Privacy policy

3.1 Scope and responsibility

This policy explains how Crion collects, uses, stores, and shares personal data through its website, orders, customer support, WhatsApp, social-media interactions, custom-printing services, analytics, and advertising activities.

Crion is responsible for the personal data it controls. Third-party providers may separately control data they collect directly under their own privacy notices.

3.2 Personal data we collect

Depending on how you interact with us, we may collect:

  • identity and contact information, such as your name, phone number, email address, and delivery address;
  • order information, including products, custom specifications, amounts, payment status, delivery details, invoices, returns, and refunds;
  • limited payment and transaction information supplied by KlickPay, such as payment status, transaction reference, method, and fraud or verification results, but not your complete card credentials;
  • account information if you create a customer account;
  • messages, support enquiries, complaints, reviews, and communications through email, phone, WhatsApp, or social media;
  • custom-project content, including uploaded models, design files, images, measurements, instructions, approvals, and revisions;
  • device, browser, IP-address, cookie, referral, interaction, and website-usage information; and
  • consent and preference records, including analytics, advertising, and communication choices.

3.3 How we collect data

We collect data directly from you and automatically through the website. We may also receive data from Shopify, KlickPay, delivery providers, Meta services, Google services, WhatsApp, social-media platforms, banks or payment networks, and other service providers involved in your transaction or interaction.

3.4 Why we use personal data

We use personal data where permitted by applicable law to:

  • provide the website and respond to enquiries;
  • create and manage orders and customer accounts;
  • assess, quote, design, approve, manufacture, and support custom projects;
  • process and reconcile payments, refunds, disputes, and chargebacks;
  • arrange delivery and provide order or production updates;
  • confirm identity, prevent fraud, secure the website, and protect customers and Crion;
  • handle returns, defects, complaints, and customer service;
  • maintain business, accounting, complaint, and transaction records;
  • comply with legal, regulatory, tax, court, and authority requirements;
  • measure website use and improve our store using consented analytics where required; and
  • measure advertising, build audiences, and improve marketing using Meta Pixel or similar technologies only where an appropriate legal basis and required consent exist.

We do not currently send promotional email, SMS, or WhatsApp marketing unless you have requested it or expressly opted in. Transaction and service messages are not promotional marketing.

3.5 Cookies and similar technologies

We may use:

  • strictly necessary technologies, required for core store functions such as security, cart, checkout, account access, and payment;
  • analytics technologies, including Google Analytics, to understand visits and website performance; and
  • marketing technologies, including Meta Pixel, to measure advertisements, attribute actions such as product views or WhatsApp-link clicks, and improve advertising audiences.

Google Search Console may provide aggregated search-performance information and does not ordinarily require a visitor-facing cookie by itself.

Where consent is required, non-essential analytics and marketing technologies will not be activated until you make a choice. You can change or withdraw your choice through the store’s privacy or cookie controls. Blocking some technologies may affect non-essential features but should not prevent core shopping functions.

3.6 When we share personal data

We may share only the data reasonably necessary with:

  • Shopify, which hosts and operates store functions;
  • KlickPay, banks, payment networks, and financial-service providers for payments, fraud prevention, refunds, and disputes;
  • licensed or otherwise lawfully operating external delivery companies for fulfilment;
  • Google, for consented analytics and related services;
  • Meta, including Facebook, Instagram, Meta Pixel, and WhatsApp, for communications, advertising measurement, and consented marketing functions;
  • hosting, technology, security, professional, accounting, and customer-support providers;
  • competent government, regulatory, law-enforcement, judicial, or tax authorities where required; and
  • a lawful successor in connection with a genuine restructuring, sale, or transfer of the business, subject to appropriate safeguards.

We do not sell personal data for money. Advertising and analytics disclosures may still be treated as sharing or processing under some privacy rules, so we provide appropriate notice and choice where required.

3.7 International data transfers

Some service providers may process or store data outside Kuwait. Where personal data is transferred internationally, we take reasonable steps to use providers and safeguards appropriate to the nature of the data and the applicable legal requirements.

3.8 Retention

We retain electronic order and transaction records for at least five years where required for digital-commerce, accounting, legal, or regulatory purposes. Complaint records are retained for at least six months. Other personal data, including custom-project files and communications, is kept only for as long as reasonably necessary for the purpose collected, to provide support, protect legal rights, or meet a legal obligation, after which it is deleted or anonymized where practicable.

3.9 Your choices and rights

Subject to applicable Kuwait law and lawful exceptions, you may ask us to provide information about personal data we hold about you, correct inaccurate data, delete data that is no longer required, restrict or object to certain processing, or withdraw consent for future consent-based processing.

You may also opt out of promotional communications at any time. Withdrawing consent does not affect processing already lawfully completed and does not prevent us from retaining information that the law requires us to keep.

To make a request, email support@crionkw.com. We may need to verify your identity before acting on a request.

3.10 Security and data incidents

We use reasonable administrative, technical, and organizational safeguards appropriate to our operations. No internet or storage system is completely secure. If a personal-data incident occurs, we will investigate and provide any notice required by applicable law.

3.11 Children

Our store and services are intended for adults aged 18 or older. We do not knowingly seek personal data from children for independent purchases. If you believe a child has provided personal data improperly, contact us.

3.12 WhatsApp and social media

When you click a WhatsApp or social-media link, you leave our website and the relevant platform may collect and process information under its own terms. Messages sent to Crion through those platforms are also retained and used by us as needed to answer enquiries, prepare orders, provide support, or keep legally required records.

3.13 Privacy-policy updates and contact

We may update this policy when our services, providers, or legal duties change. The updated version will show a revised date. Privacy questions and requests may be sent to support@crionkw.com or +965 6994 2109.