Privacy policy

Effective date: 22 May 2026
Last updated: 22 May 2026

This Privacy Policy explains how Aiwa Chocolate and Flowers LLC ("Aiwa Flowers", "we", "us") collects, uses, shares, and protects personal data when you visit aiwaflowers.ae or interact with our services. We operate from Dubai, United Arab Emirates, and comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("PDPL") and its Executive Regulations.

1. Who we are

Aiwa Chocolate and Flowers LLC is a mainland LLC registered in Dubai, UAE (Al Quoz 3). Our online store is hosted by Shopify, Inc. We are the controller of the personal data you share with us; our service providers (listed below) are processors acting on our instructions.

For any privacy question, request, or complaint, contact us at ops@aiwabox.com.

2. What we collect

When you visit our site, place an order, or contact us, we may collect:

  • Contact details: name, phone number, email, billing and delivery addresses.
  • Recipient details: name, phone, address, and any card message you provide for the person receiving the gift.
  • Payment information: card or wallet details processed by Shopify Payments / Tabby / Apple Pay — we do not store full card numbers.
  • Order history: items purchased, dates, amounts, delivery preferences, gift options.
  • Device & usage data: IP address, browser type, language, referring page, pages viewed, click-stream, and approximate location derived from IP.
  • Identifiers used for advertising: cookies, device IDs, hashed email or phone (see Sections 5 and 6).
  • Communications: the content of WhatsApp, email, phone, and chat messages you send to us, plus our replies, for customer-service and quality purposes.

3. How we use your data

We process personal data for the following purposes and legal bases under PDPL:

  • Processing orders (performance of a contract): name, address, payment, and recipient details to fulfil and deliver your order.
  • Customer support (legitimate interest / consent): handling enquiries, complaints, and follow-up.
  • Analytics and site improvement (consent via cookie banner): understanding which pages, products, and features customers use, to improve the experience.
  • Advertising and remarketing (consent via cookie banner): showing relevant ads on Google, Meta (Facebook / Instagram / WhatsApp), and other platforms, and measuring the performance of those ads.
  • Fraud prevention and security (legitimate interest / legal obligation): detecting and preventing fraudulent transactions and abuse.
  • Legal compliance (legal obligation): tax records, VAT, accounting, dispute resolution.

We do not use your personal data for automated decision-making that produces legal effects on you, and we do not sell your personal data.

4. Who we share data with

We share personal data only with the following categories of recipients, and only to the minimum extent needed for each purpose:

  • Shopify, Inc. — store and checkout hosting, fraud screening, payment processing.
  • Payment partners — Shopify Payments, Tabby, Apple Pay, and the issuing bank, for the specific transaction you authorise.
  • Delivery partners — our own riders and authorised third-party couriers (e.g. Talabat, Careem, RSA), receiving name, address, phone, and order details to deliver your order.
  • Marketing and analytics partners — Google (Ads + Analytics 4), Meta Platforms, Inc., and the operators of WATI (our WhatsApp Business platform). See Sections 5 and 6 for details.
  • Government authorities — when required by UAE law (tax authority, MOHRE, Dubai Police, courts).
  • Professional advisers — accountants and lawyers, bound by confidentiality.

We do not transfer personal data outside the UAE except to the providers listed above; transfers to those providers rely on the provider's published safeguards (including Standard Contractual Clauses or equivalent appropriate measures) under PDPL Article 22.

5. Google services — cross-site joining, Analytics 4, and enriched conversions

We use Google Analytics 4 (GA4) to measure how the site is used, and Google Ads to show ads and measure their performance. With your consent (via the cookie banner), the following happens:

  • Google places cookies (including _ga, _gcl_*) and reads device identifiers from your browser.
  • Google may join data from across its services and partner sites to build a profile of your interests for advertising personalisation. This means data we share with Google for measurement may be combined with data Google holds from other websites or Google products.
  • For conversion measurement, we may share hashed (one-way encrypted) versions of your email, phone, or name with Google ("Enhanced Conversions" / "Enriched Conversions"). Hashing prevents Google from reading the raw values; the hashes are used solely to match a conversion to an ad click, then discarded by Google per their published retention policy.
  • You can opt out at any time by clicking "Reject" in our cookie banner, or by using Google's Ads Settings: .

Until you accept cookies, Google services run in Consent Mode v2 default-denied state, meaning Google receives only anonymised cookieless pings (used for aggregate modelling only) rather than identifying data.

6. Meta (Facebook, Instagram, WhatsApp) — Pixel and Conversions API

We use Meta Pixel and Meta Conversions API (CAPI) to measure the performance of our ads on Facebook, Instagram, and WhatsApp, including ads that lead to a chat with us on WhatsApp ("Click-to-WhatsApp" / CTWA).

With your consent:

  • The Meta Pixel places a cookie (_fbp) and reads device identifiers from your browser.
  • We send Meta a hashed (one-way encrypted) copy of your email and phone, together with the WhatsApp click identifier (ctwa_clid) where applicable, so Meta can attribute a purchase or enquiry back to the ad that brought you. Hashes are not reversible to plain text.
  • Meta may join this data with information it already holds about you under its own published privacy policy.

You can opt out by clicking "Reject" in our cookie banner, or via your Facebook and Instagram ad-preference settings.

7. Cookies and consent

When you first visit our site we show a cookie banner that lets you Accept all or Reject non-essential cookies. Your choice is stored in a first-party cookie (aiwa_consent) for 180 days.

We use the following cookie categories, mapped to Google Consent Mode v2 signals:

Category Examples Consent Mode signal Used for
Essential session, cart, security functionality_storage, security_storage Operate the store. Always on, no consent required.
Analytics _ga, _gid analytics_storage Measure site usage. Off until you Accept.
Advertising _gcl_*, _fbp ad_storage, ad_user_data, ad_personalization Show and measure ads. Off until you Accept.
Personalisation preferences, language personalization_storage Remember your preferences. Off until you Accept.

You can change your choice at any time by clearing the aiwa_consent cookie in your browser, or by emailing ops@aiwabox.com.

8. Your rights under UAE PDPL

You have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Delete your data, subject to legal retention obligations (e.g. tax records).
  • Restrict or object to certain processing.
  • Receive a copy of your data in a structured, commonly used format (data portability).
  • Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
  • Lodge a complaint with the UAE Data Office.

To exercise any of these rights, email ops@aiwabox.com. We will respond within thirty (30) days. We may ask for proof of identity before acting on a request to protect your data from unauthorised disclosure.

9. How long we keep your data

  • Order and accounting records: retained for five (5) years to comply with UAE VAT and commercial-records law.
  • Customer-service messages: retained for two (2) years to allow follow-up and dispute resolution.
  • Marketing identifiers (cookies, hashed identifiers): retained per the cookie expiry shown in Section 7, or until you withdraw consent — whichever comes first.
  • Account data: retained for as long as your account is active, plus one year after closure.

Once retention expires, data is deleted or anonymised.

10. Security

We use Shopify's PCI-DSS-certified infrastructure, encryption in transit (HTTPS / TLS 1.2+), encryption at rest for sensitive fields, role-based access controls for our team, and audit logging. No system is perfectly secure, so we encourage you to use a strong unique password and to contact us immediately at ops@aiwabox.com if you suspect any account compromise.

11. Children

Our services are not directed to children under 18. We do not knowingly collect personal data from anyone under 18. If you believe we have, contact ops@aiwabox.com and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be announced on the home page or by email to registered customers.

13. Contact

Aiwa Chocolate and Flowers LLC Al Quoz 3, Dubai, United Arab Emirates ops@aiwabox.com