Privacy Policy And Terms Of Use

Who We Are

Dumyé's Studio is a handmade doll brand based in Dubai, United Arab Emirates. We operate www.dumye.com and sell globally, including to customers in the European Union and United Kingdom. For the purposes of GDPR, Dumyé's Studio is the data controller for personal data collected through this website.

Email: hello@dumye.com

What Information We Collect

When you shop with us, create an account, or contact us, we may collect: your name, email address, shipping and billing address, phone number, and personalisation details (such as a monogram name for a custom doll). If you subscribe to our newsletter, we collect your email address. When you visit our website, we also automatically collect your IP address, browser type, and browsing behaviour through cookies and analytics tools.

We do not store your payment card details. All transactions are processed securely by our payment providers and card data is never held on our servers.

How We Use Your Information

We use your information to process and fulfil your orders, manage your account, arrange delivery, and send you order confirmation and tracking updates. We use your email address to respond to your enquiries and, where you have opted in, to send you our newsletter and product updates. We also use anonymised data to improve our website. We keep records as required by law for tax and accounting purposes, and we process withdrawal and cancellation requests where a customer exercises their right to cancel under applicable consumer law.

Legal Basis for Processing (for EU & UK Customers)

We process your personal data on the following legal grounds under GDPR:

Processing your order and delivering your products — performance of a contract (Art. 6(1)(b))
Sending you our newsletter — your consent (Art. 6(1)(a)), which you may withdraw at any time
Improving our website and analysing usage — legitimate interests (Art. 6(1)(f))
Keeping tax and accounting records — legal obligation (Art. 6(1)(c))
Fraud prevention and security — legitimate interests (Art. 6(1)(f))
Processing a withdrawal or cancellation request — legal obligation / performance of a contract

Who We Share Your Data With

We do not sell, rent, or trade your personal information. We share data only where necessary with: Shopify Inc. (our e-commerce platform), delivery couriers such as FedEx (who receive your name and shipping address to fulfil your order), payment processors, our email marketing platform (for newsletter subscribers only), and analytics providers. All third parties are contractually obligated to keep your data confidential and to use it only for the purpose for which it was shared. We may also disclose information where required by law.

How Long We Keep Your Data

Order and transaction records: 7 years (to comply with tax and accounting obligations)
Customer account data: for as long as your account is active, plus 2 years after closure
Marketing email subscriptions: until you unsubscribe or withdraw consent
Customer service communications: 3 years from the date of your enquiry
Website analytics: up to 26 months

When data is no longer needed, we delete or anonymise it securely.

Your Rights

If you are based in the EU, EEA, or UK, you have the following rights regarding your personal data:

Right to Access — request a copy of the data we hold about you
Right to Rectification — ask us to correct inaccurate or incomplete data
Right to Erasure — request deletion of your data ("right to be forgotten"), subject to legal retention requirements
Right to Restrict Processing — ask us to pause processing in certain circumstances
Right to Data Portability — receive your data in a portable format
Right to Object — object to processing based on legitimate interests, or to direct marketing at any time
Right to Withdraw Consent — where processing is based on consent, withdraw it at any time
Right to Complain — lodge a complaint with your national data protection authority (e.g. Germany's BfDI, France's CNIL, the UK's ICO)

To exercise any of these rights, email us at hello@dumye.com. We will respond within 30 days.

Unsubscribing from Marketing

You can unsubscribe from our newsletter at any time by clicking the "Unsubscribe" link in any email we send, or by emailing hello@dumye.com.

Cookies

We use cookies to operate our shopping cart, remember your preferences, analyse site traffic, and — with your consent — to support marketing. You can accept or decline non-essential cookies when you visit our site, and you can manage cookie settings through your browser at any time.

International Data Transfers

Dumyé is based in the UAE. If you are located in the EEA or UK, your data is transferred outside the EEA/UK to be processed. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where applicable, and we work only with providers (such as Shopify) who comply with recognised data protection frameworks.

Children's Privacy

Our website is for adults. While our products are made for children, all purchases and accounts must be made by adults aged 18 or over. We do not knowingly collect data from anyone under 13. If you believe we have done so, please contact us at hello@dumye.com and we will delete it promptly.

Security

We use SSL encryption, access-controlled systems, and PCI-DSS compliant payment processors to protect your data. In the unlikely event of a breach affecting your rights, we will notify you and the relevant authorities as required by law.

Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top will reflect any changes. For significant changes, we will notify you by email or with a notice on our website.

Contact Us

hello@dumye.com