Privacy policy

This policy explains how Casa Legacy ("we", "us") handles personal data when you visit casa-legacy.ae, send us a request, place a ready-to-wear order or visit the atelier. It is written to comply with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, for visitors from the European Economic Area and the United Kingdom, the GDPR and UK GDPR.

Who we are

Casa Legacy, bespoke tailoring atelier, The Binary by OMNIYAT, office 608, 32 Marasi Drive, Business Bay, Dubai, United Arab Emirates. Email: admin@casa-legacy.ae. Phone: +971 58 226 7000. Casa Legacy is the trading name of CASA LEGACY FASHION DESIGNING L.L.C, a company licensed in Dubai, United Arab Emirates (Dubai Commercial Licence No. 1552222).

What we collect and why

• Consultation and contact requests: name, email, phone, the service you are interested in and your message. Used only to answer you and arrange your appointment. Legal basis: taking steps at your request before a contract; your consent for marketing, if given separately.
• Ready-to-wear orders: name, phone, delivery address, the pieces and sizes you choose. Used to confirm, fulfil and deliver your order and to handle alterations and returns. Legal basis: performance of a contract.
• Gift certificate orders: your name (printed on the certificate as the sender), email and phone, and the recipient's name. Used to issue the certificate: an electronic certificate is sent to your email, a printed certificate is issued at the atelier. We do not contact the recipient. Legal basis: performance of a contract.
• Bespoke commissions: measurements, posture notes, fabric and style choices and your pattern, kept in the atelier so that future commissions need only a brief fitting. Legal basis: performance of a contract and our legitimate interest in serving returning clients; you may ask us to delete them at any time.
• Website use: strictly necessary data to run the site (your cookie choice, the contents of your bag and, while you pay for a gift certificate, the details you typed in its form are stored in your own browser only). Analytics and marketing cookies are set only if you accept them in the cookie banner.

WhatsApp

If you choose to message us on WhatsApp, your messages are processed by WhatsApp LLC under its own privacy policy. Messages sent from this site are prefixed "[WEB]" so that we can recognise their origin.

Who receives your data

Our hosting and security provider (Cloudflare, Inc.), our email provider, courier companies for deliveries, and, if you accept the relevant cookies, Google (Analytics) and Meta (Pixel). Card payments, once available, are processed by Stripe, a licensed payment provider; we never see or store your full card number. We do not sell personal data.

International transfers

Some providers process data outside the UAE. We use providers that offer appropriate safeguards (standard contractual clauses or equivalent) and limit the data shared to what the service needs.

How long we keep data

Requests: up to 24 months after our last contact. Orders and invoices: as long as UAE commercial and tax law requires (currently five years). Patterns and measurements: for as long as you remain a client, unless you ask us to remove them.

Your rights

You may ask for access to your data, correction, deletion, restriction or portability, and you may object to processing or withdraw consent at any time by writing to admin@casa-legacy.ae. We respond within 30 days. You may also complain to the UAE Data Office or, where applicable, your local supervisory authority.

Security

The site is served over HTTPS with strict security headers, forms are protected against abuse, and access to client records is limited to atelier staff who need it.

Children

The site is not directed at children under 18 and we do not knowingly collect their data.

Changes

We may update this policy; the date at the top shows the current version.

This page is a working draft prepared for review by the company's legal adviser before publication.