Privacy Policy UAE
See also Terms of Sale, Terms of Use, Refund Policy, Tax Strategy & Cookie Policy
PRIVACY AT A GLANCE
We collect information about you to process your orders, manage your account, respond to your queries, operate and secure our business, and, if you consent, send you information about our products and offers tailored to your interests.
We share your information with service providers and affiliates for these purposes, and with authorities where required by law. We do not share your personal information for marketing with unrelated third parties without your consent.
To understand your rights and how we use your personal data in detail, please read the full Privacy Notice below.
1. INTRODUCTION
Welcome to Graff’s Privacy Notice for the United Arab Emirates. Graff respects your privacy and is committed to protecting your personal data. This Privacy Notice explains the types of personal data we collect through our websites, in-store interactions, by phone, and how we use, share, transfer and protect it in line with applicable laws including the UAE Personal Data Protection Law (PDPL).
2. WHO CONTROLS AND PROCESSES YOUR DATA
Controller: Graff Diamonds Limited
Address: 28-29 Albemarle Street, London, W1S 4JA, United Kingdom
Contact: data@graff.com
Graff Diamonds Limited (referred to as “Graff”, “we”, “us”, “our”) determines the purposes and means of processing your personal data.
3. PERSONAL DATA WE COLLECT
We may collect:
a. Information you provide directly:
• Name, address, email, phone number, date of birth, demographic information, account and order details.
• Correspondence records if you contact us.
• Identification details when required for purchase, delivery or legal compliance.
b. Usage, device and technical data:
• IP address, browser type, access times, referral URLs.
• Cookies and similar technologies (see our Cookie Policy).
• Location data if you opt in where offered.
We do not collect more data than necessary for the purposes described here.
4. HOW AND WHY WE USE YOUR PERSONAL DATA
We process your personal data on one or more of these legal bases:
Contract Performance: to take and fulfil your orders, deliver products, communicate about your purchases, manage payments and invoices.
Legitimate Interests: to administer and improve our services; to detect fraud and protect our platforms and customers; to manage complaints and business operations where it does not override your rights.
Consent: for marketing, profiling and analytics where you have explicitly agreed.
Legal Obligations: to comply with UAE laws or respond to lawful requests from court, regulators or law enforcement.
We use your data for, among other things:
• Order processing and delivery
• Customer service and account management
• Responding to enquiries
• Business administration
• Fraud prevention and security
• Marketing where you have consented
• Legal compliance
Where marketing is based on consent, you may withdraw that consent at any time.
5. WHO WE SHARE YOUR PERSONAL DATA WITH
We may share your personal data with:
• Service providers acting on our behalf (e.g. delivery, payments, marketing, IT and analytics).
• Affiliates and related companies.
• Regulatory authorities or law enforcement where required by law.
• Parties involved in corporate transactions (e.g. mergers or asset sales).
We require all third parties to protect your personal data and restrict its use to what we authorise.
6. DATA TRANSFERS OUTSIDE THE UAE
Your information may be transferred outside the UAE and the EEA. Where transfers occur, we ensure appropriate legal safeguards are in place (for example, data transfer agreements or other measures to meet legal requirements).
7. DATA RETENTION
We keep your personal data only as long as necessary for the purposes outlined in this Notice, to comply with legal obligations, resolve disputes, enforce agreements, and for legitimate business needs.
For example, order records are generally kept for the duration of the customer relationship plus a statutory period required by UAE law.
8. YOUR RIGHTS UNDER UAE LAW
Under applicable laws including the UAE PDPL, you may be entitled to:
• Access your personal data.
• Rectify inaccuracies.
• Request erasure where lawful to do so.
• Restrict or object to processing (including direct marketing).
• Withdraw consent where processing is based on consent.
• Request portability of your personal data.
To exercise these rights, contact us at data@graff.com. We may ask you to verify your identity before responding. If you believe we processed your data unlawfully, you have the right to lodge a complaint with the UAE Data Office or other competent authority.
9. COOKIES AND SIMILAR TECHNOLOGIES
Please see our separate Cookie Policy for details on the cookies we use, why we use them and how to control them.
10. SECURITY OF YOUR PERSONAL DATA
We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, misuse, alteration or destruction.
11. CHANGES TO THIS PRIVACY NOTICE
We may update this policy to reflect changes in law, technology, or our business. We will post updates on our website with the revised effective date.
Effective date: February 2026