Last updated: 27 September 2026 · Effective date: 1 October 2026
This Privacy & Data Policy (the “Policy“) explains how ORIGINALL SERVICES FZCO, trading as ORIGINALLUXURY (“ORIGINALLUXURY“, “we“, “us” or “our“) collects, uses, shares and protects personal data when you visit originall.market, create an account, purchase a Product, use a Digital Product Passport (“DPP“) or the ORIGINALLUXURY mobile application, or otherwise interact with us (together, the “Services“).
We are committed to handling personal data lawfully, fairly and transparently. Depending on where you are located and how you interact with us, this Policy is designed to comply with the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP), and other applicable data protection laws, including US state privacy laws where applicable.
1. Who We Are
The data controller responsible for your personal data is ORIGINALL SERVICES FZCO, a free zone company registered in the Dubai Multi Commodities Centre (DMCC) Free Zone under licence number DMCC-943062 and registration number DMCC200210, with its registered address at Unit ALMAS48-LUX-SO-02, DMCC Luxury Innovation Centre, 48th Floor, Almas Tower, Plot JLT-PH1-A0, Jumeirah Lakes Towers, Dubai, United Arab Emirates.
Privacy contact: contact@originall.com. For any data protection matter, you may also contact us by telephone on +971 50 814 9650.
The Maisons whose Products are sold on the Marketplace receive certain personal data to fulfil your order (see Section 5). Each Maison acts as an independent controller of the data it receives and is responsible for its own processing.
2. Personal Data We Collect
2.1 Data you provide to us
- Account data: name, email address, password, telephone number, country of residence, and account preferences.
- Order data: billing and delivery addresses, Products purchased, order history, and communications relating to your orders.
- Payment data: payment method, transaction reference and the last digits of your card. Full card details are collected and processed directly by our payment service provider, Stripe, and are not stored by us.
- Verification data: where required under anti-money laundering, counter-terrorist financing or sanctions laws, copies of identity documents, proof of address, nationality, date of birth and information on the source of funds.
- Digital Product Passport data: ownership records linking you to a Product, and any documents, photographs, valuations, notes or other content you choose to add to your DPP.
- Communications: messages you send us via email, contact forms, telephone or social media, and your marketing preferences.
2.2 Data collected automatically
- Technical data: IP address, browser type and version, device type, operating system, time zone and language settings.
- Usage data: pages viewed, Products browsed, search terms, referring sources, and the date and time of visits, collected through cookies and similar technologies (see Section 11).
2.3 Data from third parties
- Payment and fraud-prevention providers (e.g. payment status, fraud risk indicators); carriers (delivery status); Maisons (information relating to your order or after-sales requests); identity verification and sanctions-screening providers; and social media platforms if you interact with our pages or choose to log in using them.
We do not intentionally collect special categories of personal data (such as health, religious or biometric data). Please do not include such data in content you upload to your DPP or send to us.
3. How We Use Your Personal Data and Our Legal Bases
We only use personal data where we have a lawful basis to do so. Where the GDPR, UK GDPR or similar laws apply, our legal bases are as follows:
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account | Account data, technical data | Performance of a contract |
| Processing, fulfilling and delivering orders; handling after-sales and statutory claims | Account, order, payment and communication data | Performance of a contract; legal obligation |
| Issuing, transferring and hosting your Digital Product Passport | Account, order and DPP data | Performance of a contract |
| Identity verification, AML/CTF and sanctions screening; fraud prevention | Verification, order, payment and technical data | Legal obligation; legitimate interests (preventing fraud and crime) |
| Accounting, tax and record-keeping | Order and payment data | Legal obligation |
| Customer service and responding to enquiries | Account and communication data | Performance of a contract; legitimate interests |
| Sending marketing communications and newsletters | Name, email, preferences | Consent (which you can withdraw at any time); or legitimate interests for similar products where permitted by law |
| Improving the Marketplace, analytics and personalisation | Technical and usage data | Consent (for non-essential cookies); legitimate interests |
| Security and operation of the Services | Technical and usage data | Legitimate interests; legal obligation |
| Establishing, exercising or defending legal claims | Any relevant data | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may request details of this assessment. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, except automated fraud screening at checkout, which is subject to human review on request.
4. Digital Product Passports and Ownership Transfers
Your DPP links your account to the Product you own. When you transfer a Product and its DPP to a new owner, the new owner will see the Product information and provenance history, but your identity and the personal content you added will not be disclosed to them unless you choose to share it. We retain a record of past ownership changes to maintain the integrity and traceability of the DPP, in pseudonymised form, and for the periods described in Section 8.
5. Who We Share Your Data With
We share personal data only where necessary and with appropriate safeguards:
- Maisons: the Maison whose Product you purchased receives your name, delivery address, contact details and order information in order to prepare, ship and support your order. The Maison may share your delivery details with the carrier it uses.
- Service providers (processors): our payment service provider Stripe, our cloud hosting and storage provider Amazon Web Services (AWS), website and e-commerce platform providers, email and customer-service tools, analytics providers, and identity-verification and sanctions-screening providers. They act on our instructions and under contractual confidentiality and security obligations.
- Professional advisers: lawyers, auditors, accountants and insurers, under duties of confidentiality.
- Authorities: regulators, law enforcement, tax and customs authorities, financial intelligence units and courts where required by law or to protect our rights.
- Corporate transactions: a buyer or successor in the event of a merger, acquisition or restructuring, subject to this Policy.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising without your consent.
6. International Data Transfers
We are based in the United Arab Emirates and our service providers may process data in other countries, including the European Union, Switzerland, the United Kingdom and the United States. Where personal data is transferred to a country that does not provide an adequate level of protection under the law applicable to you, we implement appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and their UK and Swiss equivalents), contractual protections required by the UAE PDPL, or other lawful transfer mechanisms. You may request a copy of the relevant safeguards by contacting us.
7. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including encrypted connections (TLS), access controls, and the use of reputable hosting and payment providers. No online transmission is completely secure; please keep your account credentials confidential. In the event of a personal data breach, we will notify the competent authorities and affected individuals where required by law.
8. How Long We Keep Your Data
| Category | Retention period |
|---|---|
| Account data | For as long as your account is active, and up to 2 years after closure |
| Order, payment and invoice records | At least 5 years after the transaction, or longer where required by tax or accounting law |
| Verification (AML/CTF) records | At least 5 years after the transaction or end of the business relationship, as required by law |
| Digital Product Passport ownership records | For the lifetime of the Product and its DPP, to preserve provenance (pseudonymised after transfer to a new owner) |
| DPP content you uploaded | Until you delete it or your account is closed |
| Marketing preferences | Until you unsubscribe or withdraw consent |
| Cookies and analytics data | See Section 11; generally no longer than 13 months |
When data is no longer needed, we delete or anonymise it securely.
9. Your Rights
Depending on the law applicable to you, you may have the right to:
- access the personal data we hold about you and obtain a copy;
- rectify inaccurate or incomplete data;
- erase your data, where there is no overriding legal reason to keep it;
- restrict or object to certain processing, including processing based on legitimate interests and direct marketing (which you can object to at any time);
- data portability, receiving your data in a structured, machine-readable format;
- withdraw consent at any time, without affecting processing carried out before withdrawal;
- not be subject to decisions based solely on automated processing that significantly affect you;
- if you are a California resident: know what personal information we collect and disclose, request deletion or correction, opt out of any “sale” or “sharing” (we do not sell or share), and not be discriminated against for exercising your rights.
To exercise your rights, contact contact@originall.com. We may need to verify your identity. We will respond within the time required by applicable law (generally one month under the GDPR). Some rights are subject to limitations, for example where we must retain data to comply with AML or tax laws.
You also have the right to lodge a complaint with a supervisory authority, such as the UAE Data Office, the data protection authority of your EU Member State of residence, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner. We would appreciate the opportunity to address your concern first.
10. Marketing
We will only send you marketing emails where you have consented or where otherwise permitted by law. Every marketing email contains an unsubscribe link, and you may also update your preferences in your account or by contacting us. We will continue to send service messages relating to your orders and DPP.
11. Cookies and Similar Technologies
We use cookies and similar technologies to operate the Marketplace, remember your basket and preferences, keep you logged in, and, with your consent, to analyse traffic and improve our Services. Non-essential cookies are only placed after you give consent through our cookie banner, and you can change your choices at any time via the “Cookie settings” link in the website footer.
| Type | Purpose | Consent needed? |
|---|---|---|
| Strictly necessary | Security, login, shopping basket, checkout, cookie-consent record | No |
| Preferences | Remembering language, currency and display choices | Yes, where required by law |
| Analytics | Understanding how visitors use the Marketplace (Google Analytics) | Yes |
| Marketing | Measuring campaigns and showing relevant content on other platforms (Meta Pixel) | Yes |
You can also control cookies through your browser settings; blocking strictly necessary cookies may prevent parts of the Marketplace from working.
12. Children
The Services are not directed at persons under 18, and we do not knowingly collect personal data from them. If you believe a minor has provided us with personal data, please contact us so that we can delete it.
13. Third-Party Websites and Services
The Marketplace may contain links to third-party websites, Maison websites, social media platforms and app stores. Their privacy practices are governed by their own policies, and we are not responsible for them.
14. Changes to this Policy
We may update this Policy from time to time. The latest version is always available on the Marketplace, with its date shown at the top. If we make material changes, we will notify you by email or through the Services before they take effect.
15. Contact Us
ORIGINALL SERVICES FZCO (trading as ORIGINALLUXURY)
DMCC licence no. DMCC-943062 · Registration no. DMCC200210
Unit ALMAS48-LUX-SO-02, DMCC Luxury Innovation Centre, 48th Floor, Almas Tower, Plot JLT-PH1-A0, Jumeirah Lakes Towers, Dubai, United Arab Emirates
Email: contact@originall.com · Telephone: +971 50 814 9650