Privacy policy

This policy explains how we collect, use and protect your personal data when you use SHILA Beauty, under the Personal Data Protection Law (Royal Decree 6/2022) and its Executive Regulation.

1. Who is responsible

Data controller: SHILA Beauty, Muscat, Sultanate of Oman (licence details on our Licences page).
Data protection officer: contact care@shilashop.com.

2. Data we collect

Account: name, mobile number, e-mail (optional when you sign up with your mobile).
Orders and delivery: address, wilaya and governorate, products, amounts, payment method, notes.
Optional: date of birth (for a birthday gift), your product reviews.
Messages: your conversations with us on WhatsApp or e-mail.
Technical: IP address, device and browser type, and the session files the site needs to work.

We do not store your card details; they are handled by the payment gateway. We do not ask for sensitive data.

3. Why we use it

To process and deliver your order, issue the tax invoice and support you (performing our contract with you).
To send sign-in codes, order status messages and tracking numbers.
For legal and tax obligations, site security and fraud prevention.
Promotional messages and offers only after your explicit consent.

4. Your consent

We ask for your explicit agreement to this policy when you create an account. Consent to promotional messages is separate and optional; you can withdraw it any time through the unsubscribe link in our e-mails, under My account → Newsletter, or by contacting us. Withdrawal does not affect processing done before.

5. Who we share it with

Courier (Dalilee / Amaan or another delivery partner): name, phone, address, amount to collect.
Payment gateway (Thawani) for card payments.
Technical providers: website hosting, e-mail, SMS and WhatsApp Business (Meta) where used.
Authorities when the law requires it.

We share only what each purpose needs, and we never sell your data.

6. Transfers outside Oman

Your data may be stored or processed on servers of some providers outside Oman (such as hosting and messaging). This only happens with your explicit consent given at sign-up, and with providers that offer adequate protection.

7. How long we keep it

Account data: while your account exists; deleted or anonymised when you ask, except what the law requires us to keep.
Invoices and order records: as long as commercial and tax rules require.
Security and sign-in logs: up to six months.

8. Your rights

Withdraw your consent.
Access your data and get a copy.
Correct or update it.
Ask us to delete it.
Transfer it to another organisation.
Be told about a breach that puts your data at risk.

Send your request to care@shilashop.com; we reply within 45 days at most. You may also complain to the Ministry of Transport, Communications and Information Technology, the authority for personal data protection.

9. Security

We use encrypted connections (HTTPS), one-time sign-in codes, and limited staff permissions with access logs. If a breach may harm your data, we notify the authority and you within the legal time limits.

10. Cookies

We only use cookies the site needs to work: session, sign-in, cart, language and currency. We do not currently use advertising or third-party tracking cookies; if we add them we will update this policy and ask for your consent.

11. Children

The store is not aimed at people under 18 and we do not knowingly collect their data.

12. Updates

We may update this policy; the date of the last update is shown below and we will tell you about important changes.

Last updated: 2026-10-30