stored, and by what means

This section states a fact many stores leave out: our store database is not in Saudi Arabia. The store runs on shared hosting with Hostinger International Limited on the node fr-int-web1343.main-hosting.eu, its database sits on the same machine, and that machine is in Paris, France. So everything the store stores — your account, your order, your address, your message — is stored there, and the hosting provider is a processor acting on our instructions. Our backups are encrypted and kept on Cloudflare R2 storage.

What serves the Lavin app — your basket, your account, your order notifications and the Lavin assistant — runs on a server of ours inside Saudi Arabia, in Riyadh (Oracle Cloud). Product images are served from the Cloudflare network, which routes through the node nearest you and keeps the internet address and the requested URL in its logs.

The entities your data reaches, and their capacity

We do not sell your personal data or trade in it, and we do not disclose it to any entity outside this list. Every entity here is measured in our own store, not assumed, and receives the minimum data its purpose needs. “Outside the Kingdom” means the processing takes place on that entity’s servers abroad:

Running the store — always active, not dependent on your consent

• Hostinger International Limited — processor: hosting the store, its database and its email. All store data reaches it by virtue of the hosting. Outside the Kingdom (France).
• Cloudflare, Inc. — processor: the delivery and protection network in front of the store, and image and backup storage. It receives the internet address, the URL and the technical request data as they pass through. Outside the Kingdom.
• Oracle Cloud — processor: the server running the app’s backend and our operational jobs. Inside the Kingdom (Riyadh).
• PayTabs — the licensed payment gateway: it receives your card or wallet details, the order value and the contact details the transaction needs, and acts as a controller of payment data under its own regulatory regime and privacy policy.
• Tamara — only when you choose pay-later: they receive your name, mobile number, email and the order value to check eligibility and complete the payment plan, as an independent controller under their own privacy policy.
• AliExpress and the supplier of the piece — because your pieces ship from the supplier’s warehouse: we place the purchase order there and it receives your name, mobile number, city, region, short national address and postal code — the fields their interface requires to create the order, and the least the carrier needs to hand the parcel to you. Your email address does not reach them — their interface has no field for it — nor do your payment details or your browsing history. Outside the Kingdom.
• Telegram — operational alerts to our team: the order number, its value, the payment method, your city and the item names, without your name, number, address or email. Outside the Kingdom.
• Official authorities in the Kingdom — where a legal obligation requires it, only to the extent required, and we document every such request.

Measurement and advertising — none of these runs before your consent

What reaches these entities: the device or browser identifier, the internet address, the pages you visited, and the pieces you viewed or added to the basket. On completing an order, contact details (email and mobile number) may be sent as a one-way hash (SHA-256) to match the purchase to the campaign — never in their original form. All of them are outside the Kingdom, and all act as joint or independent controllers under their own policies:

• Google LLC — visit analytics (Google Analytics 4) and Google Ads conversion measurement. We say it plainly: our analytics property is linked to a Google Ads account with ads personalisation enabled, so the measurement data serves advertising too — which is why it sits behind your consent, not outside it.
• Meta Platforms, Inc. (Facebook and Instagram) — the measurement pixel and the server-side Conversions API.
• TikTok Pte. Ltd. — the TikTok pixel and its events.
• Snap Inc. (Snapchat) — the Snap pixel for conversion measurement.
• Pinterest, Inc. — the Pinterest tag for conversion measurement.
• X Corp. (formerly Twitter) — the X pixel for site-audience building and visit measurement.
• Klaviyo, Inc. — our email platform. The detail is in the messages section below.

The product feeds we send to Google, Pinterest, Snap and TikTok are product data, not your data: a title, an image, a price and availability, with nothing in them about you.

Transfer outside the Kingdom — its basis and its safeguards

Some of the above happens outside the Kingdom, as we set out entity by entity. Our basis for it is Article 29 of the Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom:

• Performance of an obligation you are a party to (Article 29(1)(c)) — the basis for everything your order cannot be completed without: the hosting the store runs on, the payment, and buying the piece from the supplier and shipping it to you.
• The operational processing that lets us conduct our activity and providing a service or benefit to you (Transfer Regulation, Article 2(4)(a) and (b)) — the basis for the delivery network, the team alerts and the Lavin assistant.
• And your consent is the basis for the measurement and advertising processing itself, so none of it is transferred before it, and withdrawing it stops the transfer.

The safeguards: the minimum data for each purpose — which is why the supplier never gets your email, the advertising platforms never get your details in their original form, and Telegram never gets your name. We rely on each of these entities’ contractual data-protection commitments. As at the date of this policy the competent authority has not published the list of countries with an adequate level of protection, so we are working to put SDAIA’s standard contractual clauses in place with those entities that need them, and we hold a written risk assessment for these transfers under Article 8 of the Transfer Regulation. We also verify that a transfer does not impair your ability to exercise your rights or to withdraw your consent.

New-arrivals emails and your basket reminder

We never send you a marketing email without your prior consent, given separately for that purpose alone: when you tick, at checkout, “Email me what’s new at Lavin, and remind me about my basket if I don’t finish my order”, or when you subscribe to our newsletter. It is entirely optional: it is not a condition of completing your order or of any service we provide, and the box is unticked by default. With it we send new arrivals and a reminder about pieces you browsed or added to your basket and did not order.

We send them through Klaviyo, Inc. (United States), sharing your email, your name and the pieces you browsed, added to the basket or bought; the platform infers an approximate location (city and country) from the internet address. We do not share your mobile number, your shipping address or your payment details with it. Every message carries the name “Lavin Fashion” clearly.

You can withdraw your consent at any time from the “unsubscribe” link at the foot of every message — one click, easier than giving it — or by writing to [email protected], and we stop without delay. Messages about the order itself (its confirmation, its shipment and its invoice) reach you to perform the contract and do not depend on this consent.

Cookies and your consent to them

We use strictly necessary cookies to run the store — the basket, signing in, checkout, security and storing your own choice in the consent notice — and these always run and need no consent, because the store does not work without them.

Everything else — analytics and marketing — runs only after you consent. The cookie notice appears on your first visit and nothing from either category loads before you choose, and each category has its own separate consent, so you can accept one and refuse the other. You can change or withdraw your choice at any time from the “Manage my consent” link at the foot of every page or from our cookie policy — as easily as you gave it, and it takes effect at once. Withdrawing does not affect the necessary cookies, nor our processing of your order data required by law, nor the lawfulness of what happened before it.

We also keep proof of your consent, as the Law requires: its time, its means, the categories you accepted, the version number of this policy, and a pseudonymous identifier that does not point to you — we do not store the internet address in that record. We keep it for twenty-four months and then destroy it.

The Lavin automated assistant (Ask Lavin)

The “Ask Lavin” button in the store and in the app is an automated assistant. When you type a question, the text of your question is sent to Anthropic, PBC (United States) to compose the answer — along with the page language, the identifier of the product you are looking at, and whatever is needed from our own pages and products. We do not send your name, email, number, address or order history with it. The text you type is free-form, so please do not type personal or payment details into it — if you do, they are sent as you typed them. Your device identifier is not sent; your internet address is used at our end for a moment to count your usage quota and prevent abuse, and it is not stored with your question.

In the app we ask for your consent once before your first message, and no message is sent without it. The assistant can be wrong, so what binds us is what the product page and our policy pages say, not what the assistant says.

The Lavin mobile app

Everything in this policy applies to the app as it does to the website; these are the differences specific to it:

• Your account, orders, basket and wishlist are handled through our Riyadh server and then stored in our store. “Remember me” and fingerprint or face sign-in are kept on your device alone in its secure store; no biometric data ever reaches us.
• Order notifications: when you enable them the operating system creates a device notification token, which we store with your account or with the order numbers you are following, so we can send you your order update. We pass it to Google (Firebase Cloud Messaging) on Android and to Apple Inc. on iPhone to deliver the notification — outside the Kingdom. Turning “my order updates” off, or deleting your account, removes the token from our side.
• Lavin offers in the app: a separate, optional subscription you choose yourself, and cancel from the same settings.
• App analytics (Firebase Analytics) run only after you consent inside the app, and can be switched off in its settings. We show no advertising in the app and do not track you across apps: no advertising identifier and no tracking request.
• Payment in the app opens your device browser on the gateway’s page, so your card details never pass through the app at all.
• The app reports no crashes to anyone today: no crash-reporting tool is built into it. If we add one, we will update this policy first.

Your review of a piece

When you review a piece you have received — in the app or from the review link in your order email — the text, stars and date of your review are published for everyone with your first name and the first letter of your family name only, and stored with your account or order. A review containing a link, a phone number, an email address or an offensive word is held for us to check before it is published, and any review reported from the app is hidden until we have reviewed it. You can ask us to delete your review at any time at [email protected].

Deleting your Lavin Fashion account

In the app: “My account” ⇒ “Delete account”, then confirm with your password — it is deleted at once. Without the app: email [email protected] from the address on your account with the subject “Delete my account”; we confirm the request is yours and delete it within thirty days at most.

• Deleted: your account and its password, your profile details, addresses and wishlist, and your devices’ notification tokens; your sessions end on every device. Your name and email are removed from your reviews, so their text and stars remain with no owner.
• Kept without your identity: the record of each past order — its number, items, amounts, status and payment reference — once your name, email, mobile and address are stripped from it, because the Commercial Books Law requires us to keep it (above). An order not yet closed is erased when it closes, and at most 180 days after your deletion request.

Retention periods, and how we destroy your data

We destroy your personal data without delay once the purpose of collecting it has ended, except what another law requires us to keep for a set period. These periods are enforced in our store system, not merely written here, and run automatically every day:

• Your completed or refunded order record: ten years, after which your identity is stripped from it (name, email, mobile, address and internet address) and the financial record remains without identity. The basis is that an order’s invoice and correspondence are trade documents, which the Commercial Books Law (Article 8) requires a merchant to keep for at least ten years.
• An order never paid for (pending or failed): thirty days, then deleted — it has no invoice, so there is no reason to keep it.
• An account you have not used for twenty-four months is deleted, together with its password and its wishlist. A past order record is not deleted with it — that has its own period above.
• Proof of your cookie consent: twenty-four months. Your email subscription is kept while it stands, and deleted after you cancel it.
• Your message to us is kept while your enquiry is open and for a year afterwards in case of a complaint, then destroyed. Your sign-up to a new-market waiting list is deleted after the launch message or after twelve months, whichever comes first.
• A matter before a judicial body — the data connected to it is kept until the proceedings are complete, then destroyed.

Destruction means deletion from the store database and from its backups as they rotate, or stripping everything that points to you where we must keep the financial record. When we destroy data at your request we notify those we disclosed it to and ask them to destroy it as well.

Your rights, and how to exercise them

Under the Personal Data Protection Law (Article 4) you have the right to:

• Be informed — of the legal basis for collecting your data and the purpose of collecting it; this page is that notice.
• Access — to see the data we hold about you, and to obtain a copy of it in a clear, readable form and free of charge.
• Correction — to correct, complete or update your data.
• Destruction — of what is no longer needed, or of what rested on your consent alone once you withdraw it. What another law requires us to keep remains for the period stated above.
• Withdrawal of consent — at any time and as easily as you gave it, without affecting the lawfulness of what happened before the withdrawal.

To exercise any of them, write to us at [email protected] from the email registered with us, or on WhatsApp at +966 56 697 6014. We may ask for something confirming that you are the data subject before acting — for your own protection. We carry out your request within thirty days at most, and if it needs unusual effort or you have made several requests we may extend that by a further thirty days, telling you of the extension and its reason beforehand. We document every request we receive, including a spoken one.

The security of your data

We apply organisational, administrative and technical measures to protect your data from unauthorised access, leakage or alteration: encrypted connections to the store and the app; access limited to authorised people only, with two-factor authentication on administrative accounts; encrypted backups; payment handled at the gateway with no card data stored by us; and automated monitoring of the store and its servers. We choose processors that provide the necessary guarantees and we verify their compliance. If a breach affecting your data occurs, we notify the competent authority and notify you as the Law requires.

Children’s data

Our store is aimed at adults. We sell children’s clothing, but we neither ask for nor collect a child’s data: no name, no age and no size tied to a particular child — the order is created in your name and with your details. If we learn that an account was created for a minor without their legal guardian’s consent, we destroy its data.

Updates to this policy

We may update this policy to match the applicable laws and what we actually run; any update is published on this page and takes effect from the date it is published. We will tell you before a change that widens an existing processing purpose or adds a new entity that your data reaches. Version of this policy: 2026-10-21.

Contacting us, and your right to complain

For any question about your privacy or to exercise your rights: [email protected] — we commit to replying within 24 working hours, and to carrying out rights requests within the period stated above. The store is based in Riyadh, Saudi Arabia. If our answer does not satisfy you, you may complain to the Saudi Data and AI Authority (SDAIA) as the authority supervising the Personal Data Protection Law, and you may also turn to the Ministry of Commerce on consumer-rights matters.

Our use of YouTube API Services

We publish short videos of our products on our official YouTube channel, “Lavin Fashion”, using YouTube API Services. By using our website or watching our content on YouTube, you are also subject to the YouTube Terms of Service and the Google Privacy Policy.

Our use of the API is one-way and limited to our own account: we upload our own videos to our channel, read the list of what we have uploaded so that we do not publish the same video twice, and organise our own playlists. We expressly confirm that we:

• Do not collect, store or process any personal data relating to you through the YouTube APIs.
• Do not ask you to sign in with a Google account, and do not access your YouTube account or its data.
• Do not download, re-host or distribute YouTube content.
• The only credential used is the company’s credential for its own channel, and it is stored on our devices with restricted permissions.

Because we do not request any permission on your account, there is nothing for you to revoke on our side. Nevertheless, you can at any time review the apps you have granted permission on your Google account and revoke them from the Google account permissions page. We retain no data derived from the YouTube APIs that relates to individuals; as for our own technical data — the identifiers of the videos we uploaded and their upload times — we keep it in our store to avoid duplication, and it is deleted when the product linked to it is deleted.