Last updated: August 25, 2026
This Privacy Policy explains how Habiba Arts ("we", "us", "our") collects, uses, and protects your personal information when you visit our website or place an order with us.
Who We Are
The data controller for personal information collected through this website is Habiba Arts Ltd, a company registered in England and Wales under company number 17444310, with its registered office at Initial Business Centre, Unit 7 Wilsons Business Park, Manchester, United Kingdom, M40 8WN.
1. What Information We Collect
When you browse our store, personalize a product, or place an order, we may collect:
- Your name, email address, and phone number
- Delivery address and billing address
- Order details (products, quantities, prices)
- Personalization text (names, dates, messages) that you enter for custom items
- Photos or files you upload for personalized products
2. How We Use Your Information & Our Lawful Basis
Under UK GDPR, we must have a valid lawful basis for each way we use your personal information. Here's what we use it for, and which basis applies:
| What we use it for | Lawful basis |
|---|---|
| Processing, personalizing, and fulfilling your order | Performance of a contract with you |
| Arranging delivery and providing tracking updates | Performance of a contract with you |
| Taking payment and keeping financial/accounting records | Performance of a contract; legal obligation (tax law) |
| Responding to customer support requests and chatbot conversations | Performance of a contract; our legitimate interest in supporting customers |
| Sending order confirmations and service updates | Performance of a contract |
| Sending marketing emails and newsletters | Your consent (you can withdraw it at any time) |
| Fraud prevention, security, and enforcing our Terms | Our legitimate interest in protecting our business and customers |
3. Uploaded Photos & Files
Any photo or file you upload is used solely to create and proof your personalized order. We do not use your uploaded images for any other purpose, and we do not share them outside of producing your item.
4. Payment Data
We do not store your card details on our servers. If a payment gateway is used at checkout, your payment information is collected and processed directly by that payment provider under their own security standards.
5. Cookies
Our site uses cookies to keep your cart and wishlist contents, remember your login/session, and (where enabled) understand how visitors use our site through basic analytics. You can disable cookies in your browser, though parts of the site — like the cart — may not work correctly without them. Where required, we will ask for consent before using non-essential cookies.
6. Live Chat / Chatbot
Our website includes an AI-powered chat assistant to help with common questions and order tracking. We may store the messages you send to the chat assistant, along with technical data such as your IP address, for support and security purposes. Please don't share passwords, full payment card numbers, or other sensitive information in chat.
7. Email Marketing
We only send marketing emails or newsletters to customers who have opted in. Every marketing email includes an unsubscribe link, and you can opt out at any time.
8. Data Sharing
We share the minimum information necessary with these categories of trusted third parties who help us run our store:
| Category of recipient | Why we share data with them |
|---|---|
| Couriers and delivery providers | To deliver your order and provide tracking updates |
| Payment-processing providers | To securely take payment for your order |
| Production partners and product suppliers | To make and prepare your (often personalized) order for dispatch |
| AI-powered customer-support providers | To power our live chat assistant and help answer your questions |
| Translation/localisation providers | To display our website and communications in your preferred language |
| Email service providers | To send order confirmations and, where you've opted in, marketing emails |
| Website hosting and business tools | To run and secure our store's technical infrastructure |
We never sell your personal information to third parties.
9. Data Retention
We only keep personal information for as long as we need it. Retention periods vary by the type of data:
| Data | Retention period |
|---|---|
| Order & transaction records (including personalization details kept for warranty/support) | 6 years from the order date, to meet UK tax and accounting obligations |
| Uploaded personalization photos/files | Deleted from active production storage within 90 days of order completion, unless still needed for a support or warranty issue |
| Customer account data (name, email, saved addresses) | Kept while your account is active; deleted or anonymised if it's been inactive for 3 years |
| Marketing/newsletter data | Kept until you unsubscribe or ask us to delete it |
| Live chat/chatbot logs | Up to 12 months, for support and security purposes |
| Support messages & correspondence | Up to 3 years after your enquiry is resolved |
Where we're required to keep information for longer to comply with the law, or to establish, exercise, or defend legal claims, we'll retain it for that longer period.
10. Security
We use reasonable technical and organisational measures to protect your personal information.
11. International Data Transfers
Some of the third parties listed in Section 8 — including our payment processor, AI customer-support provider, translation/localisation provider, and overseas production partners — are based, or process data, outside the UK. If you order from outside our operating country, your information may also be processed by service providers in other countries where required to fulfil your order.
Where we transfer personal data outside the UK, we put appropriate safeguards in place, such as relying on the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or transferring only to countries covered by UK adequacy regulations.
12. Children's Privacy
Our website is not intended for children under 16, and we do not knowingly collect personal information from children.
13. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Ask us to delete your data ("right to be forgotten"), where applicable
- Restrict or object to certain processing
- Receive your data in a portable format, where applicable
- Withdraw consent at any time, where we rely on consent (e.g. marketing emails)
To make a request, contact us using the details below and we'll respond as soon as we can, and within one month as required by law.
If you're unhappy with how we've handled your personal data, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.
14. Contact Us
Habiba Arts Ltd (company number 17444310)
Initial Business Centre, Unit 7 Wilsons Business Park, Manchester, United Kingdom, M40 8WN
Questions about this policy or your data? Email us at contact@habibaarts.com.