Dinaar & Dirham is committed to protecting your personal data. This policy explains how we collect, use, store and share information about you when you visit our website, place an order, or interact with our brand — and the rights you hold in respect of that data.
Who We Are
Dinaar & Dirham (Company No. 01234567) is registered in England and Wales with its registered office at 12 Clerkenwell Road, London, EC1M 5PA. We are the data controller for all personal data described in this policy.
Our website dinaardirham.com and all its subdomains are operated by Dinaar & Dirham. We are registered with the Information Commissioner's Office (Registration No. Z1234567) and comply fully with the UK GDPR and the Data Protection Act 2018.
Data We Collect
Information you provide directly
- Name, email address, and phone number when placing an order or creating an account
- Delivery and billing addresses
- Payment details — processed by Stripe; we never store full card numbers
- Company name, VAT number, and PO details for corporate orders
- Messages sent via email, contact forms, or customer service channels
- Reviews, survey responses, and voluntary feedback
Information collected automatically
- IP address, browser type, operating system, and device identifiers
- Pages visited, time on site, referring URLs, and click data
- Order history and on-site browsing behaviour
Payment Security: All card payments are processed by Stripe, Inc. (PCI-DSS Level 1). Dinaar & Dirham never has access to your full card number, CVV, or PIN.
How We Use Your Data
| Purpose | Legal Basis | Details |
|---|---|---|
| Process & fulfil orders | Contract performance | Confirmation, dispatch, delivery, invoicing |
| Account management | Contract performance | Order history, saved addresses, preferences |
| Customer service | Legitimate interest | Returns, queries, complaints |
| Marketing emails | Consent | Newsletter, new arrivals — opt-in only |
| Website improvement | Legitimate interest | Analytics, A/B testing, UX research |
| Fraud prevention | Legal obligation / legitimate interest | Order verification, suspicious activity |
| Legal compliance | Legal obligation | Tax records, HMRC reporting |
Legal Basis for Processing
Under UK GDPR Article 6, we rely on:
- Contract (Art. 6(1)(b)): Processing necessary to fulfil your order or service agreement
- Legal Obligation (Art. 6(1)(c)): Processing required by law, such as HMRC tax records
- Legitimate Interests (Art. 6(1)(f)): Fraud prevention, service improvement, and marketing to existing customers
- Consent (Art. 6(1)(a)): Email marketing, analytics cookies, and optional personalisation features
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
Sharing Your Data
We do not sell or rent your personal data. We share it only with processors bound by UK GDPR-compliant data processing agreements:
| Recipient | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing | USA (adequacy decision) |
| Royal Mail / DPD | Delivery & tracking | United Kingdom |
| Mailchimp (Intuit) | Email marketing | USA (SCCs) |
| Google Analytics | Website analytics | USA (SCCs) |
| Zendesk | Customer support | USA (SCCs) |
| HMRC | Tax compliance | United Kingdom |
Data Retention
| Data Type | Retention Period |
|---|---|
| Order & transaction records | 7 years (HMRC requirement) |
| Customer account data | Account lifetime + 2 years after last activity |
| Marketing consent records | Until consent withdrawn |
| Website analytics | 26 months |
| Customer service correspondence | 3 years |
| Fraud prevention records | 5 years |
Your Rights Under UK GDPR
- Access (Art. 15): Request a copy of the personal data we hold about you
- Rectification (Art. 16): Ask us to correct inaccurate or incomplete data
- Erasure (Art. 17): Request deletion where no lawful basis for retention exists
- Restriction (Art. 18): Ask us to limit how we process your data
- Portability (Art. 20): Receive your data in a structured, machine-readable format
- Objection (Art. 21): Object to processing based on legitimate interests or for direct marketing
- Automated decisions (Art. 22): Not be subject to decisions made solely by automated processing
To exercise any right, email dpo@dinaardirham.com or write to our registered address. We respond within 30 calendar days. You may complain to the ICO at ico.org.uk or on 0303 123 1113.
Security
We implement appropriate technical and organisational safeguards including:
- TLS 1.3 encryption for all data in transit (HTTPS site-wide)
- 256-bit AES encryption for stored sensitive data
- Role-based access controls limiting staff access to personal data
- Regular security audits and penetration testing
- Mandatory two-factor authentication on all administrative systems
In the event of a breach likely to risk your rights, we will notify the ICO within 72 hours and inform affected individuals without undue delay.
Cookies
We use cookies and similar technologies to maintain sessions, measure performance, and support optional marketing. You can manage your cookie preferences at any time via the "Cookie Settings" link in our footer.
For a full list of cookies, their purposes, durations, and controls, please see our Cookie Policy.
Children's Privacy
Our website is not directed at children under 16. We do not knowingly collect personal data from minors. If you believe we have done so inadvertently, contact dpo@dinaardirham.com immediately and we will delete it promptly.
Changes to This Policy
We may update this policy periodically. When we make material changes, we will update the "last updated" date and notify registered account holders by email. Continued use of our website following any changes constitutes acceptance of the revised policy.
Contact Our Data Protection Officer
For any privacy query or to exercise a data subject right, please contact our DPO:
Lena Kurosawa
Dinaar & Dirham
12 Clerkenwell Road
London, EC1M 5PA
dpo@dinaardirham.com
+44 20 7946 0320
Mon–Fri, 9am–5pm GMT
No. Z1234567
ico.org.uk
0303 123 1113
We respond to all data subject requests within 30 calendar days of receipt.