This policy explains how NEXT FRAME TRADING / الإطار التالي للتجارة processes personal data when a person browses nextframe.ae, uses the cart or checkout, contacts us, or deals with an accepted order for delivery within the United Arab Emirates.
Data controller and contact
We are the controller for the processing described here unless a specific notice states otherwise. To ask a question or exercise a data right:
- Email: hello@nextframe.ae
- Instagram: @nextframegear
For a formal request, put “Data Rights Request” in the email subject. Do not send an identity document unless we request it for proportionate verification.
Scope
This policy applies to:
- browsing pages, selecting language and managing cookies;
- the site session, cart and checkout fields;
- submitting transaction details within the UAE;
- orders we expressly accept and their related payment, shipping and after-sales service;
- enquiries, complaints, warranties, returns and safety reports; and
- data-rights requests and security incidents.
It does not govern independent processing by another platform after the user leaves our site through an ordinary link, such as Instagram. That platform’s policy governs its independent activity.
Data we process
Browsing, device and security data
We may process the Internet Protocol address, device and browser type, operating system, language, requested page, request time, session identifier, response and error logs, and limited data needed to prevent abuse and protect the site. We do not operate optional analytics, advertising, session-replay or marketing-pixel tools.
Session and cart data
The session or necessary storage may contain a random identifier, product identifiers, quantities, variants, calculated values, discounts and cart state. This information preserves the cart, calculates totals and secures requests; it is not used to build an advertising profile.
Checkout fields
Checkout may request the name, email address, telephone number, recipient name, UAE delivery address, emirate, area, landmark, building or unit number, necessary delivery notes, cart contents, displayed shipping method, order value, acknowledgement that the customer is at least 18 years old, and acceptance of the transaction terms and relevant policies.
The fields are used to validate completeness, address eligibility, shipping rules, price, security and whether an order can be created. Sensitive information that is not requested should not be entered in the notes field.
What happens if no order is created
If final submission does not succeed before a confirmed order number is created:
- the data is not stored as a purchase order in the order register;
- no sale contract or carrier booking is created;
- checkout-field content is not retained as a transaction record;
- no invoice or payment claim is created; and
- non-identifying cart contents may remain in a short session for the period below. Name, email, phone, address and delivery-note fields are scrubbed immediately if final submission does not result in a confirmed order number and are not written to an order record, error log or backup. Security or hosting systems may record an aggregate technical event without personal data and without converting it into an order.
We do not record a full card number or card security code in an order or error log. When an accepted transaction proceeds to payment processing, card data is entered directly into an approved payment provider through hosted fields or a secure redirect. We retain only the transaction reference, status and limited information needed for reconciliation and legal rights.
Accepted orders and after-sales service
When an order is expressly accepted, we may process the order number, products, quantities, prices, charges, discounts, payment reference and status, invoice, shipment, tracking and delivery data, and the cancellation, return, replacement or refund history. Support files may include communications, photographs, serial numbers, inspection reports, RMA decisions, complaints and safety reports.
Consents and acknowledgements
The 18+ acknowledgement and acceptance of transaction terms are not retained as a permanent record unless an accepted order is created. If final submission does not result in a confirmed order number, they are scrubbed with the Checkout fields. The current site does not store an optional-cookie choice or a cookie-consent evidence record. A transaction acknowledgement is never treated as marketing consent.
Sources
We obtain data:
- from you when you browse, enter fields or contact us;
- automatically from your device through necessary technologies;
- from hosting, security and support providers for site operation and protection; and
- only for an accepted order, from a payment provider, carrier or service centre to the extent needed to perform or address the transaction.
If you provide another recipient’s details, you must be authorized to do so and must inform them of the relevant processing.
Purposes and legal grounds
We process data for the following defined purposes and on an available ground under applicable law:
| Purpose | Example data | Usual ground |
|---|---|---|
| Deliver the site, language and cart | session, language and cart | requested functionality and our legitimate interest in operating the site |
| Protect the site and prevent abuse | IP address, security and error logs | legitimate interests and security duties |
| Validate checkout fields | contact, address, cart and acknowledgements | steps requested by the person before a contract |
| Perform an order we expressly accept | order, payment, shipping and invoice | contract performance and legal duty |
| Handle returns, warranty, complaints and safety | transaction, communications and evidence | contract, legal duty and legitimate interests |
| Deal with rights, disputes and audit | identity, order and records | legal duty, legitimate interests and legal claims |
| An optional preference | the specific consent record | express, withdrawable consent; the optional purpose does not operate before an affirmative choice where required |
We do not sell personal data or use cart or checkout data for marketing or behavioural advertising.
Disclosures and service providers
We disclose only what is needed to:
- hosting, content-delivery, protection and technical-support providers;
- authorized staff or contractors with limited permissions;
- an approved payment provider, carrier or service centre after an accepted order exists and only for its function;
- a professional adviser or auditor under suitable confidentiality; or
- a competent authority where law requires disclosure or it is necessary to protect a right or safety.
We require processors to follow documented instructions, protect data, report incidents, control subprocessors, and return or delete data when their service ends. The site has no active optional analytics, marketing, advertising or social-embed vendor.
Transfers outside the UAE
We use Pressable for website hosting and Google Workspace for business email. The current website hosting location is Dallas, United States. These services can involve processing outside the UAE; UAE-only delivery does not mean UAE-only data storage.
If an approved provider processes data in another country, we assess the processing location, contract and appropriate legal and security safeguard before activation. Transfer is limited to what is needed for the disclosed purpose. General information about destination categories and safeguards may be requested through our contact channels.
Retention periods
We retain data for the purpose and then delete or de-identify it, subject to a necessary exception for rights, disputes, safety or a legal order. The following operational schedule applies unless a specific matter requires longer retention:
| Category | Usual period |
|---|---|
| Ordinary web-server logs | up to 90 days |
| Security and abuse-prevention logs | up to 180 days |
| Language routing and optional-cookie choices | Language is selected by the /en/ or /ar/ page address; no separate language-preference cookie or optional-cookie consent record is created by the current site |
| Administrative access and audit record | up to 12 months |
| Email or Instagram enquiry not connected to an order | up to 24 months after the last substantive contact |
| Non-identifying cart contents and Checkout fields not connected to a confirmed order | 30-minute session lifetime, which may renew with continued activity; personal Checkout fields are scrubbed immediately if final submission does not result in a confirmed order number |
| Operational backups | Retention varies by backup type, as explained below |
| Security-incident or data-breach file | up to 5 years after closure |
| Orders, invoices, payment, shipping, warranty and complaints | as needed for contract, warranty, accounting, dispute and legal duties |
If an enquiry becomes an order, complaint, warranty or safety file, the new file’s period applies. A copy may remain in a backup until its cycle expires, restricted to restoration and security use.
Pressable provides automatic filesystem and database backups on separate schedules. Available automatic history uses daily copies for one week followed by weekly copies for a month. For on-demand backups, the newest copy is retained for 30 days; creating a newer copy starts a seven-day expiry period for the preceding copy. Retention is not one uniform 35-day cycle.
Session expiry ends access to that session; it does not itself erase stored database rows or existing backups. Expired server-side session records are removed by scheduled cleanup, and backup copies remain until their applicable retention period ends.
Cookies and tracking
We use only necessary technologies to deliver and secure the site and operate the session, cart and checkout steps. Language is selected by the /en/ or /ar/ page address, not a separate preference cookie. No optional analytics, marketing or advertising provider operates on the site. Names and durations are explained in the Cookies and Tracking Technologies Policy.
Security
We apply proportionate controls including encrypted connections, access restrictions, multi-factor authentication for administrative accounts where supported, secrets management, security updates, backups, log monitoring and incident response. No electronic method is risk-free, so controls are reviewed against the nature of the data and risk.
Do not send a password, card data or identity document through email or Instagram. If you suspect impersonation, contact us through the channels published here.
Automated rules
Checkout may use automated rules to validate fields, address, price, stock and security. We do not make a legal or similarly significant decision about a person solely through marketing or automated profiling. A person who believes a rule prevented a valid transaction may request review by email.
Data-subject rights
Subject to legal conditions and exceptions, a person may request:
- information about processing and access to data;
- correction of inaccurate data;
- erasure where no ground remains for retention;
- restriction or objection in the cases provided by law;
- data portability where the right applies;
- withdrawal of optional consent without retroactive effect; and
- review of a qualifying automated decision where applicable.
We request enough information to verify identity and locate the record, but no more than is needed. We may refuse or limit a request where a record must be retained or disclosure would conflict with another person’s rights, and will explain the reason and available escalation route.
Persons under 18
Public pages may be browsed, but a person under 18 may not create a purchase account, submit a transaction, purchase independently, or have a parent or guardian purchase through the site on their behalf. Every person submitting a transaction must acknowledge that they are at least 18 years old. We do not target persons under 18 with marketing or tracking. See the Child Privacy and Digital Safety Notice.
Data breaches
When an incident is suspected, we document, contain and assess it, including the data and people affected, impact, risk, corrective actions and whether notification is required. We notify affected people or the competent authority where law requires, using available information and the required process.
Changes and contact
We may update this policy if processing or legal requirements change. The version and effective date appear above, and appropriate notice will be given for a material change.
For a privacy request:
- Email: hello@nextframe.ae
- Instagram: @nextframegear