This Privacy Policy explains how The Inclusive Collective FZ-LLC ("Company", "AnyBody", "we", "us", or "our") collects, uses, discloses, stores, and protects your Personal Data when you access or use the AnyBody mobile application, website, or related services (collectively, the "Platform").

Platform access, functionality, and use are governed by the Terms and Conditions.

This Privacy Policy complies with:

• UAE Federal Decree-Law No. 45 of 2021 on Protection of Personal Data (PDPL)
• UAE Consumer Protection Law
• Applicable UAE laws relating to data protection and cybersecurity
• Apple App Store and Google Play requirements
• Stripe and payment processor privacy requirements

By using the Platform, you acknowledge this Privacy Policy and understand that your Personal Data will be processed in accordance with applicable UAE law. Where consent is required as a lawful basis for processing, such consent will be obtained prior to processing.

1. Data Controller

The Data Controller responsible for your Personal Data is:

The Company determines the purposes and means of processing your Personal Data. The Company processes Personal Data in accordance with applicable UAE PDPL requirements and lawful bases described in this Privacy Policy.

2. Personal Data We Collect

2.1 Information You Provide

We may collect:

• Full name
• Email address
• Phone number
• Billing and shipping address
• Account credentials
• Purchase and order history
• Customer support communications
• Returns and exchanges information

2.2 Transaction and Payment Information

We collect:

• Order details
• Transaction confirmations
• Delivery details

Payment information is processed directly by third-party payment processors such as Stripe. We do not store full credit card numbers.

Payment processors operate under their own privacy policies and act as independent data controllers or processors depending on the processing involved. They are solely responsible for their processing of Personal Data in accordance with applicable laws.

2.3 Automatically Collected Information

We may automatically collect:

• IP address
• Device type
• Operating system
• App usage date
• Browser type
• Session activity
• Platform interaction data
• Unique device identifiers

This information may be collected using analytics tools and platform monitoring technologies. Such processing is conducted based on legitimate business interests to improve Platform functionality, security, and user experience.

2.4 Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Enable Platform functionality
• Improve performance
• Detect fraud
• Analyze usage

You may disable cookies in your device settings. Where required under applicable law, non-essential cookies and tracking technologies will only be activated after obtaining user consent through a clear opt-in mechanism.

2.5 Requirement to Provide Personal Data

Providing Personal Data is voluntary. However, certain Personal Data is required to create an account, process transactions, deliver products, and use essential Platform features. Failure to provide required Personal Data may prevent access to certain services or completion of transactions.

2.6 Accuracy of Personal Data

You are responsible for ensuring that the Personal Data you provide is accurate, complete, and up to date. The Company is not responsible for inaccuracies resulting from incorrect or outdated information provided by users.

2.7 Device Permissions and App Access

The Platform may request access to certain device features, such as notifications, storage, or other device capabilities, where necessary to provide Platform functionality, improve user experience, or deliver communications. You may control or disable such permissions at any time through your device settings. Disabling certain permissions may limit Platform functionality.

3. Purposes of Processing Personal Data

We process Personal Data for the following purposes:

• Processing and fulfilling orders
• Delivering products
• Providing customer support
• Preventing fraud and abuse
• Improving Platform functionality
• Ensuring Platform security
• Communicating with users
• Complying with legal obligations
• Providing marketing communications where consent has been given
• Investigating fraud, chargebacks, disputes, violations of the Terms and Conditions, or other unlawful or unauthorized activity
• Protecting the legal rights, safety, and security of the Company, its users, and third parties

We collect and process only Personal Data necessary for the purposes described in this Privacy Policy and do not process Personal Data in a manner incompatible with those purposes. Processing of Personal Data for the purposes described above is conducted in accordance with lawful bases under UAE PDPL, including performance of contractual obligations, compliance with legal obligations, legitimate business interests such as fraud prevention and Platform security, and your consent where required.

Processing may also be conducted where necessary to prevent fraud, unauthorized activity, abuse of the Platform, or violations of contractual or legal obligations.

The Company collects and processes only the minimum Personal Data necessary to achieve the specified purposes in accordance with applicable data protection principles.

4. Legal Basis for Processing

We process Personal Data based on the following lawful bases:

• Performance of a contract (order fulfillment, payments, delivery)
• Compliance with legal obligations
• Legitimate business interests, including fraud prevention, security monitoring, prevention of unauthorized access, protection of the Platform, and service improvement
• Your consent (marketing communications and optional processing)

You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal. You may withdraw consent by contacting support@shopanybody.com or through available Platform settings.

5. Sharing of Personal Data

We do not sell Personal Data.

We may share Personal Data with service providers where necessary to operate the Platform. Examples include:

• Stripe (payment processing)
• Courier providers (Aramex, DHL, FedEx, or equivalent)
• Cloud hosting providers (AWS, Google Cloud, or equivalent)
• Analytics providers
• Customer support providers
• Fraud prevention and security providers

We may also disclose Personal Data where required by UAE law or legal authorities. This may include retaining certain Personal Data after account closure where necessary to prevent fraud, enforce agreements, or comply with legal obligations.

We may transfer Personal Data as part of a merger, acquisition, restructuring, financing, sale of assets, or other corporate transaction, subject to appropriate legal safeguards and confidentiality protections.

Service providers process Personal Data only as necessary to provide services to the Company and are contractually required to protect Personal Data in accordance with applicable data protection laws. Such service providers are prohibited from using Personal Data for their own independent purposes unless acting as independent data controllers under applicable law.

Where third-party providers act as independent data controllers, their processing is governed by their own privacy policies and legal obligations, and the Company is not responsible for their independent processing activities beyond its reasonable control.

To the fullest extent permitted by applicable law, the Company shall not be liable for the independent acts or omissions of third-party service providers beyond its reasonable control.

The Company may also share Personal Data with payment processors, financial institutions, fraud prevention networks, and law enforcement authorities where necessary to detect, prevent, investigate, or address fraud, unauthorized transactions, security incidents, or illegal activities, based on contractual necessity, legitimate business interests, legal obligations, or lawful requests under applicable law.

By using the Platform, you acknowledge that certain third-party service providers may process Personal Data independently in accordance with their own privacy policies and legal obligations.

The Company may also disclose Personal Data to regulatory authorities where required to comply with applicable legal or regulatory obligations. Personal Data will be disclosed only where permitted under applicable law and based on lawful grounds, including legal obligations, contractual necessity, legitimate interests, or user consent where required.

6. International Data Transfers

Your Personal Data may be transferred outside the UAE. We ensure appropriate safeguards are in place, including contractual protections and secure transfer mechanisms consistent with UAE PDPL requirements.

Such transfers may occur to jurisdictions that may have different data protection standards than the UAE, but appropriate safeguards will be implemented. Such transfers are conducted in accordance with UAE PDPL requirements and are supported by appropriate safeguards, including contractual protections, adequacy determinations, lawful business necessity, legal obligations, or your consent, where applicable.

Where required under applicable law, appropriate contractual or legal safeguards will be implemented to ensure an adequate level of protection for transferred Personal Data.

Personal Data may be processed or stored in the United Arab Emirates, the European Economic Area, the United States, or other jurisdictions where our service providers operate infrastructure, subject to appropriate safeguards under applicable law.

7. Data Security

We implement appropriate technical and organizational measures to protect Personal Data, including:

• Secure servers
• Encryption
• Access controls
• Fraud monitoring systems

Access to Personal Data is restricted to authorized personnel only. Access is granted strictly on a need-to-know basis and subject to confidentiality obligations.

Personal Data may be processed and stored on secure infrastructure operated by trusted third-party hosting providers. Processing and storage of Personal Data on third-party infrastructure are conducted based on contractual necessity, legitimate business interests, and legal compliance.

8. Data Retention

While the Company implements reasonable safeguards, no method of transmission over the internet or electronic storage is completely secure, and the Company cannot guarantee absolute security.

The Company does not warrant that the Platform will be free from unauthorized access, cyber attacks, or security breaches, but implements reasonable safeguards consistent with industry standards.

We retain Personal Data only as long as necessary for:

• Providing services
• Legal compliance
• Fraud prevention
• Accounting and audit requirements

Retention periods vary depending on legal, operational, and regulatory requirements. We may retain certain Personal Data where necessary to prevent fraud, resolve disputes, enforce agreements, or comply with legal obligations.

Upon account deletion, Personal Data may be retained where necessary to comply with legal obligations, resolve disputes, prevent fraud, and enforce agreements.

Notwithstanding account deletion or consent withdrawal, the Company may retain Personal Data where necessary to detect fraud, prevent abuse, enforce legal rights, comply with legal obligations, or resolve disputes.

Certain Personal Data may be retained for legally required retention periods under applicable tax, accounting, and financial regulations. Personal Data may also be retained where necessary to establish, exercise, or defend legal claims, including fraud investigations, chargeback disputes, or regulatory enforcement proceedings.

The Company may retain relevant Personal Data as necessary to comply with payment processor requirements, prevent fraud, resolve chargebacks, and defend legal claims.

Retention periods may be extended where required to comply with regulatory, tax, accounting, dispute resolution, or legal enforcement obligations.

Where Personal Data is no longer required for operational, legal, or regulatory purposes, the Company will take reasonable steps to securely delete, anonymize, or de-identify such Personal Data in accordance with applicable data protection requirements.

Obligations relating to fraud prevention, legal compliance, dispute resolution, and enforcement of legal rights shall survive account deletion or termination. Personal Data may be retained for fraud prevention, risk assessment, and compliance purposes even after account closure, to the extent permitted under applicable law.

9. Your Rights Under UAE Law

Under UAE PDPL, you have the right to:

• Access your Personal Data
• Correct inaccurate data
• Request deletion of Personal Data
• Restrict processing
• Object to processing
• Withdraw consent
• Request transfer of Personal Data to another service provider where technically feasible and permitted under applicable law

To exercise your rights, contact: support@shopanybody.com

We may require identity verification before fulfilling requests. We will respond within a reasonable time in accordance with UAE law.

The Company will respond to verified data subject requests within 30 days of receipt, unless the request is complex or requires additional time under applicable law, in which case the Company will inform the requester of the extended timeframe.

You also have the right to lodge a complaint with the UAE Data Office or any other competent regulatory authority, as applicable under UAE law.

10. Account Security

You are responsible for safeguarding your account credentials. The Company is not responsible for unauthorized access resulting from your failure to protect your credentials.

11. Children's Privacy

The Platform is not intended for individuals under 18. We do not knowingly collect Personal Data from minors.

12. Third-Party Links

The Platform may contain links to third-party websites. We are not responsible for their privacy practices.

Third-party service providers operate independently and are responsible for their own privacy practices. The Company is not responsible for the privacy practices of third parties beyond its reasonable control.

13. Automated Processing and Fraud Prevention

We may use automated systems to detect fraud, abuse, and security risks. These systems are designed to protect both users and the Company.

We may monitor Platform activity to detect fraud, abuse, unauthorized access, security threats, or violations of our Terms and Conditions, and may retain relevant data as necessary to protect the Platform, enforce legal rights, and ensure Platform security.

Such automated processing is conducted in accordance with applicable UAE PDPL requirements and lawful bases, including legitimate business interests, legal obligations, and fraud prevention.

Automated processing is used to assist decision-making and does not solely produce legal or similarly significant effects without appropriate human review where required under applicable law.

14. Data Breach Response

In the event of a data breach, we will:

• Investigate promptly
• Take appropriate corrective action
• Notify affected users and authorities where required under applicable UAE law

15. Marketing Communications

You may receive marketing communications where consent has been given. You may unsubscribe at any time.

Marketing communications may include email, SMS, push notifications, or other electronic communications.

Service-related communications, including order confirmations, delivery updates, security notifications, and account-related notices, may be sent without marketing consent where necessary to provide the Platform and fulfill contractual or legal obligations.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Updates will be posted on the Platform.

Continued use of the Platform after updates become effective constitutes acknowledgment of the updated Privacy Policy, to the extent permitted under applicable law.

17. Compliance Statement

This Privacy Policy is designed to comply with applicable UAE data protection requirements and industry best practices. The Company maintains internal data protection controls and procedures to ensure ongoing compliance with applicable legal obligations.

18. Contact Information

This Privacy Policy is governed by the laws of the United Arab Emirates and applicable laws of the Emirate of Ras Al Khaimah. Disputes relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Ras Al Khaimah, United Arab Emirates.