Information we collect
- Account data such as name, email, phone number, locale and account-security information.
- Buyer and order data such as addresses, cart activity, purchases, returns, refunds and support history.
- Seller and business verification data such as company details, trade-license information, KYC documents, bank or payout details and authorized-user roles.
- Technical data such as IP address, browser/device information, session records, security events and website usage.
- Marketing and analytics identifiers where you have provided consent or where another lawful basis permits processing.
How we use personal data
- Create and secure accounts and authenticate users.
- Process orders, payments, seller sub-orders, shipping, returns, refunds and payouts.
- Perform KYC, business verification, fraud prevention, compliance and security monitoring.
- Operate customer support, notifications and transactional communications.
- Measure marketplace performance and improve products, search and user experience.
- Run advertising, analytics and social integrations where they are enabled and lawfully permitted.
Legal bases and consent
Depending on the activity, processing may be necessary to perform a contract, comply with law, protect legitimate interests, prevent fraud, protect users or operate the marketplace. Where consent is required, we will request it before the relevant processing and allow withdrawal as required by law.
International processing and transfers
TomadoClick works with sellers and service providers that may operate outside the UAE. Where personal data is transferred internationally, we use appropriate contractual, technical and organizational safeguards as required by applicable law.
Retention
We retain personal data only for as long as reasonably necessary for the purpose collected, legal obligations, accounting, fraud prevention, dispute handling and platform security. Retention periods can differ by record type.
Your privacy rights
Depending on applicable law and the circumstances, you may have rights to request access, correction, deletion, restriction, portability, objection, or withdrawal of consent. Some requests may be limited where we must retain information for legal, fraud-prevention, accounting or dispute purposes.
Identity verification may be required before a privacy request is completed.
Security
We use access controls, encrypted connections, role-based permissions, account-security controls and other safeguards appropriate to the sensitivity of the information. No internet service can guarantee absolute security, so users should also protect their credentials and devices.