Protecting You.

PRIVACY POLICY

PADDY HANLEY

Effective date: 13 October 2026

1. Introduction

Paddy Hanley (“Paddy Hanley”, “we”, “us” or “our”) is committed to respecting your privacy and protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you visit our website, purchase our products, subscribe to our communications or otherwise interact with our business.

Paddy Hanley is a luxury candle and home fragrance brand founded in 2026 in Abu Dhabi, United Arab Emirates.

This policy applies to our website, online store, customer communications and related e-commerce services. It should be read alongside our Terms of Service and other applicable store policies.

For the purposes of applicable data protection legislation, Paddy Hanley is responsible for determining how and why personal information is processed in connection with its business, subject to the respective roles and obligations of our service providers.

By using our website, you acknowledge the practices described in this policy. Where consent is required by law, we will obtain it separately. Visiting our website does not, by itself, constitute consent to every form of data processing described below.

2. Personal Information We Collect

The personal information we collect depends on how you interact with Paddy Hanley.

2.1 Information you provide directly

When you place an order, contact us, subscribe to our newsletter or use a feature of our website, we may collect:

  • Identity information: your name and, where relevant, the name of a recipient.

  • Contact information: your email address, telephone number and billing or delivery address.

  • Order information: the products purchased, quantities, order history, delivery instructions and relevant transaction records.

  • Customer service information: correspondence, enquiries, feedback, complaints and information you choose to provide when contacting us.

  • Marketing preferences: your newsletter subscription status and communication preferences.

  • Personalisation information: names, messages or other details you voluntarily submit when requesting a personalised product or service.

  • Account information: information associated with a customer account, if account functionality is available.

Please provide only the information reasonably necessary for your transaction or enquiry.

2.2 Information collected automatically

When you visit our website, certain information may be collected automatically by our website platform and, where enabled, our service providers. This may include:

  • Internet Protocol (IP) address and approximate location derived from it.

  • Browser type, operating system and device characteristics.

  • Pages visited, products viewed and interactions with website features.

  • Referring websites and the source of your visit.

  • Session identifiers, cookie data and similar technical information.

  • Website performance, error reports and security-related information.

We use this information, where appropriate, to operate the website, maintain security, understand website performance and improve the customer experience.

2.3 Information received from third parties

We may receive information from payment processors, delivery providers, Shopify and other service providers where it is necessary to process orders, confirm transactions, prevent fraud, administer customer requests or provide our services.

We do not assume that every third-party service collects the same categories of information. The information processed will depend on the service used and your interaction with it.

3. How and Why We Use Personal Information

We process personal information only for appropriate purposes and on a lawful basis where required by applicable law.

Purpose Examples of use
Order fulfilment Processing purchases, arranging delivery, issuing receipts and administering returns or refunds.
Customer service Responding to enquiries, resolving complaints and providing assistance.
Website operation Maintaining functionality, remembering necessary preferences and troubleshooting technical issues.
Security and fraud prevention Investigating suspicious transactions, protecting the website and preventing unauthorised activity.
Marketing Sending newsletters, collection announcements and promotional messages where legally permitted.
Business administration Maintaining appropriate transaction, accounting and operational records.
Legal compliance Meeting applicable legal obligations and establishing, exercising or defending legal claims.
Website analysis and advertising Measuring performance or evaluating marketing effectiveness where relevant tools are used and the processing is lawful.

We will not knowingly use personal information for an unrelated purpose that is incompatible with the original purpose without an appropriate legal basis or other measure required by law.

4. Legal Grounds for Processing

Where applicable law requires us to identify a legal basis for processing, we may rely on the following grounds:

Performance of a contract. Processing necessary to accept and fulfil your order, arrange delivery, administer a refund or provide a service you have requested.

Compliance with legal obligations. Processing necessary to satisfy applicable accounting, tax, regulatory or other legal requirements.

Consent. Processing based on your freely given consent, including where required for certain marketing communications or non-essential cookies and tracking technologies.

Legitimate interests. Processing necessary for legitimate business purposes, such as maintaining website security, preventing fraud, responding to customer enquiries or improving our services, where permitted by law and subject to applicable safeguards.

The legal basis will depend on the particular activity and the law applicable to it. We will not rely on consent where another legal basis is more appropriate merely to avoid explaining the actual purpose of processing.

Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect processing lawfully carried out before withdrawal.

5. Payments and Checkout

Payments are processed through the payment methods and payment service providers made available at checkout.

Depending on the payment method selected, your payment information may be collected directly by the relevant payment provider or processed through Shopify's payment infrastructure.

Payment providers may process information such as card details, billing information, transaction identifiers and fraud-prevention data in accordance with their own responsibilities and privacy policies.

Paddy Hanley receives or accesses transaction information to the extent necessary to confirm payment, fulfil orders, administer refunds, maintain records and address payment-related enquiries.

We do not intend to store full payment card numbers or card security codes in our own customer records.

Payment transactions may be subject to security checks, verification procedures and the payment provider's terms. We cannot guarantee the security of systems operated independently by third parties.

6. Shopify and Other Service Providers

Our online store is powered by Shopify, which provides e-commerce infrastructure and related services.

To operate our business, we may use third-party providers for:

  • E-commerce hosting and store functionality.

  • Payment processing and transaction security.

  • Shipping, delivery and order fulfilment.

  • Customer communications and email marketing.

  • Website analytics and performance measurement.

  • Advertising and social media integrations.

  • Customer support and technical maintenance.

The particular providers involved will depend on the services enabled in our store.

These providers may process personal information to deliver their services, fulfil contractual obligations, comply with applicable law or perform other activities permitted under their own terms and applicable privacy legislation.

Some providers act on our behalf, while others may process information under their own independent responsibilities. Their precise roles depend on the service and processing activity.

We encourage customers to review Shopify's privacy information and the privacy policies of relevant third-party providers where appropriate.

7. Disclosure of Personal Information

We do not sell personal information to third parties in exchange for monetary payment.

We may disclose personal information where reasonably necessary for the purposes described in this policy, including to:

  • Service providers assisting with the operation of our business.

  • Payment processors and financial institutions involved in transactions.

  • Delivery providers responsible for transporting orders.

  • Professional advisers providing legal, accounting or other professional services.

  • Regulatory authorities, courts, law enforcement agencies or other recipients where disclosure is required or legally justified.

  • Relevant parties in connection with a proposed or completed business sale, restructuring or transfer, subject to applicable legal requirements.

Where advertising or analytics technologies are enabled, certain information may also be disclosed to the relevant technology providers. Depending on the circumstances and applicable law, this may constitute a regulated form of data sharing even where no money changes hands.

We will not represent that advertising-related data sharing never occurs without first verifying the services and settings used on our website.

8. Cookies and Similar Technologies

Our website may use cookies, pixels, local storage and similar technologies.

Cookies are small files stored on your device that can support website functionality, remember preferences or collect information about browsing activity.

Depending on the technologies enabled, cookies and similar technologies may be used for:

  • Essential functionality: enabling checkout, maintaining shopping cart contents and supporting website security.

  • Preferences: remembering settings and improving your browsing experience.

  • Analytics: measuring traffic, identifying technical issues and understanding website usage.

  • Advertising: measuring campaigns, personalising advertisements or supporting advertising across services.

Essential technologies may be necessary for the website to operate. Other technologies will be subject to applicable consent and opt-out requirements.

Where required, we will seek your consent before activating non-essential cookies or similar technologies. You may change your preferences through the cookie controls made available on our website, where provided.

You may also manage cookies through your browser. However, blocking certain cookies may affect website functionality, including checkout.

The specific cookies and technologies in use may change as our website and service integrations develop.

9. Marketing and Customer Communications

We may send transactional communications necessary to administer your purchases, including order confirmations, delivery updates, refund notifications and responses to customer enquiries.

Where permitted by law, we may also send marketing communications about Paddy Hanley products, new collections, product releases and other relevant brand news.

We will obtain consent where required and honour applicable marketing preferences.

You may unsubscribe from promotional emails at any time using the unsubscribe link included in the message or by contacting us directly.

Unsubscribing from marketing communications does not prevent us from sending necessary transactional or service-related messages.

Where applicable, you may also object to direct marketing or withdraw consent for associated processing. We will respect such requests in accordance with applicable law.

10. International Transfers of Personal Information

Paddy Hanley operates from the United Arab Emirates and uses an online commerce platform that may involve service providers or infrastructure located in other countries.

Consequently, personal information may be transferred to, stored in or accessed from jurisdictions outside the UAE, depending on the services used and the location of the relevant provider.

International transfers will be handled in accordance with applicable data protection requirements, including any applicable conditions, safeguards or authorisation requirements.

Where required, appropriate measures will be taken to protect personal information transferred internationally.

The level of statutory protection available in another jurisdiction may differ from that provided in the country where you reside.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal obligations.

Retention periods depend on the type of information, the purpose of processing and any relevant statutory requirements.

For example:

  • Order and transaction records may be retained for accounting, tax, dispute-resolution and legal purposes.

  • Customer correspondence may be retained for as long as necessary to resolve an enquiry or maintain an appropriate service record.

  • Marketing information may be retained while a subscription remains active and as necessary to maintain suppression records and respect unsubscribe requests.

  • Technical and security information may be retained for an appropriate period to maintain website integrity and investigate potential misuse.

Where information is no longer necessary, we will take reasonable steps to delete it, anonymise it or otherwise dispose of it securely, unless retention is required or permitted by law.

We do not promise a single fixed retention period for all information because different records may be subject to different requirements.

12. Data Security

We take reasonable technical and organisational measures appropriate to the nature of the personal information we process and the risks involved.

These measures are intended to reduce the risk of unauthorised access, disclosure, alteration, loss or destruction.

We also seek to use reputable service providers and appropriate platform security features when operating our online store.

No electronic transmission, website or storage system can be guaranteed to be completely secure. Accordingly, we cannot promise absolute security.

If a personal data breach occurs, we will assess the incident and take appropriate action, including any notification required by applicable law.

13. Your Privacy Rights

Depending on the laws applicable to you and the circumstances of the processing, you may have the right to:

  • Request confirmation of whether we process your personal information.

  • Request access to personal information we hold about you.

  • Request correction of inaccurate or incomplete information.

  • Request deletion of personal information where legally available.

  • Request restriction of, or object to, certain processing activities where applicable.

  • Withdraw consent where processing is based on consent.

  • Object to direct marketing.

  • Request a portable copy of certain information where applicable.

  • Lodge a complaint with the relevant data protection authority.

These rights are not absolute and may be subject to legal conditions, exceptions and limitations.

Where applicable, individuals in the UAE may exercise the rights available under the UAE's personal data protection framework. Individuals in other jurisdictions may have additional or different rights depending on the legislation applicable to them.

To submit a request, contact us using the details in Section 17. Please describe your request clearly. We may need to verify your identity before disclosing, correcting or deleting information.

We will respond within the period prescribed by applicable law. If we cannot fulfil a request, we will explain the position where legally required.

14. Children's Privacy

Our website is intended for a general consumer audience and is not designed to knowingly collect personal information from children in circumstances where parental consent or other legal requirements apply.

We do not knowingly collect children's personal information unlawfully.

If you believe a child has provided personal information to us inappropriately, please contact us. We will assess the circumstances and take appropriate action in accordance with applicable law.

15. Third-Party Websites and Social Media

Our website or communications may contain links to third-party websites and platforms, including social media services.

Once you leave our website or interact with a third-party service, that service may collect and process information under its own privacy policy and terms.

Paddy Hanley does not control the privacy practices of third-party websites that it does not operate. We encourage you to review their privacy information before providing personal information.

16. Changes to This Policy

We may revise this Privacy Policy to reflect changes in our business, website, technology, service providers or legal obligations.

The latest version will be published on this page, together with its effective or last-updated date.

Where a change materially affects the way we process personal information, we will provide additional notice or obtain consent where required by applicable law.

We encourage you to review this policy periodically.

17. Contact Information

For questions about this Privacy Policy, requests relating to personal information or concerns about how your information is handled, please contact:

Paddy Hanley

Location: Abu Dhabi, United Arab Emirates

Email: [Insert official customer service email address]

Registered legal entity or business name: [Insert exact legal name, if applicable]

Registered business address: [Insert address, where applicable]

Please do not include payment card details, passwords or other sensitive information in ordinary email correspondence.

We will review privacy requests and respond in accordance with applicable law.

Paddy Hanley

A story of scent, place and memory.

Founded 2026 · Abu Dhabi