Privacy policy
Last updated: 7 November 2026
This policy explains how we collect, use, keep and destroy your personal data, and what your rights are and how to exercise them. It applies to the Elian Russia online store and to your communication with us by WhatsApp and email. It was prepared under the Personal Data Protection Law and its Implementing Regulation, and the E-Commerce Law and its Implementing Regulation.
1. Who controls your data
1.1 The controller is RandM Company (شركة راندم), a single-person limited liability company, Unified National Number 7052744294, the exclusive agent of the Elian Russia brand in the Kingdom of Saudi Arabia and the operator of the store ("the Company" or "we").
1.2 Address: Sheikh Saleh bin Abdulaziz bin Abdulrahman Street, Al Suwaidi Al Gharbi, Riyadh 12993, Kingdom of Saudi Arabia.
1.3 For any request or question about your data: email care@elianrussia.sa with the subject "Personal Data", or WhatsApp and phone +966 58 223 2010.
2. The data we collect
| Category | Data | Required or optional |
|---|---|---|
| Order data | Name, mobile number, email, shipping address, products ordered, amounts, invoices, returns | Required, because the order cannot be fulfilled without it |
| Payment data | Payment method and result. The card number is entered directly with the payment provider; we do not see it or store it | Required to complete payment |
| Account data | Email, saved addresses, order history | Optional, because guest checkout is available |
| Messages | The content of your messages to us, and the photos you send so we can help you choose a shade | Optional |
| Reviews | Display name, review text, photos and video | Optional |
| Marketing subscription | Email or mobile number | Optional |
| Technical data | IP address, device and browser type, pages visited, cookie identifiers | Essential ones automatically; analytics and marketing ones only with your consent (Section 8) |
2.1 We collect this data directly from you, automatically from your device when you browse, or from payment and shipping providers to the extent needed to fulfil your order (such as payment status and shipment status).
2.2 We do not ask for sensitive data, such as health data or ID numbers. If you mention such information in a message, for example an allergy to an ingredient, we use it only to answer your question.
3. Purposes of processing and legal basis
| Purpose | Legal basis |
|---|---|
| Fulfilling the order: payment, preparation, shipping, invoicing, returns and exchanges | Performance of our contract |
| Order messages (confirmation, shipping and delivery) and customer service | Performance of the contract |
| Helping you choose a shade | Your request and consent |
| Newsletter and offers by email, WhatsApp or SMS | Your consent (Section 5) |
| Asking for a product review after delivery and publishing it | Your consent; you can stop these messages at any time |
| Measuring store visits and personalised ads | Your consent to cookies (Section 8) |
| Protecting the store and customers from fraud | The Company's legitimate interest, without prejudice to your rights |
| E-invoicing, keeping tax records and responding to official authorities | Legal obligation |
3.1 We do not sell your data, and we do not process it for any purpose not listed here unless we first inform you and obtain your consent where required.
3.2 We do not make any decision that affects your rights based solely on automated processing. Product recommendations in the store are based on what you view or add to your cart.
4. Who receives your data
4.1 We share only what is necessary, with parties acting on our behalf under contractual data-protection obligations:
| Recipient | Purpose | Data |
|---|---|---|
| Shopify (store platform) | Hosting the store and managing orders | Order, account and technical data |
| Licensed payment service providers | Processing payment | Payment data, name and email |
| Instalment (BNPL) providers | Instalments, when you choose them | Order and contact data |
| Storage and fulfilment providers, and shipping companies | Preparing and delivering the order | Name, mobile, address, order contents |
| E-invoicing provider | Issuing the tax invoice | Invoice data |
| Email and messaging providers | Newsletter, back-in-stock alerts and cart reminders | Email or mobile and shopping activity |
| Reviews provider | Requesting and publishing reviews | Name, email and review text |
| WhatsApp Business (Meta) | Replying to your messages | Mobile number and message content |
| Analytics and advertising tools on digital platforms | Measurement and ads, only with your consent | Technical data |
| Competent government authorities | Executing a lawful request or court ruling | Whatever is legally required |
4.2 We do not share your data with the manufacturer of Elian Russia products, or with any party for its own marketing purposes.
4.3 You can ask for the names of the parties that receive your data through the channels in Section 1.3. We update this table and the policy date whenever a new category of recipient is added.
4.4 The services the store currently uses: Shopify (platform, sign-up forms, email, search, translation and Looks bundles), Paymob (payments), Judge.me (reviews), and WhatsApp Business by Meta (replying to your messages).
5. Marketing messages
5.1 We send marketing messages only with your prior consent, and the sender is clearly identified in them (Elian Russia).
5.2 You can stop them at any time, free of charge: through the "Unsubscribe" link in every email, by replying "STOP" to the message, or by contacting us. We stop sending as soon as your request arrives.
5.3 Stopping marketing messages does not stop order and invoice messages, because they are part of performing the contract.
6. Our relationship with Shopify
6.1 Shopify hosts the store and processes your visit and order data to run it. Shopify may use some of this data in features that span several stores, and it is responsible for that processing. Details are in Shopify's Consumer Privacy Policy.
7. Transfers outside the Kingdom
7.1 Some of the recipients in Section 4, including Shopify and WhatsApp, process data on servers outside the Kingdom.
7.2 We transfer only the minimum needed for the purpose, in line with the rules and safeguards set by Saudi law for transferring personal data outside the Kingdom.
8. Cookies
| Type | What it does | Needs your consent? |
|---|---|---|
| Essential | Cart, sign-in, security, and saving your display language and privacy choices | No, because the store cannot work without it |
| Analytics | Knowing which pages are visited most, to improve the store | Yes |
| Marketing | Showing our ads on platforms and measuring their results | Yes |
8.1 The consent banner appears on your first visit, and you can change your choice at any time from the "Privacy settings" link at the bottom of the page or from your browser settings. Declining analytics and marketing cookies does not stop you from buying.
9. Retention and destruction
| Data | Retention period |
|---|---|
| Orders and invoices | The period required by applicable law, including tax and commercial law |
| Account | As long as the account exists; deleted on request, except what the law requires us to keep |
| Messages and complaints | The period needed to follow up the matter and protect both parties' rights |
| Shade-matching photos | The period needed to help you choose; deleted on request |
| Marketing subscription | Until you unsubscribe |
| Published reviews | As long as they are published; deleted on request |
9.1 When the period ends, we destroy the data or convert it into data that does not identify you.
10. Your rights
10.1 You have the right to:
Be informed: know the purpose of collecting your data and its legal basis.
Access: see the data we hold about you.
Obtain a copy: receive a copy of your data in a clear, readable format.
Correction: ask us to correct, complete or update your data.
Destruction: ask us to destroy data we no longer need, except what the law requires us to keep, such as invoices.
Withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.
10.2 Send requests through the channels in Section 1.3. We may ask for proof of identity before acting. We respond within no more than thirty days, which may be extended by another thirty days after informing you in advance of the reason.
10.3 Exercising your rights is free and does not affect how we treat you.
11. Data of minors
11.1 We take consent to marketing messages from minors only through their guardian.
11.2 A guardian may exercise the rights in Section 10 on their behalf, after proving guardianship.
12. Data security
12.1 Connections to the store are encrypted, payment is made with licensed payment providers, and access to your data is limited to those who need it to serve your order.
12.2 If a leak of your data occurs that could harm you, we notify the competent authorities within the statutory periods, and we notify you without delay and within no more than three days of becoming aware of it, explaining what happened and what we have done.
12.3 Please do not send your card details or passwords in messages. We will never ask you for them.
13. External sites
13.1 The store may contain links to sites or platforms we do not operate. Those sites are governed by their own privacy policies.
14. Complaints
14.1 Please contact us first through the channels in Section 1.3.
14.2 You have the right to file a complaint with the authority responsible for personal data protection (the Saudi Data & AI Authority, SDAIA), within the statutory period set for this.
15. Changes to this policy
15.1 We publish any change on this page and update the "Last updated" date. If the change is material, such as adding a new purpose, we notify you by email or by a clear notice in the store, and ask for your consent where the law requires it.