1. Introduction

YallaParts.shop ("we," "our," or "us") respects your privacy. This policy outlines how we collect, use, and protect your personal data in compliance with:

• UAE's Federal Decree-Law No. 45/2021 (Personal Data Protection Law, PDPL)
• Saudi Arabia's Personal Data Protection Law (PDPL, 2023)
• General Data Protection Regulation (GDPR) principles for global users

By using our platform, you consent to this policy.

2. Data We Collect

a. Personal Information

• Contact details (name, email, phone, business address)
• Vehicle/part specifications (model, VIN, purchase history)
• Payment/banking information (processed via PCI-DSS compliant gateways)

b. Automated Data

• IP address, device type, browser
• Cookies (essential, analytics, marketing) -- manage via our Cookie Banner

c. Third-Party Data

• Logistics partners (tracking numbers)
• Fraud detection services

3. Legal Basis & Use of Data

We process data under:

• ✔ Contractual necessity (order fulfillment, warranty claims)
• ✔ Legitimate interest (fraud prevention, service improvement)
• ✔ Legal obligation (tax compliance, Middle Eastern data localization laws)
• ✔ Consent (marketing emails -- opt-in required)

Purposes include:

• Processing orders & cross-border shipments
• Providing customer support (via WhatsApp/email)
• Sending transactional alerts (SMS/email)
• Analyzing market trends (aggregated/anonymized data)

4. Data Sharing & Transfers

• Within Middle East: Data stored in UAE/Saudi AWS regions (PDPL-compliant)
• Global transfers: Encrypted transfers to China HQ under Standard Contractual Clauses (SCCs)
• Strict third-party contracts: Logistics (Aramex, DHL), payment gateways (PayFort, Stripe)

We never sell your data.

5. User Rights (PDPL/GDPR)

You may request:

• Access to your data
• Correction/deletion (unless retained for legal reasons)
• Opt-out of marketing
• Data portability (machine-readable format)
• Withdraw consent (via email/portal link)

Submit requests to: info@yallaparts.shop | Response within 30 days.

6. Security Measures

• Encryption: TLS 1.2+ for data in transit, AES-256 at rest
• Access controls: Role-based employee permissions
• Breach notification: Within 72 hours if PDPL/GDPR applies

7. Retention Period

• Active accounts: 5 years post-last transaction
• Inactive accounts: Anonymized after 2 years
• Legal requirements: Up to 10 years (tax records)

8. Children's Privacy

Our platform is not for users under 18. We do not knowingly collect minors' data.

9. Updates & Contact

We may update this policy. Continued use constitutes acceptance.

Data Protection Officer (DPO):
Email: info@yallaparts.shop