Privacy Policy

30/10/2025

1. Data Controller Identity

The site is operated by AddictGlow FZ-LLC, Free Zone Limited Liability Company, registered with Ras Al Khaimah Economic Zone (RAKEZ), United Arab Emirates.
Licences: Commercial no. 5031165 — E-Commerce no. 45007312.
Registered address: Compass Building, Al Hulaila Industrial Zone – FZ, Ras Al Khaimah, United Arab Emirates.
GDPR / Privacy Officer contact: direction@intiviae.com.

2. Scope

This Policy applies to the processing of personal data relating to visitors, users, customers and accounts created on the Site, including transactions handled through Shopify Checkout and Stripe and shipments managed by CJ Logistics.

3. Legal Bases for Processing

Performance of a contract: order handling, shipping and customer service.
Consent: non-essential cookies, marketing and newsletters.
Legitimate interest: fraud prevention, security and experience improvement.
Legal obligations: invoicing and accounting retention.

4. Data Processed

Customer account: name, email, activity history and hashed identifiers.
Order data: products, amounts, shipping address and phone number when provided.
Payment: secure tokens; no card data is stored on our servers.
Logistics: only the data strictly required for shipping.
Technical data: IP metadata, system logs, performance and security data.
Customer support: messages and attachments if provided.

5. Processing Purposes

Account management and authentication.
Payment, shipping, confirmation and tracking.
Customer support and post-purchase operations.
Site performance analysis where consent is given.
Detection and prevention of fraud attempts.
Compliance with applicable regulatory obligations.

6. Processors

Shopify — E-commerce infrastructure & billing.
Stripe — Payment processing.
Supabase — Authentication & encrypted storage.
Vercel — Frontend hosting & edge caching.
CJ Logistics — Fulfilment & international shipping.

Transfers outside the EU are governed by Standard Contractual Clauses (SCC) in accordance with GDPR.

7. Retention Periods

Customer account: period of use + 3 years of inactivity.
Billing data: 10 years.
Technical logs: 6 to 24 months depending on criticality.
Marketing data: until consent is withdrawn.

8. Your Rights

Access, rectification, erasure, restriction, objection and portability.
Requests: direction@intiviae.com
Supervisory authorities: CNIL (France), APD (Belgium), FDPIC (Switzerland).