Privacy Policy | ARVUREL

Last updated: 22 October 2026

This policy explains how ARVUREL processes the personal data of visitors to its store, people who contact it and its customers. The provisions relating to purchases, accounts and commercial communications apply to the services actually offered and used.

1. Who is responsible for your data?

The data controller is RALIA SOLUTIONS FOR MARKETING OPERATIONS — établissement individuel (sole proprietorship), operating the ARVUREL store and holding Abu Dhabi economic licence CN-6680708.

Business address:
Baniyas Tower, Al Falah Street – Saeed bin Ahmed Al Otaiba
Abu Dhabi, United Arab Emirates

Contact for your data and requests: sav@arvurel.com
Business telephone: +971 52 358 2268

2. What data is concerned?

The data processed depends on your interactions with ARVUREL:

Contact and identification: surname, first name, email address, telephone number and information you choose to include in a request.
Orders and delivery: items, variants, quantities, prices, order number, recipient contact details, delivery and billing addresses, parcel tracking, returns, refunds and exchanges with after-sales service.
Payment: payment method and status, transaction references, amount and information necessary for a refund or to deal with an incident. Payment data entered during checkout is processed by the payment services concerned. Do not send a full card number, card security code or password by email.
Account and preferences: information associated with an account used for the store, language or country choices, subscriptions and privacy choices.
Browsing and security: IP address, browser and device information, pages viewed, interactions with the store, technical identifiers and logs necessary for operation or security. Processing based on trackers also depends on the choices and rules described in our cookie policy Manage cookies.
Supporting documents: information strictly useful for handling a complaint, a return or a request relating to personal data. Avoid including sensitive information or information about third parties that is not necessary for your request.

This information comes from you, your interactions with the store and, depending on the service used, payment services, logistics partners and delivery or returns providers. For example, a carrier may inform us of the status of a delivery.

Providing the corresponding service depends on receiving the information necessary to respond to a request, take payment or make a delivery. Without it, we may be unable to respond, process the order or deliver it. A subscription to commercial communications and acceptance of optional trackers are not necessary to make a purchase.

3. Why do we use this data and on what basis?

Responding to a pre-purchase enquiry: examining your request and providing information about a product or order, on the basis of pre-contractual steps taken at your request. For other enquiries, our legitimate interest is to provide a useful contact service and follow up on exchanges.
Fulfilling an order: recording purchases, processing payment, organising supply and delivery, providing tracking information and managing returns or refunds. The basis is performance of the contract and, for guarantees or obligations imposed by regulations, compliance with applicable legal obligations.
Providing the requested account service: enabling access to information and features associated with the account, on the basis of performing that service.
Securing the store and preventing abuse: protecting accounts and transactions, diagnosing incidents and investigating fraudulent use. Our legitimate interest is to protect the store, its customers and the operations carried out. The data used must remain proportionate to this objective.
Keeping records necessary for the business: handling invoicing, accounting and tax obligations or responding to a legally mandatory request. The basis is a legal obligation where it arises under European Union or Member State law applicable to the processing. An obligation arising from a third country does not, on its own, constitute such a basis under the GDPR; the corresponding processing must have an appropriate basis, including the legitimate interest in managing and substantiating the business activity where applicable.
Handling complaints and defending rights: retaining and examining the information necessary to resolve a dispute and to exercise or defend rights. The basis is our legitimate interest in establishing the facts and protecting our rights, or a legal obligation where it applies.
Sending news or offers: using your contact details when you have agreed to receive these communications. An exception for similar products may apply to an existing customer if the legal conditions are met and a simple opt-out is offered at collection and in every subsequent message. Communications strictly necessary for an order remain separate from promotional messages.
Measuring audience, personalising or advertising: these uses depend on the tools actually enabled. Where trackers or targeted advertising require your consent, it must be obtained before the processing concerned. Making a purchase or merely reading this policy does not constitute consent.
Handling your choices and rights requests: recording relevant choices, responding to requests and retaining the necessary evidence of how they were handled, in order to comply with our data protection obligations.

4. Who may receive your data?

Data useful for an operation may be accessible to the operator of ARVUREL and the following parties, depending on their role:

Cloudflare: hosting and operation of the store, technical processing of orders and of the features used. Cloudflare may use its own service providers.
Payment services: Stripe, when online payment is enabled: processing of the chosen payment method, security checks and refunds. The service concerned depends on the options presented at payment.
Order management provider, logistics partners and carriers: they receive only the data necessary for preparation, shipping and, where applicable, returns.
Returns: when a return is sent to the return address provided by ARVUREL, the information necessary to receive and identify the parcel may be shared with the logistics partner receiving it, including the order reference, the customer’s identity and the details needed to process the return. ARVUREL remains your point of contact for following up on your request.
Email and communications: Google (Gmail) for professional email and for sending and receiving customer-service and order emails, depending on the features actually used and your choices.
Professional advisers and authorities: where necessary for an applicable obligation, an inspection, a complaint or the defence of rights, and within the limits justified by that purpose.

A recipient's role may vary: some act on our behalf, while others, including certain payment services, determine their own processing. You can ask us for more information about the recipients concerned by your order or request.

5. Hosting and technical services

Cloudflare provides the store’s hosting infrastructure. It processes technical data (for example the IP address and connection logs) needed for the operation and security of the site; see its privacy policy.

Stripe, when online payment is enabled, processes the payment information entered on its payment pages, according to its role described in its privacy policy. Gmail (Google) is used to send and receive customer-service and order emails (Google privacy policy).

For the processing for which ARVUREL is responsible, and to exercise your rights, you can write to us at sav@arvurel.com.

6. Where may data be processed?

The operator of ARVUREL is established in the United Arab Emirates. Data may be accessed there to manage the store and customer service. The services used may also involve processing in other countries, inside or outside the European Economic Area. Processing is therefore not intended to take place exclusively in Europe.

The providers describe their transfer mechanisms in their own policies (links above). Some providers, including the order management provider, may process data outside the European Union, notably in the United States. Delivery routes may also involve the country from which the items are shipped, including outside the European Union.

For transfers subject to the GDPR, a mechanism compliant with Chapter V and, where necessary, supplementary measures are required. Merely using the site does not constitute general consent to international transfers. To learn about the countries, recipients and safeguards applicable to an operation involving you, or to request a copy of the safeguards that can be provided, write to sav@arvurel.com.

7. For how long?

Retention depends on the purpose and applicable obligations, according to the following criteria:

Contact requests: for the time needed to respond and follow up on the request. Information that is no longer useful must be deleted; an exchange relating to an order or dispute follows the corresponding criteria below.
Orders, delivery, returns and guarantees: while they are being fulfilled and for the necessary follow-up of the customer's rights. Afterwards, only records useful for a retention obligation or a dispute are retained for that purpose.
Invoices and supporting documents: for the period required by the accounting or tax regulations applicable to the record concerned, followed by deletion when that obligation expires, unless there is another lawful reason for retention.
Customer account: while the account service is provided. Closing it does not automatically delete order records necessary for an obligation or the defence of rights.
Commercial communications: during the subscription or relationship that legally permits these communications, taking account of your activity and choices. Withdrawal of consent or an objection ends the messages concerned. A minimal record may be retained to prevent further contact contrary to your choice.
Security and incidents: for the period necessary to detect, analyse and handle the incident. If a dispute results, only relevant evidence may be retained according to the applicable limitation periods and procedural time limits.
Rights requests and evidence of choices: for the time needed to handle the request and then substantiate the response or choice during the period in which this evidence is necessary.
Cookies and measurement data: depending on the tracker's function, its lifetime, the settings of the service concerned and, where applicable, your withdrawal of consent. The expiry of a cookie and the retention of information already collected are two separate matters.

Retention as evidence or to meet a legal obligation does not authorise reuse of the data for direct marketing. You can ask for the criteria and periods applicable to your data by contacting us.

8. Your rights and how to exercise them

Under the conditions laid down by the GDPR, you can request access to, rectification or erasure of your data, or restriction of its processing. You also have a right to data portability for automated processing based on consent or a contract, and a right to object to processing based on legitimate interests in light of your situation. You can object to direct marketing at any time.

You can withdraw consent without affecting lawful processing already carried out. Where a solely automated decision produces legal or similarly significant effects, the safeguards provided by the GDPR apply, including the right to contest the decision and, in the cases provided for, obtain human intervention.

Write to sav@arvurel.com, specifying your request and the details needed to locate your data. In the event of reasonable doubt, limited information to verify your identity may be requested. The normal response period is one month; any legally permitted extension must be explained within that period.

You can contact the competent supervisory authority, including the CNIL in France, without first having to contact us.

9. Security, minors and external links

No digital service can guarantee absolute security. Keep your access details confidential, use the designated payment processes and limit the data included in your messages. Report any irregularity to our contact address.

The store is intended for an adult audience. If a minor has sent us data without appropriate authorisation, their legal representative can contact us so that the situation can be examined and the data deleted where required.

If you follow a link to an external service or use a service with its own account, its processing is also described in its privacy policy.

10. Changes to this policy

This policy may be updated to reflect changes to the services or applicable rules. The date at the top of the page identifies the version. Additional information and, where necessary, renewed consent must accompany changes that warrant them.