Privacy policy
Effective 26 October 2026
This Privacy Policy explains how Nexora Ventures L.L.C-FZ, trading as NouraHair, collects, uses and protects personal data when you visit nourahair.com, create an account, place an order, subscribe to emails or contact us. It covers our customers and website visitors in the United Arab Emirates, European Union and United Kingdom.
The privacy laws applicable to particular processing determine your rights, including UAE data protection law, the EU General Data Protection Regulation and the UK General Data Protection Regulation where they apply. Accepting our Terms and Conditions or reading this policy does not amount to consent to marketing, optional tracking or other processing that requires a separate choice.
1. Who is responsible for your personal data
Nexora Ventures L.L.C-FZ is the controller responsible for the uses of personal data described in this policy. Our trade licence number is 2652543.01 and our registered address is Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
For privacy enquiries and requests, email privacy@nourahair.com or write to our registered address marked for the privacy team. For order enquiries, cancellations, refunds and product issues, email refunds@nourahair.com. Our website is https://nourahair.com.
2. Personal data we collect
Contact and delivery information includes your name, email address, telephone number, billing address, delivery address and the details of a person receiving an order on your behalf. Account information includes your account identifier, protected login credentials, saved addresses, preferences and order history.
Order and support information includes the products purchased, quantities, prices, currency, order references, payment confirmation, delivery updates, refunds, returns, enquiries and correspondence. If you report a product issue, it may include photographs of the product or packaging, batch codes and your description of the problem.
Technical and usage information includes IP address, browser and device information, website requests, security logs and, where permitted, cookie identifiers, pages viewed, shopping events and advertising interactions. Optional Google Analytics and TikTok tracking are subject to your consent choices, as explained below.
Subscription information includes your email address, subscription preferences, when and how you subscribed, the wording presented when you gave permission and any withdrawal of consent. We do not require marketing permission as a condition of shopping.
If you report an allergic reaction or another product safety concern, your message may contain health information. Please provide only what is necessary. We do not require unrelated medical records or sensitive photographs to consider an ordinary refund.
3. How we obtain personal data
We obtain information directly from you through checkout, account registration, subscription forms, customer service enquiries and other communications. We also receive information needed to administer an order from payment providers, delivery partners and fulfilment centres, such as payment confirmation, delivery status and return updates. Technical information is generated when you use the website and its security systems.
If you provide another person’s delivery details, make sure they know those details are being provided for delivery and related support and can read this policy. We do not subscribe a gift recipient to promotional emails. We provide privacy information directly to people whose details are supplied by someone else where required by law.
You must provide the information reasonably needed to process payment, deliver your order or meet a stated legal requirement. If you do not, we may be unable to fulfil the purchase. Other information, including marketing permission, is optional. We explain additional mandatory information, such as required customs details, when requesting it.
4. Why we use personal data and our legal grounds
Orders and customer service. We use contact, order and delivery information to process purchases, send order updates, supply products, arrange delivery, handle returns and refunds and respond to your enquiries. Under EU and UK GDPR, the legal basis is performance of our contract with you or taking steps you request before entering a contract. For a recipient who is not the purchaser, we rely on our legitimate interest in delivering the purchaser’s order, balanced against the recipient’s rights.
Accounts. We use account information to provide the account service you request, including saved details and access to your orders. The legal basis under EU and UK GDPR is performance of that requested service, with legitimate interests supporting proportionate account security. Closing an account does not cancel an existing order or remove separate lawful recordkeeping obligations.
Security and fraud prevention. We use proportionate technical and transaction information to protect customers and the store, investigate misuse and prevent fraud. Under EU and UK GDPR, we rely on our legitimate interests in secure trading and protecting people and property, except where another basis is required. We assess whether those interests are outweighed by your rights and limit the information used accordingly.
Legal records and product safety. We retain necessary accounting and transaction records, respond to lawful requests, investigate product safety concerns and support recalls. We rely on legal obligations where applicable. Where a foreign legal requirement does not qualify as an EU or UK GDPR legal-obligation basis, we assess another permitted basis, such as legitimate interests in lawful business administration. We use relevant information to establish, exercise or defend legal claims where necessary.
Email subscriptions. If you subscribe to ongoing promotional emails, we use your email address, preferences and consent record to send product news, offers and updates. The basis is consent, and the service operates only where local law permits it. If you joined under the earlier promise of a single launch email, that permission covers only that message unless you separately subscribe to ongoing promotions.
Analytics and advertising. With the required consent, Google Analytics helps us understand website use and improve the store. TikTok tools help measure campaigns and, where the selected features apply, support relevant advertising. These uses can involve device identifiers, shopping activity and advertising interactions. Optional tracking and related profiling depend on your choices; essential service and security logs support our legitimate interests in operating a reliable, secure store.
For processing governed by UAE law, we rely on consent unless a specific lawful exception applies, including processing necessary for our contract with you, applicable legal obligations or qualifying legal proceedings. An EU or UK legitimate-interest basis is not, by itself, a UAE exception. We do not treat consent as overriding any legal prohibition on a particular use of data.
5. Payments and card information
We accept Visa and Mastercard credit and debit cards. Payments are processed by a third-party provider certified to the Payment Card Industry Data Security Standard, commonly called PCI DSS. Full card information is processed by the payment provider; the NouraHair website does not hold or store card numbers, expiry dates or card security codes.
We may retain the order total, payment status, transaction reference and refund record needed to administer your purchase. These transaction records are separate from your card details. Payment providers and banks may process information independently for authorisation, fraud prevention and their legal obligations. Information about the payment service is provided through the payment process, and you may contact us for further details about the provider handling your transaction.
Never send your full card details or account password to customer service or include them in a product photograph, return request or email.
6. Sharing information and order fulfilment
We share only the information necessary for the relevant purpose with the following categories of recipients. Website hosting and ecommerce providers process technical, account and order information to run the store; this includes Framer for the website. Payment processors and banks handle payment and transaction information to authorise purchases, prevent fraud and process refunds. Account, IT and support suppliers process the information needed to maintain the service and respond to customers.
Warehouses, couriers and customs intermediaries receive the recipient’s name, delivery address, necessary contact information, order contents and relevant delivery or return instructions. They do not need your account password or full card details. Orders are fulfilled through logistics centres in the EU and UK, and the centre assigned to an order may vary. Nexora remains the seller responsible for your order.
EU order dispatch address: [EU fulfilment address pending confirmation].
This is a product fulfilment location. Privacy enquiries should be sent to privacy@nourahair.com. Return addresses and collection instructions are confirmed separately by email for the relevant order.
Email delivery and subscription providers process the contact, subscription and message information needed to send service emails and permitted promotional emails. Google Analytics and TikTok receive the usage, device and event information needed for the optional services you allow. They may act as processors or independent controllers depending on the service and its contractual arrangements. Their wider privacy practices are explained in their own notices.
We require suppliers acting as processors to handle personal data under appropriate instructions, confidentiality and data protection terms. Some recipients, such as banks and couriers for certain activities, have their own legal responsibilities as independent controllers.
Where necessary and legally justified, we may share relevant information with professional advisers, insurers, regulators, courts or law enforcement bodies. Information may also be disclosed in a genuine business sale or restructuring, subject to confidentiality, data minimisation and applicable law. We will provide notice of a change of controller where required. We do not sell or rent customer contact lists or give them to unrelated businesses for their own marketing.
Information about Google’s handling of data is available at https://business.safety.google/privacy/. TikTok’s business privacy information is available at https://ads.tiktok.com/i18n/official/policy/privacy. Framer’s privacy information is available at https://www.framer.com/legal/privacy-statement. You may contact us for information about the service providers receiving your data and their role in a particular order or enquiry.
7. International processing and safeguards
Nexora operates from the UAE and uses EU and UK fulfilment centres. Your information may therefore be accessed or processed in the UAE, EU and UK. Technology and payment providers operate internationally, so their services may also involve processing in other countries. A parcel’s dispatch country does not determine where all order or website data is processed.
We permit international transfers only in accordance with applicable data protection law. Where EU or UK transfer restrictions apply, a transfer requires an applicable adequacy decision or another permitted mechanism. Where there is no applicable adequacy decision, the required protections may include the European Commission’s standard contractual clauses and, for UK transfers, the UK International Data Transfer Agreement or UK Addendum, together with any necessary assessment and additional safeguards. We do not assume that the UAE benefits from an EU or UK adequacy decision.
Transfers subject to UAE law must also meet its requirements. We do not rely on acceptance of this policy as blanket consent to international transfers. To ask where your information is processed, which transfer mechanism applies or how to obtain a copy of relevant safeguards, email privacy@nourahair.com. Copies may be subject to lawful redactions protecting confidential information and other people’s rights.
8. Cookies and similar technologies
Cookies and similar technologies can store information on, or access information from, your device. Necessary technologies support functions such as basket contents, secure sessions, checkout and recording privacy choices. Optional analytics and advertising technologies, including Google Analytics and TikTok tools, help us understand visits, measure campaigns and support relevant advertising.
Optional technologies are enabled only after you choose to allow them. You can accept or reject optional categories through the website’s cookie controls and later change your choices there. We do not treat continued browsing, creating an account or accepting the Terms and Conditions as consent. Refusing optional tracking does not prevent ordinary shopping.
Cookie information presented with the consent controls explains the technologies offered, their providers, purposes and durations. Some technologies last for a browser session; others remain until their stated expiry or until you delete them. You can also use browser settings to manage stored cookies, although blocking necessary cookies may affect the basket, sign-in or checkout. Deleting a cookie does not itself delete personal data already lawfully collected.
For help with cookie choices or information about the technologies used, email privacy@nourahair.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. We stop consent-based tracking when permission is withdrawn, subject to the technical steps needed to apply your choice.
9. Promotional emails and your choices
Ongoing promotional emails are sent to people who separately subscribe to them, where permitted by applicable law. You can unsubscribe at any time using the link in a promotional email or by contacting privacy@nourahair.com. We retain only the limited suppression information necessary to respect an unsubscribe request and any separately justified consent record.
Order confirmations, delivery updates, refund messages, security notices and other necessary service communications are separate from marketing. Unsubscribing from promotions does not prevent those service messages. We do not automatically enrol purchasers, account holders or gift recipients in promotional subscriptions.
10. How long we keep information
We keep personal data only for as long as necessary for the purpose for which it was collected. We determine retention by considering the account or customer relationship, applicable tax and accounting rules, consumer claims and limitation periods, product safety duties and proportionate security or dispute needs. We then delete the information or anonymise it so that it no longer identifies you.
Account data is retained while the account service is requested and for any necessary closure process. Necessary transaction and financial records may remain after account closure to meet legal recordkeeping, refund, safety or claims requirements. Enquiry and return records are kept for handling the issue and a justified follow-up or claims period. Security logs are retained for a limited period appropriate to the risks investigated.
Subscription information is retained while you remain subscribed, subject to periodic review. A one-off launch list is deleted after the promised message and a short delivery-handling period unless a separate service was requested or limited retention is justified to demonstrate permission or honour a withdrawal. A legal hold extends retention only for relevant records, not all customer data. You may ask us which period or legal requirement applies to your information.
11. Product reactions and sensitive information
Health information in a reaction report receives additional protection. We use only what is necessary to investigate the concern, respond to you, handle a claim or meet applicable safety requirements. Under EU and UK GDPR, we must have both a general legal basis and an applicable special-category condition, such as explicit consent or necessity for establishing, exercising or defending legal claims.
Where explicit consent is required, we request it separately and explain the purpose and withdrawal process. Sending an ordinary enquiry is not blanket explicit consent to all uses of health information. Any other applicable condition must be established before that use takes place. UAE requirements also apply where relevant. Access to sensitive reports is limited to people who need the information for the relevant purpose.
12. Security and automated checks
We use technical and organisational measures appropriate to the nature of the information and the risks, including access controls and limits on who can handle customer information. No online system can guarantee absolute security. We investigate personal data breaches and make required notifications under applicable law.
Keep your login details private and contact us promptly if you suspect unauthorised account access. We will not ask you to email your password or full card details.
Payment authorisation and fraud prevention may involve automated checks by payment providers or security services. These checks assess information relevant to whether a transaction is authorised or presents a fraud risk; the outcome can delay or prevent a payment or order. If a check affects your order, contact us to seek an explanation, provide relevant information, contest an outcome or request human review where applicable. We will review our handling of the order and help direct any request concerning the provider’s decision to the appropriate party. Any solely automated decision with a legal or similarly significant effect must meet the additional conditions and safeguards required by applicable law; acceptance of this policy does not waive those protections.
13. Your rights and complaints
Depending on applicable law and circumstances, you may request access to your personal data, correction, deletion, restriction of processing or a portable copy. You may withdraw consent at any time without affecting earlier lawful processing. These rights are subject to lawful conditions and exceptions; for example, we may need to retain a legally required invoice after closing an account.
Your right to object. Where EU or UK GDPR applies, you may object to processing based on legitimate interests for reasons relating to your situation. You may object to direct marketing at any time, including profiling connected to that marketing; we will stop that marketing. These rights are separate from cancelling an order or closing an account.
To make a request, email privacy@nourahair.com or write to our registered address. We may seek proportionate information to verify identity but will not routinely require unnecessary identity documents. Requests are normally free. For EU and UK GDPR requests, we generally respond within one month, subject to lawful rules on identification, clarification, extensions and exceptions. Other applicable deadlines also apply. We explain any lawful extension or refusal.
You may complain to the UK Information Commissioner’s Office at https://ico.org.uk, an EU supervisory authority in your habitual residence, workplace or the place of an alleged infringement, or the competent UAE data protection authority where UAE law applies. EU authority contacts are available through https://www.edpb.europa.eu. You do not have to contact us before approaching an authority.
14. Children
Our store and account service are intended for adults aged 18 and over. We do not knowingly seek children’s personal data. Contact us if you believe a child has provided information so we can investigate and take appropriate action.
15. Changes to this policy
We may update this policy when the store, providers or legal requirements change. The date at the beginning identifies the latest revision. We bring material changes to your attention where required and obtain new permission before a new use that requires consent. Posting a revised policy does not itself provide that consent.
16. Contact us
For questions about this policy or your personal data, email privacy@nourahair.com. For orders, returns or other customer service matters, email refunds@nourahair.com. You can also write to Nexora Ventures L.L.C-FZ, Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
