Privacy Policy

1. Introduction

CRafT a CaMeL (“the Company”, “we”, “us”, “our”) respects your privacy and is committed to protecting Personal Data. Personal Data refers to all data that can be related to you personally such as your name, address, email addresses and user behaviour. This Privacy Policy explains how we collect, use, disclose, store, transfer, and protect Personal Data when you interact with us, including through our website(s), customer support channels, retail and e-commerce sales, warranty or product registration, events and promotions, and our social media pages (together, the “Services”).

This Privacy Policy is intended to meet requirements under applicable data protection laws, including the Saudi Personal Data Protection Law and its Implementing Regulation, and, where our UAE operations apply, UAE Federal Decree-Law No. 45 of 2021 and its Executive Regulation.

If you do not agree with this Privacy Policy, please do not use the Services.

For the purposes of applicable data protection laws, the Company is the ‘Controller’ (or equivalent) of Personal Data processed under this Policy, unless we state otherwise.

2. Information we collect

We collect Personal Data that you provide to us directly, Personal Data we collect automatically when you use our website, and, in limited cases, Personal Data we receive from third parties.

• Personal information. When you register on the website, we may collect name, email address, phone number, billing and delivery address, and other information you choose to include in forms or user-generated content.
• Sensitive Personal Data. We do not intentionally collect sensitive Personal Data such as health information, biometric data or precise geolocation through the website.
• Account and customer support information. Account identifiers, login or account administration information, your communications with us, and information needed to resolve your request.
• Purchase and transaction information. Items purchased, order value, delivery preferences, payment confirmation details and transaction history. We do not store full payment card details or CVV; payment processing is handled by our payment service providers.
• Promotions, surveys, reviews and user content. Your responses, feedback, and any content you choose to upload or share. Where content is intended for publication, we describe what is public at the point of collection.
• Product registration, warranty and safety information. Proof of purchase, product identifiers such as batch or serial numbers, and information required to address your request. Please do not provide children's names or other identifying details unless specifically requested and necessary.
• The falcon activation journey. When a code from a product card is checked, we record only that the code was seen. If a certificate is made, we store the name given to the falcon against that code. We do not collect the child's name, the child's age, a falconer's name, a photograph or a voice recording anywhere on this website.
• Marketing preferences. Your contact details and communication preferences. You can withdraw consent or opt out at any time.
• Non-personal information. IP address, browser type and version, device type, operating system, approximate location derived from IP address, language settings, pages viewed, time and date of visit, referring webpage, clickstream data and error logs.
• Cookies and similar technologies. Used to operate the website, remember preferences, enable core functions, analyse traffic and, where permitted, deliver marketing and measure advertising effectiveness.
• Information from third parties. Payment and fraud prevention providers, delivery and logistics partners, analytics and marketing partners, and social media platforms where you interact with our official pages.
• Children's Personal Data. Our website and Services are intended for parents, guardians and other adults. We do not knowingly collect Personal Data directly from children without explicit documented parental consent. Where children participate in our events we collect images, audio and video only with the parent's or guardian's explicit consent, and we maintain records of that consent.
• Anonymised and aggregated data. Data sets that can no longer identify you, used for analytics, reporting and business improvement.

3. How we use your information

• To provide the website and services you request — access, accounts where offered, enquiries and customer support.
• To process purchases and fulfil orders — transactions, payment confirmation, delivery, shipping updates, returns, refunds and chargebacks.
• To administer warranties, product registration and product safety — after-sales support and product safety communications, including notices and recalls.
• To issue and re-issue product certificates — confirming that a code is genuine, and producing the certificate for the name given to a falcon.
• To administer promotions, surveys, reviews and events — registering participants, managing logistics, contacting winners, publishing content you submit, and, with parental permission, capturing and using photographs, audio and video from events.
• To personalise and improve the website — remembering preferences, troubleshooting, improving performance and developing new features.
• To send service messages and marketing communications — order confirmations, delivery updates, event logistics and support responses; marketing where permitted and in line with your preferences.
• To support analytics, advertising and measurement — subject to your cookie choices. We do not use children's event media for targeted advertising.
• To maintain security and prevent fraud.
• To comply with legal obligations and defend legal claims.

Nothing from the activation journey trains, fine-tunes or adapts any AI model.

4. Legal bases for processing

• Performance of a contract — providing what you request, processing orders, taking payment, delivering products, handling returns, administering warranties and providing support.
• Consent — marketing communications where opt-in is needed, non-essential cookies, and capturing and using photos, audio and video at events including where children appear. You can withdraw consent at any time; this does not affect processing that already took place.
• Legal obligation — tax, accounting, consumer protection, product safety and recall obligations, and lawful requests from regulators, courts or law enforcement.
• Vital interests and public interest — in limited cases, such as urgent product safety communications or recalls where permitted by law.

5. How we share your information

• With the public and on social media, where you choose or consent — reviews you submit, and event photography, audio and video where a parent or guardian has consented.
• With third-party service providers — e-commerce platform providers, cloud hosting and storage, payment processors, delivery and logistics partners, customer support, analytics, marketing services and content production partners. They process Personal Data on our instructions under confidentiality and security obligations.
• With authorities and for legal reasons — where required by law, court order or lawful request, or to establish, exercise or defend legal claims.
• Corporate transactions — a merger, acquisition, financing, reorganisation or sale of assets, subject to appropriate protections.

The public authenticity check at craftacamel.com/verify reveals no personal data about anyone, for any code.

6. International data transfers

We may transfer Personal Data to recipients and countries outside the Kingdom of Saudi Arabia and the United Arab Emirates — for example cloud hosting, analytics, customer support tools, payment service providers, content production partners and social media platforms that process data internationally.

Transfers are made only in accordance with the applicable law, including where the destination jurisdiction provides an adequate level of protection, or where an approved safeguard or permitted exception applies. We take appropriate contractual, organisational and technical measures to protect Personal Data when it is transferred internationally.

7. Children's privacy

Our Services are intended for parents, guardians and other adults and are not directed to children.

Where our events or promotions involve children, we collect and use children's Personal Data, including images, audio and video, only with the explicit consent of a parent or guardian, and we maintain records of that consent.

A parent or guardian may withdraw consent for future use of a child's event media at any time by contacting us. Withdrawal does not affect processing that already took place.

If we become aware that we have collected a child's Personal Data through the website without verified parental consent, we will take appropriate steps to delete or deidentify it.

8. Data retention

We retain Personal Data only for as long as necessary for the purposes described in this Privacy Policy, including to provide the Services, complete transactions, administer warranties, run events and promotions, comply with legal obligations, maintain business records, and establish, exercise or defend legal claims.

Retention periods vary with the type of data and how it is used. We consider the nature of the data, the purposes of processing, legal and regulatory requirements, product safety considerations including recalls, and limitation periods for potential claims.

When Personal Data is no longer needed we delete, anonymise or securely deidentify it, unless we are required or permitted to retain it under applicable law.

9. Security

We implement appropriate technical and organisational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data — taking into account the nature of the data we process, the risks of processing, and available technology.

Measures include access controls and least-privilege permissions, encryption in transit and at rest where supported, monitoring and logging, secure backups, vendor due diligence and staff training.

No method of transmission over the internet or electronic storage is completely secure. You are responsible for keeping any account credentials confidential.

10. Your rights

Subject to applicable law, you may have the right to:

• Access your Personal Data and obtain information about how we process it.
• Correct inaccurate or incomplete Personal Data.
• Request deletion in certain circumstances.
• Restrict or object to certain processing, including direct marketing.
• Withdraw consent where we rely on it; withdrawal does not affect earlier processing.
• Data portability, where applicable and technically feasible.

To exercise your rights, contact us using the details in “Contact us”. We may need to verify your identity, and where relevant your authority to act on behalf of a child, before responding.

11. Breach response

If we become aware of a personal data breach likely to result in a risk to your rights and interests, we will take appropriate steps to contain, assess and remediate it, including measures to reduce potential harm.

Where required by applicable law, we will notify the competent authority and affected individuals within the required time limits, with information about steps you can take to protect yourself.

12. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technologies, legal requirements or other factors. When we make changes we revise the effective date at the top of the page.

If we make material changes we will take reasonable steps to provide notice through the Services or by other appropriate means.

13. Contact us

Controller
CRafT a CaMeL · رَكِّب جَمَلاً
Riyadh, Diriyah, 13714, Kingdom of Saudi Arabia
CR / Unified No. 7048943406 · VAT 312864000900003

Group company
NMA Trading LLC · Dubai, Emirates Towers, Level 41, United Arab Emirates

Email · salam@craftacamel.com