1. Who we are
ZoeyBloom Wholesale and Retail Company, based in Kuwait, operates zoeybloom.shop and determines how personal data is used for the store, order fulfilment, customer support, and our own marketing. In that context, ZoeyBloom is responsible for the processing described in this policy.
Tap Payments separately determines how it processes payment-instrument information when you initiate payment. Its role is explained in section 6 below.
2. Personal data we collect
- Identity and contact data, such as your name, email address, Kuwait phone number, delivery address, and preferred language.
- Order and customer-care data, including products, quantities, delivery instructions, returns, refunds, enquiries, and communications with us.
- Account data, if account features are available, such as sign-in details, saved addresses, and order history.
- Payment-related data received from Tap, such as transaction reference, amount, currency, status, payment method type, limited card metadata, and refund or dispute status. We do not receive your complete card number or security code.
- Device and usage data, such as IP address, browser or device type, pages viewed, referring URL, approximate location derived from IP, error logs, and security events.
- Preferences and marketing data, including language, product interests, newsletter choice, and your interaction with messages where permitted.
3. How we collect data
- Directly from you when you browse, place an order, contact support, subscribe, complete a form, or use an account feature.
- Automatically through necessary cookies, local storage, server logs, and similar technologies used to operate, secure, and improve the website.
- From Tap Payments, delivery providers, vendors, fraud-prevention providers, and other service providers involved in your transaction.
- From public or regulatory sources where permitted or required by law.
4. Why we use personal data
- To process and fulfil orders, arrange delivery, manage returns and refunds, and provide customer service.
- To verify payment status, reconcile transactions, prevent fraud, protect accounts, and keep the website secure.
- To remember your cart and language, provide requested account features, and personalise the shopping experience.
- To communicate service messages, policy changes, or important information about an order.
- To send marketing only where permitted and to honour unsubscribe or preference choices.
- To analyse performance, diagnose errors, improve products and services, keep business records, establish or defend legal claims, and comply with legal or regulatory duties.
5. Basis for processing
Depending on the activity and applicable law, we process data because it is necessary to take steps at your request or perform a purchase contract, comply with law, protect legitimate interests such as security and service improvement, or because you have given consent. Where we rely on consent, you may withdraw it for future processing.
6. Tap Payments and payment data
Tap Payments processes online payments and acts as an independent controller for the payment-instrument information it receives when you initiate a payment. Tap may collect card or wallet details, transaction data, contact information, device fingerprints, and security data, and may share data with banks, payment schemes, fraud-prevention providers, regulators, and other parties described in its policy.
ZoeyBloom uses the transaction information shared by Tap to confirm payment, fulfil orders, issue refunds, answer questions, reconcile accounts, and handle fraud or disputes. We do not store complete card credentials on our systems.
Tap requires merchants to make its notice available to customers. Please read the Tap Payments Privacy Policy for its retention, cross-border transfer, security, and rights practices.
8. International data transfers
Some technology, brand, payment, or support providers may process data outside Kuwait. Where personal data is transferred across borders, we take reasonable steps to use providers and safeguards consistent with applicable Kuwait requirements. Tap’s own transfers are governed by its privacy policy.
9. How long we keep data
We keep personal data only as long as reasonably needed for the purpose collected, including order fulfilment, warranties and returns, customer support, fraud prevention, accounting, legal compliance, and dispute resolution. Retention periods vary by record and legal duty.
- Order, invoice, refund, and transaction records are retained for the period required by applicable commercial, accounting, payment, and legal obligations.
- Support communications are kept while needed to resolve the request and maintain an appropriate service record.
- Marketing details are kept until you unsubscribe, withdraw consent where relevant, or the data is no longer useful, subject to a suppression record so we can respect your choice.
- Cart and preference data may remain on your device until it expires or you clear browser storage.
10. Security
We use reasonable technical and organisational measures designed to protect personal data, including access controls, secure transmission, provider review, backups, and monitoring appropriate to the nature of the data. No internet service is completely secure, so we cannot guarantee absolute security.
If we become aware of a personal-data incident, we will investigate, limit the impact, work with relevant providers including Tap where payment data is involved, and make notifications required by applicable law.
12. Your privacy rights
Subject to applicable law and relevant exceptions, you may ask us to:
- Explain whether and how we process your personal data and provide access to it.
- Correct inaccurate, incomplete, or outdated data.
- Delete data, restrict its processing, or object to certain processing where the law provides that right.
- Withdraw consent for future processing where consent is the basis, including unsubscribing from marketing.
- Receive or transfer data where a portability right applies.
- Raise a privacy enquiry or complaint with us or the competent authority.
13. Children and legal capacity
The store is not designed for children to purchase independently. If you are below the legal age to enter a purchase contract in Kuwait, a parent or legal guardian must place or authorise the order. Contact us if you believe a child provided personal data without proper authorisation.
14. Third-party links
Links to brand sites, social platforms, Tap, or other third parties lead to services we do not control. Their privacy notices apply to their independent processing, so we encourage you to read them.
15. Changes to this policy
We may update this policy when our services, providers, or legal obligations change. We will post the revised policy and date here and provide additional notice when required by law or when a change is material.
Privacy questions or requests
Contact us to ask a privacy question or exercise a right available to you under applicable law.
