MAISON TERRAĒ

Handicraft Works

PRIVACY POLICY

Last Updated: February 2026

1. Introduction

Welcome to the Privacy Policy of Maison Terraē Handicraft Works ("Maison Terraē", "we", "our", or "us"). We are a ceramic and pottery studio registered and licensed in the Emirate of Dubai, United Arab Emirates, located at Goshi Warehouse City, Al Quoz 3, Warehouse 128, Dubai, UAE.

This Privacy Policy explains how we collect, use, store, disclose, and protect your personal information when you visit our website www.maisonterrae.com (the "Site"), make a booking, purchase a gift card, participate in our classes, workshops, or events, or otherwise communicate with us.

We are committed to protecting your personal data in accordance with the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL"), the UAE Federal Law No. 15 of 2020 on Consumer Protection, and all other applicable data protection laws and regulations in the United Arab Emirates.

By using the Site or our services, you acknowledge that you have read and understood this Privacy Policy. If there is any conflict between our Terms & Conditions and this Privacy Policy, this Privacy Policy shall prevail with respect to the collection, processing, and disclosure of your personal information.

2. Personal Information We Collect

We may collect the following categories of personal information depending on how you interact with us:

a) Information You Provide Directly:

— Contact Details: Your name, email address, phone number, and WhatsApp number.

— Payment Information: Credit or debit card details (Visa, Mastercard, American Express) processed securely through our payment provider, Stripe. We do not store your full card details on our servers. Stripe receives your payment information directly through its secure, PCI-DSS compliant infrastructure.

— Booking Information: Details of the classes, workshops, events, session packages, or gift cards you book or purchase, including dates, times, participant names, and any special requests.

— Communications: Information you include when you contact us via email, WhatsApp, Instagram, or any other channel, including customer support inquiries and rescheduling requests.

— Minor Information: If you book a session for a participant under the age of 18, we may collect the minor's name and age. This information is provided solely by the parent or legal guardian who makes the booking, and is used only for the purpose of managing the session.

b) Information Collected Automatically:

— Device Information: Your IP address, browser type, operating system, device type, and unique device identifiers.

— Usage Information: Pages you visit on the Site, how you navigate the Site, referring URLs, time spent on pages, and interaction data.

— Cookies and Similar Technologies: We use cookies, pixels, and similar tracking technologies to improve your browsing experience and analyse Site usage (see Section 8 below).

— Fraud Detection Data: Our payment provider, Stripe, may collect additional behavioral data during the checkout process — including interaction patterns with the payment form, device fingerprints, and connection data — through its fraud prevention system (Stripe Radar). This data is used solely for the purpose of detecting and preventing fraudulent transactions and is processed by Stripe in accordance with its own Privacy Policy.

3. Legal Basis for Processing

We process your personal information on the following legal grounds, as permitted under the UAE PDPL:

a) Contractual Necessity: Processing is necessary to perform our contract with you — for example, to confirm and manage your booking, process your payment, and provide the service you have purchased.

b) Consent: Where you have given us your explicit consent to process your personal information for a specific purpose, such as receiving marketing communications. You may withdraw your consent at any time (see Section 9).

c) Legitimate Interest: Processing is necessary for our legitimate business interests, provided that such interests are not overridden by your rights — for example, fraud prevention, improving our services, and ensuring the security of the Site.

d) Legal Obligation: Processing is necessary to comply with applicable laws and regulations, including tax, accounting, and commercial record-keeping obligations under UAE law.

4. How We Use Your Personal Information

We use your personal information for the following purposes:

a) Providing Our Services: To process and confirm your bookings, process payments, manage your session packages and gift cards, send booking confirmations and reminders, handle rescheduling requests, and communicate with you about your upcoming sessions.

b) Customer Support: To respond to your inquiries, resolve issues, and provide assistance via email, WhatsApp, or any other communication channel.

c) Marketing and Promotions: To send you promotional emails about upcoming classes, workshops, events, and special offers, only where you have provided your consent or where we have a legitimate interest to do so. In accordance with UAE Federal Law No. 15 of 2020 on Consumer Protection, we will not use your personal data for marketing purposes without your prior consent. You may opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us directly. If you opt out, we may still send you non-promotional messages related to your bookings.

d) Improving Our Services: To analyse how our Site and services are used, identify trends, improve the user experience, and develop new offerings.

e) Safety and Security: To detect and prevent fraud, protect the security of our Site and services, and authenticate your identity when necessary.

f) Legal Compliance: To comply with applicable laws and regulations, respond to lawful requests from authorities, and enforce our Terms & Conditions.

5. How We Share Your Personal Information

We do not sell, rent, or trade your personal information to any third party. We may share your personal information with third parties only in the following circumstances and only to the extent necessary:

a) Shopify: Our Site is hosted on Shopify Inc. (Canada). Shopify collects and processes certain personal information related to your use of the Site in order to provide and improve the platform, including hosting, site performance, and analytics. Shopify may also use data from your interactions with our Site, alongside data from other Shopify merchants, to provide enhanced features and services. Your personal information may be transferred to Shopify's servers in Canada and the United States. For more information, please refer to Shopify's Privacy Policy.

b) Stripe: Our payment processing is handled by Stripe, Inc. (United States). When you make a payment, your financial information is transmitted directly to Stripe's secure, PCI-DSS compliant servers. We do not store your full payment card details on our systems. Stripe may also collect behavioural and device data during the checkout process for fraud prevention purposes through Stripe Radar. Your personal information may be transferred to Stripe's servers in the United States. For more information, please refer to Stripe's Privacy Policy.

c) Cowlendar booking: We use Cowlendar for booking and scheduling management. Booking information (including your name, contact details, session dates, and times) may be shared with Cowlendar to manage class availability and session scheduling.

d) Communication Platforms: When you contact us via WhatsApp (Meta Platforms, Inc.), Instagram (Meta Platforms, Inc.), or email, your communications are processed and stored by those respective platforms in accordance with their own privacy policies. We encourage you to review their privacy policies.

e) Legal Requirements: We may disclose your personal information if required to do so by law, in response to a valid request from a UAE government authority or court order, or to protect the rights, safety, or property of Maison Terraē, our customers, or the public.

f) Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your personal information may be transferred as part of that transaction. We will notify you of any such change via the Site and ensure that the receiving party is bound by equivalent data protection obligations.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, and in accordance with the following retention periods:

— Booking and transaction records: Retained for a minimum of five (5) years from the date of the transaction, in accordance with UAE commercial and tax record-keeping requirements.

— Communication records: Retained for as long as necessary to resolve any ongoing inquiries or disputes, and thereafter deleted or anonymized.

— Marketing data: Retained until you withdraw your consent, opt out of marketing communications, or request deletion of your data.

— Automatically collected data (cookies, analytics): Retained for up to twenty-four (24) months for analytics purposes, unless a longer retention period is required by law.

— Payment data: We do not retain full payment card details. Transaction records (amounts, dates, confirmation numbers) are retained as part of our booking and transaction records above.

When personal information is no longer needed for its stated purpose and no legal obligation requires its retention, we will securely delete or anonymize it.

7. Data Security

We take reasonable and appropriate technical and organisational measures to protect your personal information against unauthorized access, loss, misuse, alteration, or destruction, as required by the UAE PDPL. These measures include:

— Secure payment processing through Stripe (PCI-DSS Level 1 compliant — the highest level of certification in the payment card industry).

— SSL/TLS encryption on our Site to protect data in transit.

— Restricted access to personal information on a need-to-know basis among our staff.

— Regular review of our data collection, storage, and processing practices.

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. We encourage you to use strong passwords and to exercise caution when sharing personal information online.

8. Cookies and Tracking Technologies

Our Site uses cookies and similar technologies to enhance your browsing experience. Cookies are small text files stored on your device when you visit the Site.

a) Essential Cookies: Required for the Site to function properly, including maintaining your session, processing payments, and ensuring site security. These cookies cannot be disabled without affecting the functionality of the Site.

b) Analytics Cookies: Help us understand how visitors use the Site, which pages are most popular, and how we can improve the user experience. These cookies collect information in an aggregated and anonymized form.

c) Marketing Cookies: Used to deliver relevant advertisements and track the effectiveness of our marketing campaigns. These cookies may be set by third-party advertising partners.

d) Shopify Cookies: As our Site is hosted on Shopify, Shopify may set its own cookies for platform functionality, analytics, and to support personalised advertising features. For more information on Shopify's use of cookies, please refer to Shopify's Cookie Policy.

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse cookies or alert you when a cookie is being set. Please note that disabling certain cookies may affect the functionality of the Site, including the ability to make bookings or process payments.

9. Your Rights

Under the UAE Federal Decree-Law No. 45 of 2021 (PDPL) and other applicable data protection laws, you have the following rights with respect to your personal information:

a) Right of Access: You have the right to request access to the personal information we hold about you and to receive a copy of such information in a clear and understandable format.

b) Right to Correction: You have the right to request that we correct any inaccurate or incomplete personal information we hold about you without undue delay.

c) Right to Deletion: You have the right to request that we delete your personal information, subject to certain legal exceptions (for example, where we are required to retain records for tax, legal, or regulatory purposes).

d) Right to Restrict Processing: You have the right to request that we restrict the processing of your personal information in certain circumstances, for example while we verify the accuracy of your data following a correction request.

e) Right to Data Portability: You have the right to request a copy of your personal information in a structured, commonly used, and machine-readable format, and to have that information transmitted to another controller where technically feasible.

f) Right to Withdraw Consent: Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

g) Right to Object: You have the right to object to the processing of your personal information where we rely on legitimate interests as the legal basis, and you have the right to opt out of receiving marketing communications from us at any time.

h) Right to Lodge a Complaint: If you believe that your personal data has been processed in violation of the PDPL, you have the right to lodge a complaint with the UAE Data Office or any other competent authority.

To exercise any of these rights, please contact us using the details provided in Section 14 below. We will respond to your request within thirty (30) days of receipt, as required by applicable law. We may need to verify your identity before processing your request. We will not charge you a fee for exercising your rights, unless the request is manifestly unfounded or excessive.

10. Children's Privacy

Our Site and online services are not directed at children under the age of 18. We do not knowingly collect personal information directly from children. When a parent or legal guardian books a session for a minor, the personal information is collected from and provided by the adult making the booking. We process this information solely for the purpose of managing the booked session.

If you believe that we have inadvertently collected personal information from a child without appropriate parental consent, please contact us immediately using the details in Section 14 and we will take prompt steps to delete such information.

11. International Data Transfers

In order to provide our services, your personal information may be transferred to and processed in countries other than the United Arab Emirates. Specifically:

— Shopify transfers and stores data on servers located in Canada and the United States.

— Stripe processes payment data on servers located in the United States.

— Meta Platforms (WhatsApp, Instagram) processes communication data on servers located in the United States and other jurisdictions.

When such transfers occur, we ensure that appropriate safeguards are in place to protect your personal information in accordance with the UAE PDPL. Our service providers rely on recognized transfer mechanisms, including Standard Contractual Clauses (SCCs) and data protection framework certifications, to ensure that your data receives an adequate level of protection regardless of where it is processed.

By using the Site and our services, you acknowledge and consent to the transfer of your personal information to jurisdictions outside the UAE as described in this section.

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent UAE authorities without undue delay and, where required by applicable law, notify you of the breach. Such notification will include the nature of the breach, the categories of data affected, the likely consequences, and the measures taken or proposed to address the breach.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable laws. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this Privacy Policy periodically. Your continued use of the Site or our services after any changes constitutes your acceptance of the revised Privacy Policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy, the way we handle your personal information, or if you wish to exercise any of your rights under applicable data protection law, please contact us:

Maison Terraē Handicraft Works
Goshi Warehouse City, Warehouse 128
Dubai, United Arab Emirates
Email: contact@maisonterrae.com
WhatsApp: +971 54 279 0504
Website: www.maisonterrae.com

— End of Privacy Policy —