Privacy Policy

1. Who We Are

This Privacy Policy is issued by Crystal Arc Factory LLC (“Crystal Arc,” “we,” “us,” or “our”), a manufacturer of custom trophies, awards, corporate gifts, and luxury packaging headquartered in Dubai, United Arab Emirates, with additional offices in Abu Dhabi, UAE and Riyadh, Saudi Arabia. This Policy explains how we collect, use, disclose, and safeguard information when you visit crystalarc.net (the “Site”), contact us by WhatsApp, email, or phone, or engage us to design and manufacture a commissioned piece.

We process personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”) and, where applicable to customers located outside the UAE, the data protection principles generally expected under GDPR (EU/UK) and equivalent frameworks.

2. Information We Collect

We collect the following categories of information:

• Contact and enquiry data, name, company name, email address, phone/WhatsApp number, and any details you submit through our enquiry forms, brochure downloads, or direct messages.
• Order and commission data, project briefs, design references, engraving text, logos/artwork you supply, delivery addresses, and billing details required to quote, produce, and ship your piece.
• Communications, records of correspondence via email, WhatsApp, and phone, kept to service your enquiry or order and to resolve any dispute.
• Website usage data, IP address, browser type, device information, pages visited, and referral source, collected automatically via standard web server logs and analytics/functional cookies (see Section 5).
• Payment-related data, where deposits or balances are paid online, our payment processor handles card details directly; we retain only transaction references and amounts, not full card numbers.

3. How We Use Your Information

• To respond to enquiries and prepare quotations or proposals.
• To design, manufacture, personalise, invoice, and deliver commissioned pieces.
• To communicate order status, production timelines, and delivery updates.
• To maintain business records for accounting, warranty, and legal compliance purposes.
• To improve our Site, catalogue, and customer experience.
• To send you updates about Crystal Arc where you have opted in, and which you may unsubscribe from at any time.
• To detect, investigate, and prevent fraud, misuse, or security incidents.
• To measure which of our advertisements lead to enquiries and orders, and to improve how we advertise.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

4. Legal Basis for Processing

We process your data on the basis of: (a) performance of a contract, where you have requested a quote or placed an order; (b) legitimate business interests, such as improving our services and preventing fraud; (c) consent, where you have opted in to marketing communications; and (d) compliance with legal obligations, such as tax and accounting record-keeping requirements under UAE law.

5. Cookies and Similar Technologies

Our Site uses cookies and similar technologies to remember your preferences, understand how visitors use the Site, and measure the effectiveness of our content and advertising.

• Essential/functional cookies, required for the Site to operate correctly (e.g. remembering that you have viewed our WhatsApp widget).
• Analytics cookies (Google Analytics), which help us understand aggregate visitor behaviour so we can improve the Site.
• Session analytics tools (Microsoft Clarity and Contentsquare), which record how visitors scroll, click and move through pages so we can find and fix usability problems. They do not capture what you type into forms.
• Advertising cookies (Google Ads), which tell us when a visit or an enquiry came from one of our ads, and may be used to show our ads to people who have visited the Site.

You can disable cookies through your browser settings at any time; doing so may affect some Site functionality. You can control personalised Google ads at adssettings.google.com.

6. Sharing and Disclosure

We share information only where necessary, including with:

• Logistics and shipping partners, to deliver your order.
• Payment processors, to process deposits and balances securely.
• Professional advisors (accountants, auditors, legal counsel), where required.
• Government or regulatory authorities, where required by UAE law or a valid legal process.
• Successor entities, in the event of a merger, acquisition, or sale of business assets, subject to equivalent confidentiality protections.
• Advertising platforms (Google), in securely hashed (encrypted, one-way) form, to measure which advertisements led to an enquiry or order, as described in Section 14.

7. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, including any statutory retention period required for accounting, tax, or warranty purposes under UAE law (generally up to 5 years from the end of the relevant financial year, or longer where a legal claim is reasonably anticipated). Design files and artwork you supply for a commission are retained for our production records unless you request deletion in writing.

8. Data Security

We apply reasonable administrative, technical, and physical safeguards to protect personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage is 100% secure, and while we work to protect your data, we cannot guarantee absolute security.

9. Your Rights

Subject to applicable law, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to our legal retention obligations.
• Object to or restrict certain processing, including direct marketing.
• Withdraw consent at any time where processing is based on consent.
• Request a copy of your data in a portable format, where technically feasible.
• Ask us not to use your contact details for advertising measurement or audience lists (see Section 14).

To exercise any of these rights, contact us at info@crystalarc.net. We will respond within a reasonable time and in line with applicable legal timeframes.

10. International Data Transfers

As we serve clients across the UAE, GCC, and internationally, your data may be processed in countries other than your own, including the United Arab Emirates. Where we transfer data internationally, we take steps to ensure it remains protected consistent with this Policy and applicable law.

11. Children's Privacy

Our Site and services are directed at businesses and adults. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Third-Party Services, Platforms & AI Tools

In operating our business and this Site, we use a range of third-party platforms, applications, and AI-assisted tools, which may include (without limitation) Google (e.g. Workspace, Analytics, advertising), Meta/Facebook (e.g. business messaging, advertising), WhatsApp, and AI assistants such as OpenAI's ChatGPT and Anthropic's Claude, among others. We use these tools for purposes such as website analytics, communications, marketing, scheduling, drafting, design assistance, and general administrative work.

The specific tools and providers we use may change from time to time as our business and technology needs evolve, without a corresponding update to this Policy for each individual tool. Where information you provide to us is processed through one of these third-party platforms, that processing is also governed by that provider's own privacy policy and terms of service, which operate independently of this Policy and which we encourage you to review. We select reputable providers and take reasonable care in how we use them, but we do not control, and are not responsible for, the independent data handling practices, security, or retention policies of these third parties.

Our Site may also link to third-party platforms (e.g. WhatsApp, social media). We are not responsible for the privacy practices of those third parties; please review their own policies.

Data we receive from Google APIs is handled as described in Section 13 and is not processed through general-purpose AI tools or used to train any AI or machine-learning model.

13. Google API Services

Crystal Arc uses an internal tool that connects to the Google Ads API through Google OAuth. It is used only by Crystal Arc staff to manage, monitor and report on Crystal Arc's own Google Ads accounts.

• Data accessed: Google Ads account and campaign data (campaigns, ad groups, ads, keywords, budgets, search terms and performance metrics) for accounts the signed-in user has authorised.
• Purpose: only to view, manage and report on Crystal Arc's own advertising. It is not used to serve ads to anyone, build profiles, or for any other purpose.
• Storage: OAuth tokens are stored securely on Crystal Arc's systems. Campaign data is used when a request is made and is not sold or shared with third parties. A log records changes made through the tool.
• AI tools: Google user data is not transferred to, or used to train, any generalised AI or machine-learning model.
• Limited Use: Crystal Arc's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Revoking access: you can revoke the tool's access at any time at myaccount.google.com/permissions, or email info@crystalarc.net to have any stored Google-sourced data deleted.

14. Advertising Measurement

To understand which advertisements lead to real enquiries and orders, we may:

• record an advertising click identifier when you arrive on the Site from one of our ads;
• include a short reference code in the WhatsApp message the Site prepares for you, so we can tell which ad led to your enquiry;
• share the email address or phone number from your enquiry, and the value of a confirmed order, with Google in securely hashed (encrypted, one-way) form, so Google can match it to the ad you clicked;
• use hashed contact details of existing clients to create audience lists, for example to avoid showing ads to existing clients or to reach similar businesses.

Hashed data cannot be read by Google as your actual email or phone number, and Google uses it only to measure and deliver our advertising under its own policies. You can ask us at any time not to use your details in this way by emailing info@crystalarc.net.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page indicates the most recent revision. Material changes will be indicated on this page.

16. Contact Us

For any questions about this Privacy Policy or how we handle your data, contact:

Crystal Arc Factory LLC
Dubai, United Arab Emirates
Email: info@crystalarc.net
Phone: +971 4 347 9191  ·  WhatsApp: +971 56 536 4384