Privacy Policy

Last update: June 30, 2026

This Privacy Policy describes how Vanillya Group FZE, operating the Vanillya brand via the vanillya.co website, collects, uses, and protects the personal data of its users and customers.

This processing complies with the United Arab Emirates legislation on personal data protection (Federal Decree-Law No. 45 of 2021). For users residing in the European Union or the European Economic Area, Vanillya also applies the principles of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

1) Data Controller

The data controller is:

Vanillya Group FZE — License No. 4421800.01
Registered office: Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
Contact: privacy@vanillya.co

2) Data Collected

We collect the following categories of data:

Identification data: last name, first name, title.
Contact data: email address, phone number, shipping and billing postal address.
Order data: purchase history, amount, ordered Products.
Payment data: processed directly by our secure payment provider. We do not store credit card numbers.
Browsing data: IP address, browser type, pages visited, cookies (see section 8).

Mandatory fields are indicated at the time of collection. Failure to provide them will prevent the order from being processed.

3) Purposes of Processing

Your data is processed for the following purposes:

management and tracking of orders, deliveries, and returns;
customer relationship management and after-sales service;
invoicing and compliance with our accounting and legal obligations;
sending commercial communications and the newsletter, subject to your consent;
site improvement, audience measurement, and security;
fraud prevention.

4) Legal Basis for Processing

Each processing activity is based on one of the following foundations:

Contract performance : management of orders and deliveries.
Consent : sending the newsletter and placing non-essential cookies.
Legal obligation : retention of accounting and tax records.
Legitimate interest : service improvement, fraud prevention, and security.

5) Data Recipients

Your data is intended for authorized internal departments at Vanillya and, to the extent necessary for their tasks, for our subcontractors and partners:

payment service providers;
carriers and logistics providers;
hosting and site maintenance providers;
emailing and customer relationship management tools.

These third parties are bound by confidentiality and security obligations. Your data is never sold to third parties.

6) Data Retention Period

Order and billing data: kept for the duration necessary for execution, then archived in accordance with legal obligations for keeping accounting records.
Customer account data: kept as long as the account is active, then up to 3 years after the last contact.
Prospecting data (newsletter): kept until consent is withdrawn, then deleted within 3 years after the last contact.
Cookies: maximum duration of 13 months.

7) Your Rights

You have the following rights regarding your personal data:

Right of access to your data.
Right to rectification of inaccurate data.
Right to erasure of your data.
Right to restriction of processing.
Right to object to processing, particularly for prospecting purposes.
Right to data portability of your data.
Right to withdraw your consent at any time.

To exercise these rights, contact us at privacy@vanillya.co, providing proof of your identity. You will receive a response as soon as possible and, for residents of the European Union, within one month.

If you believe your rights are not being respected, you may file a complaint with the competent authority: the UAE Data Office in the United Arab Emirates or, if you reside in the European Union, the supervisory authority in your country of residence (e.g., the CNIL in France).

8) Cookies

The site uses cookies to ensure its proper functioning, to measure audience, and, subject to your consent, to offer you personalized content.

Strictly necessary cookies: essential for the site's operation (shopping cart, login). They do not require consent.
Audience measurement and marketing cookies: placed only after your consent, collected via the cookie banner.

You can at any time configure or withdraw your consent via the site's cookie management module, or configure your browser to refuse cookies.

9) Security

Vanillya Group FZE implements appropriate technical and organizational measures to protect your data against unauthorized access, loss, alteration, or disclosure (connection encryption, restricted access, use of secure providers).

10) International Data Transfers

As Vanillya is established in the United Arab Emirates and uses providers that may be located in various countries, your data may be transferred outside your country of residence. When these transfers involve data of residents of the European Union, they are governed by appropriate safeguards (standard contractual clauses or equivalent mechanisms) to ensure an adequate level of protection.

11) Contact

For any questions regarding this Privacy Policy or the processing of your data, you can write to us at: privacy@vanillya.co.

Cart