Privacy Policy

1. Who is responsible for your data

Plant Mama L.L.C-FZ (“Plant Mama”, “we”, “us”), trade licence 2533532.01, registered at Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates, is the controller of the personal data collected through plantmama.ae. You can reach us about any privacy matter at [email protected].

2. What we collect

• Order details — your name, phone number, email address, and the recipient's name, phone number and delivery address, plus any gift message you write.
• Payment data — handled entirely by our payment provider. We receive only the payment result, the amount and a reference; we never see or store your full card number, expiry date or CVV.
• Order history — the items ordered, delivery slot, price paid and order status.
• Technical data — IP address, browser and device type, pages viewed and referring site, collected through cookies and similar technologies.
• Messages — what you send us through the contact form, WhatsApp, email or phone.

3. Why we use it

• To take, confirm, prepare and deliver your order.
• To take payment and, where necessary, issue a refund.
• To contact you or the recipient about the order — for example to confirm the address or arrange a delivery attempt.
• To answer enquiries and handle complaints.
• To keep accounting and tax records, and to comply with applicable UAE law.
• To detect and prevent fraudulent or unauthorised transactions.
• To understand how the website is used and improve it, and — where you have consented — to measure and target our advertising.

4. Who we share it with

We do not sell your personal data. We share it only with the service providers we need to fulfil your order, and only to the extent required:

• Stripe — our payment processor, for card payments and refunds.
• Delivery partners and our own drivers — the recipient's name, address and phone number, so the order can be delivered.
• Google — Google Analytics for website statistics and Google Maps for showing our boutique location.
• Meta — the Meta Pixel, for measuring and targeting our advertising.
• Hosting and IT providers — who operate the servers on which the website and order records run.
• Authorities — where we are required to disclose data by law or a lawful request.

Some of these providers operate outside the UAE. Where data is transferred abroad, we use providers that apply recognised safeguards for protecting personal data.

5. Cookies and tracking

We use cookies and similar technologies that are strictly necessary for the website to work — remembering your cart and wishlist, and keeping your checkout session secure. We also use analytics and advertising cookies from Google and Meta to understand traffic and measure campaigns.

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies may prevent the cart and checkout from working correctly.

6. How long we keep it

Order and transaction records are kept for as long as required by UAE accounting and tax law, which is generally five years from the end of the relevant financial period. Enquiries and contact messages are kept for up to 24 months. Analytics data is retained according to the retention settings of the analytics provider.

7. Security

The website is served over an encrypted HTTPS connection and card payments are processed by a PCI-DSS compliant provider. Access to order records is limited to the staff who need it to fulfil orders. No system can be guaranteed completely secure, but we take reasonable technical and organisational measures to protect your data.

8. Your rights

Under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, you may ask us to:

• confirm what personal data we hold about you and give you a copy;
• correct data that is inaccurate or incomplete;
• delete your data, where we are not required to keep it for legal or accounting reasons;
• restrict or object to certain uses, including direct marketing;
• withdraw a consent you previously gave.

Write to [email protected] and we will respond within 30 days. If you are a recipient rather than the sender of an order and want your details removed, contact us at the same address.

9. Children

This website is not intended for children under 18, and we do not knowingly collect their personal data.

10. Changes to this policy

We may update this policy. The current version, with its last-updated date, is always published on this page.

11. Contact