Privacy Policy

This policy sets out how Carnival Mascot (“we”, “us”) collects, uses, stores and protects the personal data of visitors and customers of the website carnivalmascot.com (the “website”).

We respect your privacy. We apply legal, organisational and technical measures to protect personal data against unauthorised access, unlawful alteration, disclosure, loss, destruction and other unauthorised processing.

We process personal data in line with the data protection laws that apply to us and to you: the Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data of the United Arab Emirates and, for visitors in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR and UK GDPR). Visitors from other countries have the rights given to them by their local law.

By sending us a request or an order, you confirm that you have read this policy. Where the processing is based on your consent, you give it by ticking the box in the form, and you can withdraw it at any time.

The controller of your personal data is Carnival Mascot, a company registered in the United Arab Emirates, which sells the costumes offered on carnivalmascot.com.

Controller

Carnival Mascot

Country of registration

United Arab Emirates

Email

carnival.mascot.uae@gmail.com

WhatsApp

+971 58 539 7615

For any question about your data, write to carnival.mascot.uae@gmail.com with “Privacy” in the subject line.

• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation with personal data, such as collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, transfer, restriction, anonymisation, deletion or destruction.
• User: anyone who visits or uses the website.
• Cookies: small data files that the website stores on your device. Similar technologies, such as the browser's local storage, are covered by our cookie policy as well.
• Cross-border transfer: the transfer of personal data to another country, or access to it from another country than the one where it was collected.

Depending on how you use the website, we collect what you give us and what is technically necessary to run the website and answer you:

With your consent to analytics — or, outside the EEA, the UK and Switzerland, unless you object — the pages and models you view during a visit are linked to the random visit key. If you send us a request during the same visit, the manager handling it can see which models you looked at, so that we can answer more precisely. Our own statistics do not use cookies, do not store IP addresses and are not shared with third parties.

We do not intentionally collect passport or identity document details, information about income or debts, or other sensitive financial information. We do not collect payment card data: nothing is paid on the website, and payment is made after a manager confirms the order.

Please do not send us special categories of data, such as health information. Our website is not intended for children under 16.

We use personal data for these purposes:

• answering your enquiries and preparing quotes, sketches and delivery estimates;
• communicating with you about the design, production, payment, delivery and after-sales support of your costume;
• concluding and performing our contract with you, including invoices and customs documents;
• running the website and giving you access to its content and services;
• improving the website, its content and our service;
• keeping the website secure and preventing fraud, spam and other unlawful or unauthorised activity;
• complying with our legal obligations, for example in accounting and tax matters;
• sending you news about our products, services, offers or events, only if you have agreed to it or the law otherwise allows it.

You can stop receiving such news at any time: write to carnival.mascot.uae@gmail.com with “Unsubscribe” in the subject line, or tell us in the messenger.

We do not make decisions about you based solely on automated processing. From your answers (for example, what you need and the budget) our system gives each request an internal priority, which only helps managers decide whom to answer first. Every request is answered by a person.

Depending on the situation and the law that applies, we process personal data on one or more of these legal bases: your consent; steps taken at your request before entering into a contract; the performance of a contract with you; compliance with a legal obligation; our legitimate interests, where they are not overridden by your rights and freedoms.

Where the GDPR or the UK GDPR applies, we rely on these legal bases:

The consent box in our forms confirms that you have read this policy. Where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before the withdrawal and does not prevent processing on another legal basis.

We disclose personal data only where necessary: to our authorised staff and to service providers who help us run the website, communicate with you, process and deliver orders and receive payments. They are bound by confidentiality and data protection obligations and receive only what they need:

• Hetzner Online (Germany): hosting of the website. The server that stores requests and uploaded files is located in a data centre in the European Union.
• Cloudflare: content delivery network, DNS and protection of the website against attacks. It processes technical connection data, including IP addresses.
• Bitrix24: our customer relationship management (CRM) system, where our managers handle requests, orders and correspondence.
• WhatsApp (Meta) and Telegram: when you write to us there, the messenger processes your messages under its own privacy policy. Our CRM may receive these conversations through a messenger integration service. To make sure no request is lost, the website may also send our managers a short summary of your request (your name, how to reply to you, the model you are interested in, the country and the page) to their work chat in Telegram or to our company mailbox.
• Google: our email mailbox (Gmail); the YouTube player if you press play on a video (it is loaded from youtube-nocookie.com only at that moment); Google Analytics, only if you allow analytics cookies.
• Meta (Meta Pixel): measuring our advertising, only if you allow advertising cookies.
• Postal and courier services and customs brokers: your name, address, phone number and the contents of the parcel, to deliver your order and clear customs.
• Banks and payment service providers: to receive your payment.
• Authorities, courts and professional advisers, where the law, a court order or a lawful request of a competent authority requires it, or to establish, exercise or defend legal claims.

We do not sell, rent or otherwise commercially transfer your personal data to third parties.

We are based in the United Arab Emirates and sell to customers in many countries, and our team and service providers work from different countries. Your data may therefore be processed, transferred or stored outside your country of residence: in the United Arab Emirates and in other countries outside the European Economic Area, the UK and Switzerland, including countries that the European Commission has not recognised as providing an adequate level of data protection.

Where the law requires it, we protect such transfers with appropriate safeguards: an adequacy decision or the standard contractual clauses approved by the European Commission (with the UK addendum where needed). Transfers that are necessary to answer your request or to perform your contract may also rely on Art. 49(1)(b) GDPR. You can ask for more information about the safeguards at carnival.mascot.uae@gmail.com.

We keep personal data only as long as reasonably necessary for the purposes described in this policy, to perform our contracts and to comply with legal requirements. In particular:

• Requests that do not lead to an order: as long as needed to answer you and follow up on your request; then we delete or anonymise them. You can ask us to delete them earlier.
• Orders, invoices and accounting records: for the period required by tax and accounting law.
• Correspondence about an order: as long as warranty or other claims can be made.
• Files you uploaded: together with the request or order they belong to.
• Attribution data in your browser: up to 90 days (see the cookie policy).
• Technical records for protection against spam and attacks: no longer than needed for that purpose.
• Our own visit statistics: daily event records — 30 days; daily summaries without any visitor identifiers — 400 days.

The website uses encrypted connections (HTTPS). Access to personal data is limited to the staff who need it, and our internal tools are protected by personal logins and restricted network access. No transmission over the internet is completely secure, but we work to protect your data and to react quickly if something goes wrong.

Depending on the law that applies to you, you have the right to:

• get information about how we process your personal data;
• get access to your personal data and a copy of it;
• have incorrect data corrected;
• have your data deleted, or its processing restricted;
• receive the data you gave us in a common machine-readable format (data portability);
• object to processing based on our legitimate interests;
• withdraw your consent at any time;
• lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

To use your rights, write to carnival.mascot.uae@gmail.com. We may ask you to confirm your identity. We answer within one month; if the law gives us more time for a complex request, we will tell you.

If you live in the United Arab Emirates, you have the rights given to you by Federal Decree-Law No. 45 of 2021. If you live in another country with its own data protection law, you have the rights that law gives you and can use them in the same way.

We may update this policy when our services or the law change. The current version is always available on this page; the date and version at the top show when it was last changed. This policy remains in effect until it is replaced by a new version.

Questions about this policy or your data: carnival.mascot.uae@gmail.com or WhatsApp +971 58 539 7615.