Privacy policy

Privacy Policy — Sand & Stone

Last updated: August 2026

This Privacy Policy explains how Sand & Stone FZC-LLC ("Sand & Stone", "we", "us", "our") collects, uses, discloses and protects your personal data when you visit sandandstoneuae.com (the "Website"), place an order, request a quotation, or otherwise deal with us.

We process personal data in accordance with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "PDPL") and other applicable UAE laws. Please read this policy together with our Terms of Service and Legal Notice.

1. Who We Are

Sand & Stone FZC-LLC
A free zone company registered with the Sharjah Publishing City Free Zone Authority, Government of Sharjah
Business Licence No.: 4309704.01 | TRN: 104301564100003
Registered address: Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates
Email: info@sandandstone.store | Phone: +971 55 893 1585

For the purposes of the PDPL, Sand & Stone is the Controller of the personal data described in this policy.

2. Personal Data We Collect

  • Identity and contact data — name, email address, telephone number, billing address, delivery address and, for bespoke projects, site or building access details.
  • Order and transaction data — items purchased or enquired about, quotations, approved CAD drawings, order history, delivery arrangements, payment status and related correspondence.
  • Payment data — confirmation of payment and the method used. We do not collect or store your full card details (see Section 5).
  • Account data — where you create an account, your username, password and saved preferences.
  • Communications — messages you send us by email, contact form, WhatsApp, telephone or social media, and our replies.
  • Technical and usage data — IP address, device and browser type, operating system, pages viewed and how you navigate the Website, collected through cookies and similar technologies.
  • Marketing preferences — your consent to, or withdrawal from, marketing communications.

We do not knowingly collect sensitive personal data, and ask that you do not send it to us unless we have specifically requested it for a legitimate purpose.

3. How We Collect Personal Data

  • Directly from you — when you place an order, request a quotation or consultation, create an account, subscribe to our mailing list, or contact us.
  • Automatically — through cookies, server logs and analytics as you use the Website.
  • From service providers and partners — such as our e-commerce platform, payment providers and delivery partners, acting on our behalf.

4. How and Why We Use Your Personal Data

We use personal data only where we have a lawful basis under the PDPL — most commonly performance of a contract with you, compliance with a legal obligation, our legitimate interests, or your consent.

  • To fulfil your order — producing bespoke pieces, issuing invoices, arranging delivery and installation, and providing after-sales support. (Performance of a contract.)
  • To communicate with you — responding to enquiries, confirming quotations, obtaining CAD approval and scheduling delivery. (Performance of a contract; legitimate interests.)
  • To operate and improve the Website — maintaining security, understanding how the Website is used, and improving our products and service. (Legitimate interests.)
  • Marketing — sending offers, collection announcements and other updates where you have consented. (Consent.)
  • Legal and regulatory compliance — maintaining tax, VAT and accounting records and responding to lawful requests from competent authorities. (Legal obligation.)
  • Fraud prevention and security — verifying transactions and protecting our business and our customers. (Legitimate interests.)

5. Payments

We do not collect or store your credit or debit card details. Card payments are processed securely by our third-party payment service providers, whose handling of your data is governed by their own privacy and security policies. Where you prefer, payment may also be made by direct bank transfer to our business account, in which case we process only the transaction reference and confirmation.

6. Our E-Commerce Platform

The Website is hosted and operated on Shopify. Shopify processes personal data on our behalf in order to provide the store, process orders and payments, and keep the Website secure, and may store and process that data on servers outside the United Arab Emirates. Further detail is available in Shopify's own consumer privacy policy.

7. Sharing Your Personal Data

We do not sell or rent your personal data. We share it only where necessary, with:

  • Service providers — our e-commerce platform, payment processors, delivery and installation partners, IT and communications providers and professional advisers, each acting under our instructions.
  • Building and community management — where required to arrange delivery access, service lifts or move-in permits on your behalf.
  • Competent authorities — where required by UAE law, or to establish, exercise or defend legal claims.
  • A successor entity — in connection with a merger, acquisition or restructuring of our business.

8. International Transfers

Some of our service providers are located outside the United Arab Emirates. Where personal data is transferred outside the UAE, we take reasonable steps to ensure it remains protected to a standard consistent with the PDPL — by transferring only to jurisdictions recognised as providing adequate protection, or by putting appropriate contractual safeguards in place with the recipient.

9. Data Retention

We keep personal data only for as long as necessary for the purposes set out in this policy. Order, invoice and tax records are retained for the period required by UAE tax and commercial law. Bespoke project records, including approved CAD drawings, are retained for the life of any applicable warranty and for a reasonable period afterwards. Marketing data is retained until you withdraw consent. When data is no longer required, it is securely deleted or anonymised.

10. Your Rights Under the PDPL

Subject to the conditions and exceptions set out in the PDPL, you have the right to:

  • be informed about how your personal data is processed;
  • request access to the personal data we hold about you;
  • request correction of inaccurate or incomplete data;
  • request deletion of your personal data;
  • request restriction of, or object to, certain processing;
  • request transfer of your data to yourself or another controller, where technically feasible;
  • object to decisions based solely on automated processing that produce legal effects for you; and
  • withdraw your consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at info@sandandstone.store. We may need to verify your identity before acting on a request, and we will respond within the period required by law. Exercising these rights is free of charge and we will not treat you differently for doing so.

11. Cookies and Tracking

We use cookies and similar technologies to operate the Website, remember your cart and preferences, measure performance and, where permitted, support marketing. You can refuse or delete cookies through your browser settings, although some parts of the Website may not function properly if you do.

12. Marketing Communications

Where you have subscribed, we may send you marketing by email or messaging. Every marketing email includes an unsubscribe link, and you may opt out at any time by using it or by emailing info@sandandstone.store. We will still send you service messages relating to your orders.

13. Security

We apply appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including encrypted connections and restricted internal access. No method of transmission or storage is completely secure and we cannot guarantee absolute security, so please avoid sending sensitive information to us over unsecured channels.

14. Children's Privacy

The Website is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16 without verified parental consent. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Third-Party Links

The Website may link to third-party websites and platforms. We are not responsible for their content or privacy practices, and we recommend reviewing their policies before providing them with personal data.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal obligations. The revised version will be published on this page with an updated "Last updated" date.

17. Contact and Complaints

For any question about this Privacy Policy, or to exercise your rights, please contact:

Sand & Stone FZC-LLC
Email: info@sandandstone.store
Phone: +971 55 893 1585

We aim to resolve any concern directly. You also have the right to lodge a complaint with the UAE Data Office in accordance with the PDPL.