Privacy Policy

Last updated: 3 June 2026

This Privacy Policy explains how EXT collects, uses, shares, and protects your personal data when you use our online store, in accordance with the Personal Data Protection Law (PDPL) of the Kingdom of Saudi Arabia.

1. Who We Are

EXT is operated by Abdullah Abdulaziz Rashed Alhatim, a registered freelance practitioner selling clothing and accessories. We are the party responsible for (the controller of) your personal data.

Website	extontop.shop
Email	extbrand1@gmail.com
Freelance Document No.	FL-590860954

2. Data We Collect

Account data: your name, email address, mobile number, password (stored encrypted), and your Google account identifier if you sign in with Google.
Order data: your delivery address, city, the products you purchase, the order amount, and your chosen payment method.
Authentication data: one-time verification codes (OTP) and login session tokens.
Technical data: your IP address, device and browser information, and cookies.

We do not store your full card details. Card payments are processed directly and securely by our licensed payment provider in compliance with PCI-DSS standards.

3. How We Collect It

Directly from you — when you create an account, place an order, or contact us.
Automatically — through cookies and analytics tools when you browse the store.
Through Google — when you choose “Continue with Google” to sign in.

4. Why We Use Your Data

To create and manage your account.
To process, fulfill, and deliver your orders.
To process your payments.
To send you order and shipping notifications.
To send marketing offers and news about new drops — only with your consent.
To improve, secure, and protect the store against fraud and misuse.
To comply with our legal and regulatory obligations.

Our legal basis for processing is your consent, the performance of our contract with you (your orders), and compliance with applicable laws.

5. Cookies & Tracking

We use essential cookies that are necessary to run the store, and — based on your consent — analytics and advertising tools, including Google Analytics, Meta Pixel, TikTok Pixel, and Google Ads. You can manage or refuse non-essential cookies through your browser settings or our cookie preferences. Full details will be provided in our Cookie Policy.

6. Marketing Communications

If you consent, we may send you marketing emails about new drops, offers, and discounts. You can withdraw your consent and unsubscribe at any time using the link in any marketing email, or by contacting us at extbrand1@gmail.com.

7. Disclosure to Third Parties

We share your data only as needed, with:

Payment providers (such as Moyasar) to process your payments securely.
Shipping companies, to deliver your orders (your name, address, and phone number).
Service providers such as Google (sign-in, email delivery, and fonts) and our hosting and content-delivery providers.
Government or regulatory authorities, when required by law.

We never sell your personal data.

8. International Transfers

Some of our service providers (such as Google and payment processors) may process your data outside the Kingdom of Saudi Arabia. Where this happens, we take appropriate steps to ensure your data receives an adequate level of protection consistent with the PDPL.

9. Data Retention

We keep your personal data for as long as your account is active and for any period required by applicable laws and regulations. When you request the deletion of your account, we delete your data unless we are legally required to retain it.

10. Data Security

We protect your data using password encryption (scrypt), secure HTTPS connections, and access controls. Your card data is never stored on our servers. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Your Rights

Under the PDPL, you have the right to:

Access your personal data and know how it is used.
Correct any inaccurate or incomplete data.
Request the deletion of your data.
Withdraw your consent at any time.
Object to or restrict certain processing of your data.
Request a copy of your data (data portability).

To exercise any of these rights, contact us at extbrand1@gmail.com.

12. Complaints

If you believe your data protection rights have been violated, you have the right to file a complaint with the Saudi Data & AI Authority (SDAIA).

13. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the “last updated” date shown above.

Questions about this policy? Contact us at extbrand1@gmail.com.