“Sanipex Group”, acting through the legal entity named on the Imprint/Company Information page of the relevant storefront, is the controller for the processing described in this Notice.

Privacy contact: [email protected]

Postal address: as per the Imprint for the applicable storefront.

Where required by law, we will identify our Data Protection Officer and any EU/UK representative in the Imprint and the Regional Annexes.

This Notice applies to website visitors, account-holders, customers and prospective customers, delivery/installation/warranty recipients, and marketing/event contacts. Applicant data may be covered by a separate applicant privacy notice available on request.

Read this together with:

• Terms & Conditions of Sale
• Cookie Policy & Preferences Centre
• Returns & Refunds Policy
• Shipping & Delivery Policy
• Installations Policy
• Warranty Policy

Regional Annexes prevail where they apply (UAE/MEA, UK/EU, KSA, Qatar, GCC-Other, Wider MEA).

• Identity & contact: name, title, addresses, email, phone; company/role for B2B.
• Account: login, hashed password, saved addresses, preferences.
• Orders & payments: cart contents, order history, invoices, delivery/collection instructions, payment authorisation tokens handled by payment providers; we do not store full card numbers.
• Installation & site: appointments, site readiness/access notes, and photographs shared by you or taken with your permission for diagnosis.
• Warranty & after-sales: product serial numbers, fault descriptions, service history, correspondence.
• Device/usage: IP address, device identifiers, browser type, analytics events, cookie IDs per the Cookie Policy.
• Marketing & events: marketing preferences, engagement metrics, event RSVPs and attendance.
• B2B trade details: purchasing authority, VAT/Tax ID, trade references.
• Loyalty/benefits (if applicable): loyalty identifiers and profile attributes where you choose to link them to your account.
• CCTV/visit logs: if you attend our premises, subject to local signage/notice.

Special-category and criminal-conviction data (limited). We do not seek special-category data. If you provide such data voluntarily, or where law requires checks, we process it only on the narrow grounds permitted by law and with appropriate safeguards.

• Directly from you (forms, checkout, email/phone/chat, in-store).
• Automatically via cookies/SDKs/analytics (see Cookie Policy).
• From third parties: payment providers, delivery and installation partners, anti-fraud and security services, CRM/marketing platforms, Sanipex affiliates, and public sources.

We process your data for the purposes below, under the listed lawful bases (regional equivalents appear in the annexes):

• Account setup & management — Contract; Legitimate interests (secure accounts).
• Order intake, payment & invoicing — Contract; Legal obligation (tax); Legitimate interests (fraud prevention).
• Delivery/collection & scheduling — Contract; Legitimate interests (efficient fulfilment, safety).
• Installation & exceptional works — Contract; Legitimate interests (quality/safety); Consent where photos are optional.
• Warranty, returns & recalls — Contract; Legal obligation (product safety); Legitimate interests.
• Customer service & disputes — Contract; Legitimate interests (service, evidence).
• Marketing (email/SMS/WhatsApp/push) — Consent where required; Legitimate interests where permitted with opt-out.
• Personalisation & analytics — Consent for non-essential cookies; Legitimate interests for essential analytics.
• Security & fraud prevention — Legitimate interests; Legal obligation where mandated.
• Regulatory compliance & audit — Legal obligation; Legitimate interests (compliance).

Where we rely on consent, you may withdraw it at any time via the Preferences Centre or unsubscribe links.

We use cookies and similar technologies for functionality, performance, analytics and advertising in line with our Cookie Policy & Preferences Centre. Non-essential cookies operate on a prior-consent basis and can be changed at any time.

Disclosures. We share personal data, as necessary, with service providers (hosting, payments, logistics/installation, customer support, CRM/marketing, analytics, warranty and product-safety partners), Sanipex affiliates for consolidated operations and security, professional advisers, authorities/regulators and dispute-resolution bodies, and potential successors subject to confidentiality.

Cross-border storage and transfers. We operate internationally and may store or process data in the GCC and other countries. Where personal data moves cross-border, we implement appropriate safeguards: EU/UK Standard Contractual Clauses and/or UK Addendum with supplementary measures where appropriate; recognised transfer grounds under UAE Mainland/DIFC/ADGM, KSA and Qatar frameworks; or contractual safeguards with recipients. You may request high-level information about the relevant safeguards.

We retain personal data only as long as needed for the purpose collected, including: orders/tax records typically 6–10 years (jurisdiction-specific); warranty/product-safety records for the warranty term plus a safety buffer; accounts for the life of the account and a defined archival period; marketing until you withdraw consent/object or after defined inactivity; CCTV/visit logs for short periods unless an incident requires longer. When retention ends, we securely delete or anonymise data.

Subject to law and region, you may have rights to: access, rectification, erasure, restriction, portability, objection (including to direct marketing), and to withdraw consent. We may verify identity/authority before acting.

We do not conduct decisions based solely on automated processing that produce legal or similarly significant effects. Any personalisation used for marketing is optional and subject to your preferences.

Our e-commerce services are not directed to children. If a child has provided data without appropriate consent, contact us and we will take appropriate steps.

We implement technical and organisational measures appropriate to the risk, including access controls, encryption in transit and at rest where appropriate, network segregation, backup/recovery, and vendor due diligence. No system is perfectly secure; please use our security contact route for responsible vulnerability reporting.

Our sites may link to third-party websites, plug-ins and apps. Their privacy statements govern those services; review them before providing data.

We may update this Notice to reflect legal, technical or business changes. Material changes will be signposted reasonably in advance. The Effective date and Version indicate the current edition.