Last updated: 29 May 2026

Privacy Policy

OnlyRoses Kuwait operates this store and website, including all related information, content, features, tools, products, and services (the “Services”). This Privacy Policy describes how we collect, use, disclose, and protect your personal data when you visit our boutique, use our website, place an order, or otherwise communicate with us.

This Privacy Policy is informed by the CITRA Data Privacy Protection Regulation (DPPR), Decision No. 26 of 2024, issued by the Communication and Information Technology Regulatory Authority (“CITRA”) of the State of Kuwait, and the Electronic Transactions Law No. 20 of 2014 and Consumer Protection Law No. 39 of 2014, which together establish the applicable data protection framework for e-commerce operators in Kuwait.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal data. By using or accessing the Services, you acknowledge that you have read this Privacy Policy and understand how your information is collected, used, and disclosed.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

References in this Privacy Policy to “OnlyRoses”, “we”, “us”, and “our” mean Roots and Stems for Flowers and Plants Co. trading as OnlyRoses Kuwait. Our Services are hosted by Shopify Inc., which acts as a data processor on our behalf in respect of personal data processed through the Services.

2. What Personal Data We Collect

We collect only the personal data that is necessary for the purposes described in this policy. This may include:

• Identity & contact data: name, telephone number, email address, delivery address.
• Transaction data: details of products purchased, order history, payment confirmation references.
• Communication data: messages, WhatsApp conversations, emails, and other correspondence you send us, including personalised message requests for orders.
• Technical data: IP address, browser type and version, device identifiers, time zone, operating system, and pages visited on our website.
• Usage data: how you interact with our website, products you view, and navigation paths.
• Marketing preferences: your choices regarding receiving marketing communications from us.

We do not knowingly collect sensitive personal data (such as health, biometric, financial account, or religious data) in the ordinary course of our business.

3. How We Collect Your Data

We collect personal data in the following ways:

• Directly from you — when you place an order, create an account, contact us via WhatsApp, phone, or email, visit our boutique, or subscribe to communications.
• Automatically — through cookies and similar technologies when you browse our website.
• From Shopify — our platform provider collects certain technical and transactional data on our behalf as part of hosting and operating the store.
• From third parties — such as payment processors or analytics providers, in limited circumstances relevant to fulfilling your order or improving our services.

4. Legal Bases for Processing

We process your personal data only where we have a lawful basis to do so. In line with the CITRA DPPR and applicable Kuwaiti law, our processing is based on one or more of the following:

5. How We Use Your Data

We use your personal data only for the purposes for which it was collected. These include:

• Processing and fulfilling your orders, including arranging delivery and handling returns or complaints.
• Communicating with you about your order, delivery status, and any related enquiries.
• Managing your account (if you have created one) and maintaining our records.
• Sending you marketing communications, where you have given explicit consent to receive them.
• Improving our website, products, and services through analytics and usage data.
• Preventing fraud, ensuring the security of our website and systems, and complying with our legal obligations.
• Responding to regulatory requests or legal proceedings where required by law.

6. Sharing Your Data

We do not sell your personal data. We may share it with the following categories of recipients only to the extent necessary:

• Shopify Inc. — as our e-commerce platform provider and data processor. Shopify's privacy practices are described at shopify.com/legal/privacy.
• Payment processors — to securely handle payment transactions. We do not store full payment card details.
• Delivery team — our in-house drivers receive the minimum delivery information (name, address, phone number) needed to fulfil your order.
• Analytics and marketing tools — third-party services used to analyse website traffic and manage marketing, where you have consented to such use.
• Legal and regulatory authorities — where required by applicable Kuwaiti law, a court order, or a request from CITRA or another competent authority.
• Business transfers — in the event of a merger, acquisition, or sale of business assets, your data may be transferred to a successor entity, subject to equivalent privacy protections.

All third parties with whom we share personal data are required to handle it in accordance with applicable law and our instructions.

7. Data Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by Kuwaiti law. Our general retention periods are:

• Order and transaction records — retained for a minimum of 5 years from the date of the transaction to comply with commercial and tax record-keeping obligations.
• Account data — retained for the duration of your account and for 2 years after your last interaction with us.
• Marketing data — retained until you withdraw your consent or request erasure.
• Technical and usage data — typically retained for up to 12 months from collection.

When personal data is no longer required, we will securely delete or anonymise it in accordance with our data destruction procedures and the requirements of the CITRA DPPR.

8. Data Security & Breach Notification

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. Our website is hosted on Shopify's secure infrastructure, which employs industry-standard encryption and security controls.

In the event of a personal data breach, we will notify CITRA within 72 hours of becoming aware of the incident, in accordance with Decision No. 26 of 2024. Where the breach poses a high risk to the rights and freedoms of affected individuals, we will also notify those individuals without undue delay.

No transmission of data over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. Please contact us immediately at kuwait@only-roses.com if you suspect any unauthorised access to your personal data.

9. Cookies

Our website uses cookies and similar technologies to provide a functional browsing experience, remember your preferences, and help us understand how visitors use our site. Cookies may be set by us or by trusted third-party services such as Shopify, Google Analytics, or advertising platforms.

Non-essential cookies (such as analytics and marketing cookies) are only placed with your explicit consent, which you can manage via the cookie banner on our website. You may also control cookies through your browser settings at any time; however, disabling certain cookies may affect the functionality of the website.

For further information on Shopify's use of cookies, please see shopify.com/legal/cookies.

10. International Data Transfers

As our Services are hosted by Shopify Inc. (based in Canada), and we may use other third-party tools whose servers are located outside Kuwait, your personal data may be transferred to and processed in countries outside the State of Kuwait.

Where personal data is transferred internationally, we take steps to ensure it receives an adequate level of protection consistent with the requirements of the CITRA DPPR and applicable Kuwaiti law. This may include transferring data to jurisdictions recognised as providing adequate protection, or implementing contractual safeguards with the recipient. By using our Services, you acknowledge that your data may be processed in this way.

11. Your Rights

Under the CITRA Data Privacy Protection Regulation and applicable Kuwaiti law, you have the following rights in respect of your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to correction — you may ask us to correct inaccurate or incomplete personal data.
• Right to erasure — you may request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other lawful basis applies.
• Right to restriction — you may ask us to restrict the processing of your personal data in certain circumstances.
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to object to marketing — you may opt out of receiving marketing communications from us at any time by clicking the unsubscribe link in any email or contacting us directly.

To exercise any of these rights, please contact us at kuwait@only-roses.com, including your full name and the nature of your request. We will respond within a reasonable timeframe and in any event within 30 days.

For personal data processed by Shopify on our behalf, you may also direct requests relating to Shopify's own processing to privacy.shopify.com.

12. Children's Privacy

Our Services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at kuwait@only-roses.com and we will take prompt steps to delete such data.

13. Complaints

If you have a concern about how we handle your personal data, please contact us in the first instance at kuwait@only-roses.com. We will do our best to address your concern promptly.

If you are not satisfied with our response, you have the right to lodge a complaint with the Communication and Information Technology Regulatory Authority (CITRA), the supervisory authority for data privacy matters in Kuwait. Further information is available at citra.gov.kw.

14. Third-Party Links

Our website may contain links to third-party websites. This Privacy Policy applies only to our Services. We have no control over and accept no responsibility for the privacy practices of third-party websites. We encourage you to review the privacy policy of any site you visit.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The current version will always be published on this page with the date of last update. We encourage you to review this policy periodically. Material changes will be communicated to you where reasonably practicable.

16. Contact

For any questions or requests relating to this Privacy Policy or the personal data we hold about you, please contact us:

OnlyRoses Kuwait is a trading name of Roots and Stems for Flowers and Plants Co. (شركة روتس اند ستيمز للزهور والنباتات), a single-person company registered in the State of Kuwait. Commercial Registration No. 366800. © 2026 OnlyRoses Kuwait. All rights reserved.