Privacy Statement

Effective Date: January 2023

Alshaya Group (hereafter referred to as “we" or “our” or "us" or “Alshaya” or “organization”) are firmly committed to protecting your privacy.

This Privacy Notice has been created to demonstrate our company’s commitment to keep personal data private and secure. This Privacy Notice explains who we are, how we collect, share, and use personal data about you, and how you can exercise your data privacy rights or communicate to us for redressal of your data privacy-related queries or concerns.

This Privacy Notice is provided in a layered format so you can click through to the specific areas set out below.

IMPORTANT INFORMATION AND WHO WE ARE PURPOSE OF THIS PRIVACY NOTICE

This Privacy Notice will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from), including any data you provide through this website when you sign up to our newsletter, take part in a survey, download any Alshaya publication, take part in a competition, or use any of our mobile applications. However, if you are submitting information through our recruitment solution linked to this website, please see our separate Job Applicant Privacy Notice here.

It is important that you read this Privacy Notice together with any other privacy notice or fair processing notice we provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This Privacy Notice supplements the other notices and is not intended to override them.

This website is not intended for children, and we do not knowingly collect data relating to children.

DATA CONTROLLER

M.H. Alshaya Co. W.L.L. a Kuwaiti Company that acts as parent company of other legal entities under Alshaya (hereinafter “Alshaya Group”). This Privacy Notice is issued on behalf of the Alshaya Group so when we mention “Alshaya”, “we”, “us” or “our” in this Privacy Notice, we are referring to the relevant company in the Alshaya Group responsible for processing your data.
In this Privacy Notice “You” or “Your” refers to data subject (customers, employees, website visitors or contingent workers) whose personal data is processed by us.
M.H. Alshaya Co. W.L.L. is the data controller and responsible for this website. Alshaya's Data Protection Officer is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact the Data Protection Officer using the details set out below.

CONTACT DETAILS

Our full details are:
Full name of legal entity: M.H. Alshaya Co. W.L.L. (trading as Alshaya).
Postal address: Burj Alshaya, Al Soor Street, Al Mirgab, PO Box 181, Safat 13002, State of Kuwait.
Phone: +965 2224 2000.
Data Protection email address: dpo@alshaya.com

THIRD-PARTY LINKS

This website include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy notices/statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

THE PERSONAL DATA WE COLLECT ABOUT YOU

Personal Data, or personal information, means any information about an individual from which that person can be identified (defined under JOB Applicant Notice). It does not include data where the identity has been removed (anonymous data). We collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:

Identity Data includes first name, maiden name, last name, username or similar identifier, title, date of birth. Contact Data includes address, email address, telephone number and company details (including your company (or employer’s) name, position or title, company size, type of business/vertical and/or turnover).

Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.

Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website

Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.

Usage Data includes information about how you use our website, products and services.

Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data is derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Notice.

We do not collect any Special Categories of Personal Data about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about you. We do collect information about your health, biometric data, criminal convictions and offences.

HOW DO WE COLLECT YOUR PERSONAL DATA?

We use different methods to collect data from and about you including through:

DIRECT INTERACTIONS

You normally give us your identity, contact, resume by filling in forms or by corresponding with us by phone, and email or otherwise. This includes sharing of personal data for the following purpose:

a) Records of your interactions with us such as emails and other correspondence and your instructions to us.
b) Providing your feedback.
c) By filling in forms.
d) By sharing your personal data such as resume for recruitment purpose.
e) By interacting with us on social media platforms such as Facebook, Twitter, and LinkedIn etc.

AUTOMATED TECHNOLOGIES OR INTERACTIONS

Log Files. Log information is data about your use of the Service, such as IP (Internet Protocol) address, browser type, referring/exit pages, operating system, date/time stamps, and related data, which is stored in log files.

Cookies. A cookie is a small data file transferred to your computer (or other device) when it is used to access our service. Cookies are used for many purposes, including to enable certain features of our service and remember your preferences, your equipment, browsing actions and patterns, to better understand how you interact with our service, to provide you advertising on and off the service, and to monitor usage by visitors and online traffic routing. You can instruct your browser, by changing its options, to stop accepting cookies or to prompt you before accepting a cookie from the online services you visit.

For more information about cookies and how we use them, please read our Cookie Notice

THIRD PARTIES OR PUBLICLY AVAILABLE RESOURCES

We receive personal data about you from various third parties as set out below:

a) Analytics providers such as Google based outside the EU; and
b) Advertising networks based inside and outside the EU.

HOW WE USE YOUR PERSONAL DATA

We will only use your personal data in the following circumstances:

Consent

When you give us your consent, for example, to access your contacts on your phone or allow us to have access to your location. You have the right to withdraw your consent at any time. To withdraw your consent just go to the Privacy Settings in our mobile application or Android or iOS Mobile app settings or contact us at dpo@alshaya.com

Performance of a Contract

When we need to execute a contract with you to which you are a party or to take steps at your request before entering such a contract by accepting applicable terms and conditions or specific related terms relating to other services offered by us.

Where we need to collect Personal Data under the terms of a contract we have with you, and you fail to provide that data when requested, we will not be able to perform our services under the contract we have or are trying to enter into with you (for example, to provide you with any of our services). In this case, we will have to cancel a service you have with us but we will notify you if this is the case at the time.

Legal or regulatory obligation

When we need to collect Personal Data by law. If you fail to provide that data when requested, we will not be able to perform our services under the contract with you (for example, to provide you with any of our products or services). In this case, we will have to cancel a product or service you have with us and we will notify you at that time.

Legitimate Interests

Legitimate Interest means the broader stake that Alshaya has in the processing or the benefit that we derive from the processing of your Personal Data.

Where we rely on legitimate interests, we make sure that we consider and balance any potential impact on you and your rights before we process your Personal Data for our legitimate interests.

Additionally, we also process certain special categories of data such as criminal convictions and biometric data where we are lawfully permitted to do so and only for limited purposes such as fraud or loss prevention and for security purposes in our stores and premises. Apart from this, we do not collect any of the following Special Categories of Personal Data about you that includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, or genetic data.

We rely on consent as a legal basis for processing your personal data in relation to sending third party direct marketing communications for the purpose of targeting advertising campaigns via email and or SMS. You have the right to withdraw consent to marketing at any time by contacting us in our Contact Details section.

PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we can process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground, we are relying on to process your personal data where more than one ground has been set out in the table above.

CHANGE OF PURPOSE

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose (such as archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes). If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact the Data Protection Officer using the contact details provided in this Privacy Notice.

ALSHAYA MOBILE APPLICATIONS

Aura is the Alshaya loyalty program ("Program") accessible via the Aura mobile application and / or Aura card and website.

This Program is purposed to promote and increase our retail business lines sales; support continuing engagement by incentivizing customers to increase the frequency of their visits across Alshaya’s retail brands portfolio and ultimately, expand the customer database that will be the basis for personalized marketing activities. Any resident or national of a country in which Alshaya operates the Program can join it free of charge by downloading the Aura application and completing enrolment or via www.aura-mena.com. The below information we collect is provided when you use our application, such as when you create an account, join this loyalty program; or submit online forms through our websites or mobile applications.

i. User’s First and last Name;
ii. Phone number;
iii. E-mail;
iv. Currency;
v. Country;
vi. User’s language preference
vii. Title
viii. Password

The above personal data is strictly needed for our App functionality which in case of not being accepted by agreeing with these terms, Alshaya shall not be able to provide you the application. Use of Aura entails information collection in accordance with the above provisions and includes ways for you (the “User”) to control Application functionality, such as location services, setting push notification and in-app message preferences based in your revocable consent. As described further below, certain optional information based on your choice is also shared with through the Application, including:

i. your Date of Birth;
ii. Gender;
iii. Nationality.
iv. Advanced analytics information such as location data, diagnostic and usage data, and user interactions and v. location-based information, such as through GPS, Bluetooth-enabled iBeacons, or other location-based technology to enhance the user experience so that you can order ahead, receive directions, and see what is available at nearby stores.

MARKETING

We are committed to providing you with choices regarding certain Personal Data uses, particularly around marketing and advertising. We will get your consent before sending third party direct marketing communications to you via email or text message. You have the right to withdraw consent to receive 3rd party marketing communications at any time by Contacting us.

PROMOTIONAL OFFERS FROM US

We will use your Identity, Contact, Technical, U