Privacy Policy – Bold Crystals

Last updated: 21 September 2026

This privacy policy explains what personal data Bold Crystals collects when you visit our website or buy from us, why we need it, and the choices you have.

The short version: we collect what we need to sell and ship your order. We never sell your data for money. With your permission, Google and Meta cookies help us measure visits and our ads — and you can switch them off any time.

Who we are

Bold Crystals is an online store for natural gemstones and gemstone jewellery. We work online from the United Arab Emirates and ship worldwide.

For this policy, Bold Crystals is the "controller" of your personal data. Contact: [email protected]

What personal data we collect

Order details — your name, email, phone number, shipping address, what you buy and any order notes (for example a ring size).
Payment confirmation — whether a payment succeeded and its reference number. You enter card details on Stripe's or PayPal's own secure pages. We never see or store your full card number.
Messages — what you send us through the contact form or by email.
Newsletter — your email address, only if you subscribe.
Technical data — your IP address, browser type and the pages you request, kept in standard server security logs.
Usage data (with your permission) — pages you visit, products you view or add to your cart, and your device type, collected by Google Analytics, Google Ads and the Meta Pixel through cookies.

We don't ask for sensitive data, such as health information.

Why we use it — and our legal basis

To process, ship and support your order — needed to carry out our contract with you.
To answer your questions — our legitimate interest in helping customers, or steps you ask for before buying.
To keep tax and accounting records — a legal obligation.
To keep our store safe from fraud, spam and abuse — our legitimate interest.
To send news and offers — only with your consent. Every email lets you unsubscribe.
To measure our shop and our ads — with your consent in the EU, EEA, UK and Switzerland, and our legitimate interest elsewhere. You can switch it off any time.

Who we share it with

We share only what each partner needs to do its job:

Payment providers — Stripe and PayPal process your payment under their own privacy policies.
Delivery partners — couriers such as FedEx and Quiqup receive your name, address and phone number to deliver your parcel.
Customs authorities — international parcels carry a customs declaration with your name, address and the contents.
Service providers — our website hosting and email providers store data for us under contract.
Google (Analytics, Ads and Merchant Center) and Meta (Facebook and Instagram) — usage and purchase details, such as the products viewed and an order's value, to measure and show our ads. Only when cookies are allowed. See how Google uses this data.
Authorities — only when the law requires it.

We never sell your personal data for money. Some US state laws (such as California's) treat advertising cookies as "sharing". You can opt out any time with Cookie settings at the bottom of every page, and we honour the Global Privacy Control (GPC) signal from your browser.

International transfers

We are based in the UAE, and our partners may process data in other countries. When data moves out of the EU, UK or another region with transfer rules, we rely on recognised safeguards — such as the European Commission's Standard Contractual Clauses — offered by our main providers.

How long we keep it

Orders and invoices — at least 5 years, because tax and commercial laws require it.
Contact messages — up to 2 years after our conversation ends.
Newsletter email — until you unsubscribe.
Server logs — kept for a short time for security, then deleted.

Your privacy rights

Depending on where you live, you can ask us to:

Access the personal data we hold about you
Correct anything that's wrong
Delete your data (we may need to keep order records for tax law)
Export your data in a portable format
Object to or restrict how we use it
Withdraw consent at any time, where we rely on consent

Email [email protected]. We reply within one month, and we'll never treat you differently for using your rights.

EU and UK residents

You have these rights under the GDPR and the UK GDPR. You can also complain to your local data protection authority — in the UK, that's the Information Commissioner's Office (ICO).

California and other US states

You can ask to know, delete or correct the personal information we hold, and to opt out of its "sale" or "sharing". We don't sell personal information for money. To opt out of "sharing" through advertising cookies, use Cookie settings or turn on Global Privacy Control in your browser. You can also make a request through an authorised agent.

UAE residents

We handle your data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021).

Everywhere else

Wherever you live, you can use the rights above by emailing us.

Cookie policy

Cookies are small files saved in your browser. We use three kinds:

Essential — always on. Your cart is saved in your browser, a short-lived cookie remembers a checkout in progress (up to 2 hours), and anonymous codes block spam. The shop can't work without these.
Analytics — your choice. Google Analytics shows us how visitors use the shop, so we can improve it. Cookies such as _ga last up to 2 years.
Marketing — your choice. Google Ads and the Meta Pixel (Facebook, Instagram) measure our ads and help show them to people who may like our stones. Cookies such as _gcl_au and _fbp last up to 90 days.

Your choice

EU, EEA, UK and Switzerland: analytics and marketing cookies stay off until you click Accept.
Everywhere else: they're on by default, and you can switch them off at any time.
Change your mind whenever you like with Cookie settings at the bottom of every page.
Global Privacy Control: if your browser sends this signal, marketing cookies stay off.

Payment pages from Stripe and PayPal set their own cookies on their own sites.

How we protect your data

Our website uses HTTPS encryption. Payments go through PCI DSS-compliant providers. Only people who need your order details to run the store can see them.

Children

Our store is for adults. We don't knowingly collect data from anyone under 16. If you think a child has sent us personal data, email us and we'll delete it.

Changes to this policy

When we update this policy, we change the date at the top of this page.

Contact us

Questions about your privacy? Email [email protected].