Privacy Policy

Last updated: 22 September 2026

This Privacy Policy describes how ATELIER BOX ("we", "us", or "our") collects, uses, discloses, and protects information about you when you visit or interact with our website atelierbox.ae (the "Website"). This Policy is designed to comply with applicable data protection laws, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL") and its Executive Regulations, the European General Data Protection Regulation (GDPR – EU Regulation 2016/679), and French data protection legislation. Where our customers are established within the Dubai International Financial Centre (DIFC) or the Abu Dhabi Global Market (ADGM), we further undertake to comply with the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and the ADGM Data Protection Regulations 2021 respectively, to the extent applicable.

1. Data Controller

The controller for the processing of your personal information is:

ATELIER BOX
A Société par actions simplifiée (SAS) incorporated under the laws of France
Registered office: 4 rue du Caire, 75002 Paris, France
Paris Trade and Companies Register number 920 939 386
Represented by Paul Polyakov, publication director.

For any privacy-related inquiries: contact@atelierbox.ae

ATELIER BOX is established in France and does not have a legal establishment, branch, subsidiary, or representative office in the United Arab Emirates. ATELIER BOX has not appointed a Data Protection Officer (DPO), as the conditions for mandatory appointment under Article 10 of the UAE PDPL, Article 37 of the GDPR, and applicable French law are not met given the nature and volume of our data processing activities.

2. Target Audience and Scope

The Website is intended exclusively for businesses, corporate entities, and professionals. Personal information collected typically concerns individuals acting in a professional capacity (business contacts, employees of customer companies, and similar business representatives).

3. Information We Collect

In the course of our B2B activities, we collect the following categories of personal information:

  • Business identification data: name, first name, job title, company name
  • Business contact information: shipping and billing address, business email address, business phone number
  • Business legal data: trade license number, company registration number, VAT number where applicable
  • Order data: products ordered, purchase history, amounts, payment status
  • Payment and billing data: payments are processed by bank transfer or credit card via our provider Stripe. We never have access to full credit card numbers, which are processed directly by Stripe in compliance with PCI-DSS standards.
  • Communications data: information you voluntarily provide via our contact form or quote request forms
  • Navigation data: IP address, browser type, operating system, pages visited, time spent, referring URL (via cookies – see Section 8)

We do not knowingly collect personal information from individuals under the age of 21 (the age of majority under UAE law) or 18 (the age of majority under most other jurisdictions). If you believe we have inadvertently collected such information, please contact us immediately.

4. Purposes and Legal Bases of Processing

We process your personal information for the following purposes, on the following legal bases:

Purpose Legal Basis (UAE PDPL / GDPR)
Management of orders and customer relationship Contract performance (Art. 5(1)(b) PDPL / Art. 6(1)(b) GDPR)
Invoicing and accounting obligations Legal obligation (Art. 5(1)(c) PDPL / Art. 6(1)(c) GDPR)
Responding to inquiries via contact form Pre-contractual measures / legitimate interest
Customer relationship management (CRM) Legitimate interest (Art. 5(1)(f) PDPL / Art. 6(1)(f) GDPR)
Processing credit card payments Contract performance
Website audience measurement Consent (via cookie banner)
Fraud prevention and IT security Legitimate interest
Compliance with anti-money laundering and sanctions laws Legal obligation
Establishment, exercise, or defense of legal claims Legitimate interest

ATELIER BOX does not send newsletters or unsolicited commercial email communications.

5. How We Disclose Your Information

We do NOT sell your personal information. We do NOT share your personal information for cross-context behavioural advertising purposes.

We may disclose your personal information to the following categories of recipients:

  • authorized internal personnel of ATELIER BOX (sales, logistics, accounting)
  • our service providers, in particular:
    • Shopify International Limited – website hosting (Ireland)
    • Stripe Payments Europe Ltd. – credit card payment processing (Ireland)
    • HubSpot, Inc. – customer relationship management (United States)
    • Google LLC – analytics (Google Analytics, Google Search Console, Google Tag Manager)
    • our shipping and logistics providers for order delivery, including carriers with operations in the UAE
    • our accountant, auditors, and, where applicable, legal advisors
  • governmental authorities, courts, or third parties in the context of legal obligations under French law, UAE law (including PDPL, anti-money laundering, and sanctions regulations), or the protection of our legal rights

Each service provider is bound by a contract requiring appropriate data protection measures compliant with UAE PDPL Article 26, GDPR Article 28, and equivalent provisions.

6. International Data Transfers

ATELIER BOX is based in France. Your information may be transferred to, stored, and processed in France, the European Union, and other countries where our service providers operate, including the United States.

Under UAE PDPL (Articles 22–24), cross-border transfers of personal data outside the UAE are permitted where the destination country provides an adequate level of protection or where appropriate safeguards are in place. Transfers from the UAE to France are covered by the general adequacy framework of the European Union, of which France is a member.

For transfers from the European Economic Area, United Kingdom, or Switzerland to third countries, we rely on appropriate safeguards under Articles 44 et seq. of the GDPR, including:

  • adherence to the Data Privacy Framework (DPF) for certified U.S. providers;
  • Standard Contractual Clauses (SCC) adopted by the European Commission;
  • and, where applicable, additional technical and organizational measures.

7. Retention Period

Type of Data Retention Period
Customer data (orders, contracts, invoices) 10 years from the end of the commercial relationship (French accounting obligation)
Prospect data (quote requests, contact form) 3 years from the last contact
Navigation data and cookies maximum 13 months
Anti-money laundering compliance data 5 years from the end of the business relationship (in accordance with Federal Decree-Law No. 20 of 2018)
Data for defense of legal claims until expiry of applicable statute of limitations

8. Cookies and Similar Technologies

The Website uses cookies to ensure proper functionality, measure audience, and improve user experience. On your first visit, a consent banner allows you to accept, refuse, or customize the placement of non-strictly necessary cookies.

Strictly necessary cookies (cart, session, security) do not require your consent. You may modify your preferences at any time via the cookie banner or your browser settings.

We do not use cookies for cross-context behavioural advertising.

9. Your Rights Under UAE PDPL

Under Article 13 of the UAE PDPL, if you are a data subject whose personal data is processed in connection with your relationship with a UAE-based business, you have the following rights:

  • Right of access: to obtain information about your personal data and how it is processed;
  • Right to request transfer of your data: to obtain your personal data in a structured, commonly used format;
  • Right to rectification or erasure: to correct inaccurate data or request deletion;
  • Right to restrict processing: to limit how your data is used in specific circumstances;
  • Right to stop processing: to object to processing based on legitimate interest or direct marketing;
  • Right to object to automated decision-making: including profiling that produces legal or similarly significant effects (ATELIER BOX does not engage in such automated decision-making);
  • Right to file a complaint: with the UAE Data Office if you believe your rights have been violated.

10. Your Rights Under GDPR (EU/EEA Residents)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the GDPR (Articles 15 to 22):

  • Right of access to your personal data
  • Right to rectification of inaccurate data
  • Right to erasure ("right to be forgotten"), subject to legal exceptions
  • Right to restriction of processing
  • Right to data portability
  • Right to object, particularly to processing based on legitimate interest
  • Right to withdraw consent at any time
  • Right to lodge a complaint with a supervisory authority (in France: CNIL – www.cnil.fr)

11. Exercising Your Rights and Complaints

To exercise any of the rights described above, contact us at contact@atelierbox.ae or by post at ATELIER BOX, 4 rue du Caire, 75002 Paris, France. We may need to verify your identity before processing your request. We will respond within one month, extendable by two additional months if reasonably necessary.

UAE residents may also file a complaint with:

UAE Data Office
Website: u.ae/data-protection

EU/EEA residents may file a complaint with the French supervisory authority:

CNIL — Commission Nationale de l'Informatique et des Libertés
3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
Website: www.cnil.fr

12. Data Security

We implement appropriate technical and organizational measures compliant with UAE PDPL Article 20 and GDPR Article 32 to protect your personal information, including HTTPS encryption throughout the Website, restricted access controls, secure hosting with Shopify, regular backups, and staff awareness training. Credit card payments are processed via Stripe, PCI-DSS Level 1 certified. Notwithstanding these measures, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

13. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (CNIL for EU residents, UAE Data Office for UAE residents) and, where required by law, the affected individuals, without undue delay and in accordance with Article 9 of the UAE PDPL and Articles 33-34 of the GDPR.

14. Children's Privacy

The Website is intended exclusively for business users and is not directed to minors. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected personal information from a minor, please contact us at contact@atelierbox.ae and we will promptly delete it.

15. Changes to This Privacy Policy

ATELIER BOX reserves the right to modify this Privacy Policy at any time to reflect legal, regulatory, or technical developments. The version in effect at the time of your visit shall apply. The date of the last update is indicated at the top of the document. Material changes will be notified via a prominent notice on the Website.

16. Contact Us

For any questions regarding this Privacy Policy or the processing of your personal information, please contact us: