Privacy Policy

Welcome to Twinkle! This Privacy Policy explains how Wamdat Company Ltd (commercial registration number 1010813185), trading as “Twinkle” (“we”, “our”, or “us”), collects, uses, discloses, stores, and protects your personal data when you access or use the Twinkle website at mytwinkle.com and any associated mobile applications or platforms (collectively, the “Platform”).

This Privacy Policy should be read together with our Terms and Conditions of Use. By accessing or using the Platform, you acknowledge that you have read, understood, and agree to the collection and processing of your personal data as described in this Privacy Policy. If you do not agree with any part of this Privacy Policy, please do not use the Platform.

We are committed to protecting your privacy in compliance with the Saudi Personal Data Protection Law (PDPL) (Royal Decree No. M/19 of 2021, as amended) and its Implementing Regulations, as well as all other applicable data protection and privacy laws in the Kingdom of Saudi Arabia.

1. DATA CONTROLLER

For the purposes of applicable data protection laws, Wamdat Company Ltd is the data controller responsible for your personal data collected through the Platform. This means we determine the purposes and means of processing your personal data.

If you have any questions about how we handle your personal data, you may contact us at: support@mytwinkle.com

2. PERSONAL DATA WE COLLECT

We collect different categories of personal data depending on how you interact with the Platform. Below is a summary of the types of data we collect:

2.1 Data You Provide Directly

When you create an account, place an order, contact our customer service team, or otherwise interact with us, we may collect:

• Identity Data: First name, last name, date of birth, and gender.
• Contact Data: Email address, phone number (including WhatsApp number), delivery address, and billing address.
• Order and Customisation Data: Product selections, personalisation details (such as names, text, themes, and event dates), delivery preferences, and special instructions.
• Financial Data: Payment card details, billing information, and transaction records. Note: Full payment card details are processed by our third-party payment providers and are not stored on our servers.
• Communications Data: Records of your communications with us, including customer service enquiries, reviews, feedback, and complaints.

2.2 Data Collected Automatically

When you access or use the Platform, we may automatically collect:

• Technical Data: Internet Protocol (IP) address, browser type and version, operating system, device type and identifiers, screen resolution, and language settings.
• Usage Data: Information about how you use the Platform, including pages visited, products viewed, click patterns, search queries, time spent on pages, referral sources, and navigation paths.
• Location Data: Approximate geographic location derived from your IP address. We will only collect precise location data (e.g., GPS) with your explicit consent.

2.3 Data from Third Parties

We may receive personal data about you from third parties, including payment processors (transaction confirmation data), delivery service providers (delivery status information), and social media platforms (if you choose to link your account or interact with us through social media).

2.4 Sensitive Personal Data

We do not intentionally collect or process sensitive personal data (also known as “special categories” of data), such as data revealing racial or ethnic origin, religious or philosophical beliefs, health information, biometric data, or criminal records. If we ever need to process such data, we will obtain your explicit consent beforehand in accordance with the PDPL.

3. HOW WE USE YOUR PERSONAL DATA

We process your personal data only where we have a lawful basis to do so under the PDPL. The table below summarises the purposes for which we use your data and the corresponding legal basis:

4. COOKIES AND SIMILAR TECHNOLOGIES

The Platform uses cookies, pixel tags, web beacons, and similar technologies to enhance your experience, analyse usage patterns, and deliver targeted content. Cookies are small text files stored on your device when you visit the Platform.

4.1 Types of Cookies We Use

• Essential Cookies: Necessary for the Platform to function properly, including maintaining your session, processing orders, and ensuring security. These cannot be disabled.
• Analytics Cookies: Help us understand how visitors interact with the Platform by collecting information such as pages visited, time spent, and navigation paths. This data is aggregated and anonymised.
• Functional Cookies: Remember your preferences (e.g., language, region) to provide a more personalised experience.
• Marketing Cookies: Used to deliver advertisements relevant to your interests and to measure the effectiveness of our advertising campaigns. These may be set by third-party advertising partners.

4.2 Managing Cookies

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For more information about cookies and how to manage them, please refer to your browser’s help documentation.

5. SHARING YOUR PERSONAL DATA

We do not sell or rent your personal data to third parties for their marketing purposes. We may share your personal data with the following categories of recipients, solely for the purposes described in this Privacy Policy:

5.1 Service Providers

We engage trusted third-party service providers to perform functions on our behalf, including payment processing, order delivery and logistics, customer service support, cloud hosting and data storage, marketing and analytics services, and IT and cybersecurity services. These providers are contractually obligated to process your data only as instructed by us and in accordance with applicable data protection laws.

5.2 Payment Processors

Online payments are processed by third-party payment gateway providers who adhere to the Payment Card Industry Data Security Standard (PCI-DSS). Your payment card information is provided directly to these processors and is not stored on our servers. Their use of your data is governed by their own privacy policies.

5.3 Delivery Partners

To fulfil your orders, we share relevant personal data (such as your name, delivery address, and phone number) with our delivery and logistics partners.

5.4 Legal and Regulatory Disclosures

We may disclose your personal data where required to do so by law, regulation, legal process, or governmental request, including requests from Saudi authorities. We may also disclose your data where necessary to enforce our Terms and Conditions, protect the rights, property, or safety of Twinkle, our customers, or others, prevent fraud or other illegal activities, or respond to a court order, subpoena, or similar legal instrument.

5.5 Business Transfers

In the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, your personal data may be transferred to the acquiring entity. We will notify you of any such transfer and any changes to the processing of your personal data.

6. DATA SECURITY

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest using industry-standard protocols, secure server infrastructure with restricted access controls, regular security assessments and vulnerability testing, employee training on data protection and confidentiality, and incident response procedures for data breaches.

While we strive to use commercially reasonable measures to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee the absolute security of your data and encourage you to take steps to protect your account credentials and personal information.

7. DATA RETENTION

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, as described in this Privacy Policy. When determining the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your data and whether we can achieve those purposes through other means, and applicable legal, regulatory, and contractual requirements.

As a general guide:

• Account data is retained for the duration of your account and for a reasonable period thereafter to comply with legal obligations.
• Transaction and order data is retained for a minimum of ten (10) years in accordance with Saudi commercial and tax regulations.
• Marketing data is retained until you withdraw your consent or opt out of marketing communications.
• Technical and usage data is typically retained in an anonymised or aggregated form for analytics purposes.

When personal data is no longer required, we will securely delete or anonymise it in accordance with our data retention procedures.

8. YOUR RIGHTS UNDER THE PDPL

Under the Saudi Personal Data Protection Law, you have the following rights in relation to your personal data:

• Right to be Informed: You have the right to be informed about the collection and processing of your personal data, including the purposes, legal basis, and recipients of your data.
• Right of Access: You have the right to request access to the personal data we hold about you and to receive a copy of such data.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure: You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw your consent (and no other legal basis applies).
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest its accuracy or object to its processing.
• Right to Data Portability: You have the right to request a copy of your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to the processing of your personal data where we rely on legitimate interests as the legal basis, or where your data is processed for direct marketing purposes.
• Right to Withdraw Consent: Where we rely on your consent to process personal data, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us at hello@mytwinkle.com. We will respond to your request within thirty (30) days of receipt. We may request additional information to verify your identity before processing your request.

9. INTERNATIONAL DATA TRANSFERS

Your personal data may be transferred to, stored in, or processed in countries outside the Kingdom of Saudi Arabia where our service providers operate. In such cases, we will ensure that appropriate safeguards are in place to protect your data in accordance with the PDPL, including obtaining approval from the Saudi Data and Artificial Intelligence Authority (SDAIA) where required, ensuring that the receiving country provides an adequate level of data protection, or implementing appropriate contractual protections with the data recipient.

10. CHILDREN’S PRIVACY

The Platform is not directed at individuals under the age of eighteen (18). We do not knowingly collect personal data from children under 18 without parental or guardian consent. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately at hello@mytwinkle.com, and we will take steps to delete such data from our systems.

Where a minor’s data is processed with parental consent, the parent or guardian is responsible for providing accurate information and overseeing the minor’s use of the Platform.

11. THIRD-PARTY LINKS AND SERVICES

The Platform may contain links to third-party websites, applications, or services that are not operated or controlled by Twinkle. This Privacy Policy does not apply to such third-party services. We encourage you to review the privacy policies of any third-party services before providing your personal data. Twinkle is not responsible for the privacy practices or content of any third-party websites or services.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable laws, or for other operational, legal, or regulatory reasons. When we make material changes, we will update the “Last updated” date at the top of this Privacy Policy and, where appropriate, notify you by email or through a prominent notice on the Platform.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of such changes.

13. COMPLAINTS

If you have any concerns or complaints about how we handle your personal data, we encourage you to contact us first at hello@mytwinkle.com. We will endeavour to respond to all complaints within seven (7) business days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Saudi Data and Artificial Intelligence Authority (SDAIA) or any other competent regulatory authority in the Kingdom of Saudi Arabia.

14. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

Wamdat Company Ltd

Trading as: Twinkle
Commercial Registration No.: 1010813185
Website: mytwinkle.com
Email: hello@mytwinkle.com