Privacy Policy

1. Controller and contact Stock Arabia · 11245 operates Stock Arabia and is responsible for the personal data it determines how to use. Registered address: Warehouse # 4, 13th St. Al Khabaisi, Deira, Dubai. Privacy contact: info@stockarabia.com. This notice covers applicants, client business contacts, authorized users and information received to operate fulfilment services.

2. Information we process We process application and business-contact details, account/security information, submitted verification documents, store-connection credentials, order recipient names/addresses/telephone numbers, delivery and return events, inventory and financial records, support messages and technical/audit records. Do not submit unnecessary sensitive information. Credentials and private financial evidence require restricted access.

3. Purposes and legal grounds We use data to assess applications, establish and perform service agreements, connect stores, fulfil orders, communicate with clients and couriers, reconcile charges/COD/payouts, prevent misuse and meet applicable legal obligations. We identify the applicable basis for each activity under the UAE Personal Data Protection Law where it applies, including required consent or a permitted exception such as contractual necessity or legal obligations. We do not assume an unrestricted legitimate-interest exception. Acceptance of this notice is not consent to unrelated marketing. Optional marketing requires a separate choice. We do not sell personal data for third-party marketing.

4. Recipients and processing roles Necessary information may be shared with authorized staff, warehouse/logistics providers, couriers and riders, connected commerce platforms, payment/banking providers, hosting/email/security suppliers and professional advisers. We may disclose information where legally required. Our actual supplier categories and locations are: Malaysia. We do not give one client access to another client's records. Where we process order data on your instructions, the service/data-processing agreement defines our roles and instructions.

5. International processing Clients may operate outside the UAE. Remote access and suppliers may involve international transfers. We assess applicable restrictions and use the required contractual, organizational or other safeguards before transferring data. Relevant countries and safeguards: United Arab Emirates. Do not assume all data is stored in the UAE merely because fulfilment occurs there.

6. Retention We retain information only for documented service, security and legal purposes, then delete or anonymize it subject to disputes, legal holds and backup cycles. Our approved retention schedule is: 6 Months. Account closure does not immediately delete invoices, audit evidence or other records we are required to preserve.

7. Security and incidents We use access restrictions, account verification, encryption for protected secrets and audit controls. No system is risk-free. Report suspected access or data incidents to our privacy contact. We assess incidents and notify affected parties or authorities when required by applicable law.

8. Your choices and rights Subject to applicable law, you may request information about processing and recipients, access, correction, erasure, restriction, transfer of your data, or object to qualifying processing, including relevant automated decisions. You may withdraw consent where processing relies on it without invalidating earlier lawful processing. Contact us with sufficient information to verify your request; legal retention requirements and lawful exceptions may apply. Order recipients may also contact the seller who provided their details. We will respond within the applicable legal timeframe and explain any lawful refusal. You may complain to the competent data-protection authority. We do not make a final onboarding rejection solely through automated processing without an available human review.

9. Cookies and website use The portal uses essential session and security cookies to maintain sign-in and protect requests. Published branding and pages can be viewed without a client account. Any future non-essential analytics or advertising cookies require an updated notice and the appropriate choice mechanism before activation.

10. Updates The effective date and published revision identify this notice. We will make material changes visible and provide additional notice where required. Registration records retain the policy version acknowledged at submission; changes do not rewrite previous acknowledgements.