Craft & Culture Index

Privacy Policy

Last Updated: October 2025

1. Introduction

Craft & Culture Index ("Craft & Culture," "we," "our," or "us") is committed to protecting the personal data of individuals with whom we deal. This Privacy Policy describes how we collect, use, disclose, store and protect your personal data when you access or use our wine & spirits trading platform, associated websites and services ("Platform").

By using our Platform you acknowledge you have read, understood and consent to the data practices described here in accordance with the PDPL and other applicable UAE laws.

2. Scope and Application

This Policy applies to all personal data we process in the United Arab Emirates (onshore) and also to any processing of personal data of UAE residents (even if some processing occurs outside the UAE) in line with the extraterritorial scope of the PDPL.

If you are located in a UAE free zone jurisdiction (for example DIFC Data Protection Commissioner's Office / ADGM Data Protection Regulator) whose own data-protection regime applies, you may need to review additional or alternative privacy policies.

3. Information We Collect

3.1 Personal Data (Data Subject to the PDPL):

  • Contact details: full name, email address, phone number

  • Company / Business details (for B2B accounts): company name, registration number, business address

  • Payment, billing and trade information: bank or payment-card details, invoicing data, order history, transaction records

  • Trade / transactional data: orders placed, shipping and delivery details, correspondence and service communications

3.2 Automatically Collected Data:

  • IP address, device type, operating system, browser type/version

  • Date/time of access, pages visited, user behaviour / navigation within the Platform

  • Use of cookies and other tracking technologies (see Section 8)

4. Purposes & Lawful Basis of Processing

We process your personal data for the following purposes, relying on one or more lawful bases under the PDPL:

  • Account setup and management – to create and maintain your user account (lawful basis: performance of contract / consent)

  • Order, transaction and trade execution – to process purchases, sales, deliveries and invoicing (lawful basis: performance of contract)

  • Customer support – to respond to your queries, complaints and service requests (lawful basis: legitimate interest / consent)

  • Transactional communications – to send you order confirmations, updates and related communications (lawful basis: performance of contract)

  • Platform improvement and analytics – to enhance our services, monitor usage and improve user experience (lawful basis: legitimate interest)

  • Legal & regulatory compliance – to fulfill obligations under UAE law (such as anti-money-laundering, customs, bonded logistics) (lawful basis: legal obligation)

We collect only the personal data necessary ("data minimisation") and use it only for the purposes communicated to you ("purpose limitation") in line with PDPL principles.

5. Sharing and Disclosure of Personal Data

We do not sell or trade your personal data. We may, however, share data in the following circumstances:

  • Service providers – third-party processors acting on our behalf (hosting, payments, analytics, shipping) under contractual obligations to protect your data

  • Business partners – such as licensed suppliers, bonded-warehouse operators or logistics providers, as necessary for trade execution

  • Legal/regulatory authorities – where required by UAE law, or to protect our legal rights and interests

  • Corporate transactions – in the event of a merger, acquisition or sale of our business/assets, your personal data may be transferred to the successor entity, subject to confidentiality and compliance

We ensure that any sharing／transfer of personal data is done in compliance with the PDPL's rules on cross-border transfers (see Section 9).

6. Data Security & Retention

We adopt appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of your personal data, including encryption, access controls, secure storage and regular review of our security practices.

We will retain your personal data only for as long as necessary to fulfil the purposes set out in this Policy, or for other legitimate and lawful purposes (such as legal or tax retention obligations).

7. Your Rights under UAE Law

Under the PDPL you have the following rights in relation to your personal data:

  • Access: you may request a copy of the personal data we hold about you, along with information about its processing

  • Rectification / Correction: you may request we correct inaccurate or incomplete personal data

  • Erasure / Deletion: you may request deletion of your personal data, subject to legal or contractual retention obligations

  • Restriction of Processing: you may ask us to restrict processing where data is inaccurate, or objectionable

  • Portability: you may request your personal data in a structured, machine-readable format and transmit it to another controller

  • Objection to certain processing: you may object to processing for direct marketing or automated decision-making

  • Withdraw consent: where processing is based on consent, you may withdraw it at any time (this will not affect processing already carried out lawfully)

To exercise any of these rights, please contact us at privacy@craftandculture.com. We may require verification of your identity prior to actioning a request.

8. Cookies & Tracking Technologies

We use cookies, pixel tags and other similar technologies to:

  • Enable the core functionality of our Platform

  • Analyse user behaviour, traffic and usage patterns

  • Provide personalised content and promotional communications (where you have opted-in)

You can control the use of cookies via your browser settings. Disabling certain cookies may affect your ability to use certain parts of the Platform.

9. International & Cross-Border Data Transfers

Personal data collected under this Policy may be transferred to and stored in jurisdictions outside the UAE. We ensure that any such transfer is carried out in accordance with the PDPL's requirements:

  • Transfer is permitted to a country deemed to offer an adequate level of protection for personal data

  • If no adequacy decision exists, transfers may occur if: appropriate safeguards (such as contractual terms) are in place; or you have given your explicit consent; or the transfer is necessary for performance of a contract, or for judicial cooperation, or not contrary to UAE public interest

10. Children's Privacy

Our Platform is not intended for individuals under 21 years of age (or the legal drinking age in your jurisdiction). We do not knowingly collect personal information from minors.

If we become aware that we have collected information from a minor, we will promptly delete such information. If you believe we have collected information from a minor, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or technology. We will publish the updated version on our Platform and update the "Last Updated" date. Continued use of the Platform after the changes constitutes acceptance of the revised Policy.

12. Contact Us

If you have any questions, requests or concerns regarding this Privacy Policy or our data-protection practices, please contact us:

Craft & Culture Index
Email: support@craftandculture.com
Attn: Data Protection Officer (DPO)

Business Address:
Craft & Culture FZE
PO BOX 50365
Fujairah Free Zone
Fujairah, UAE
Phone: +971 9 228 1170

For the complete Privacy Policy, please download the full document.