Privacy Policy
Hilson Creek General Trading LLC
Applicable to Hilson Creek and all current and future Hilson Creek brands, including MAQURE and Herbero, and to customers purchasing from the GCC.
Last updated: 17 July 2026
Built In The UAE
Hilson Creek General Trading LLC (“Hilson Creek”, “we”, “us” or “our”) respects your privacy and is committed to processing personal data lawfully, fairly, securely and transparently. This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you visit our websites, use an online store, create an account, place an order, request delivery, contact customer support, make a return or warranty request, subscribe to marketing, or otherwise interact with Hilson Creek or any of its brands.
We use personal data only where reasonably necessary to provide, support, secure and improve our products and services, fulfil our contractual and legal obligations, protect our legitimate interests, or communicate with you where you have consented or where applicable law otherwise permits.
Who We Are, Scope and Jurisdiction
| Item | Details |
|---|---|
| Data Controller | Hilson Creek General Trading LLC |
| Registered Location | Dubai, United Arab Emirates |
| Customer Support & Privacy Email | care@hilsoncreekglobal.com |
| Telephone | +971 4 287 0872 |
| Brands Covered | Hilson Creek and all current and future Hilson Creek brands, including MAQURE and Herbero. |
| Customers Covered | Customers purchasing from the GCC, with the possibility of expansion to additional countries in the future. |
This Policy applies to personal data processed through Hilson Creek and brand websites, online stores, customer accounts, forms, checkout and payment processes, customer-support channels, returns, refunds, exchanges, warranty services, deliveries, marketing communications, analytics, and connected operational or logistics services. It currently applies to customers purchasing from the GCC. We may expand our service area to additional countries in the future, and this Policy will apply to customers in those countries unless replaced or supplemented by a local privacy notice.
Hilson Creek is established in the UAE. This Policy and our processing activities are primarily governed by applicable UAE law. Any dispute arising out of or in connection with this Policy or our processing of personal data shall be subject to the exclusive jurisdiction of the competent courts of Dubai, UAE, without prejudice to any mandatory privacy, data-protection or consumer-protection rights you may have under the laws of your country or region.
Applicable UAE Legal Framework
Our privacy and digital-commerce practices are intended to comply with applicable UAE legislation and regulatory requirements, including, where relevant:
- Federal Decree-Law No. 45 of 2021 Regarding the Protection of Personal Data (the UAE Personal Data Protection Law or UAE PDPL) and its applicable implementing requirements.
- Federal Law No. 15 of 2020 on Consumer Protection, as amended, including requirements concerning consumer information and the protection and lawful use of consumer data.
- Federal Decree-Law No. 14 of 2023 Concerning Modern Technology-Based Trade, which regulates e-commerce and technology-based commercial transactions in the UAE.
- Federal Decree-Law No. 46 of 2021 on Electronic Transactions and Trust Services, where relevant to electronic records, communications and transactions.
- Applicable UAE tax, accounting, cybersecurity, anti-fraud and other regulatory requirements.
References to laws in this Policy include amendments, replacement legislation and binding regulations issued from time to time. This Policy is a general public notice and does not constitute legal advice.
Personal Data We Collect
Identity and contact data
Name, email address, mobile number, billing address, delivery address, country, and other contact information you provide.
Account and preference data
Account credentials, encrypted password, saved addresses, language and communication preferences, wish lists, saved products and account history.
Order, delivery and transaction data
Products purchased, quantities, order value, discounts, payment status, VAT details, delivery instructions, shipment and tracking information, order history, cancellations, failed deliveries, returns, refunds and exchanges.
Returns and warranty data
Purchase evidence, return or warranty request details, reasons, product photographs, supporting documents, inspection findings, correspondence, collection or replacement details and resolution records.
Payment-related data
Payment method, transaction identifier, authorisation result, payment status, refund status, limited card information such as card type or last four digits where supplied by an authorised third-party payment service provider or another relevant payment participant, and fraud or chargeback information. We do not intend to store complete payment-card numbers, CVV security codes or payment authentication credentials.
Technical, device and usage data
IP address, device type, browser, operating system, cookie or advertising identifiers, approximate location derived from IP address, referral source, pages viewed, interactions, session information, error logs and website performance data.
Communications and customer-service data
Messages, enquiries, complaints, call, email or chat records, product reviews, feedback and our responses.
Marketing and advertising data
Marketing consent, subscription status, preferred communication channel, campaign interactions and information used to measure or personalise advertising where permitted.
How We Collect Personal Data
- Directly from you when you create an account, place an order, submit a form, request support, make a return or warranty request, participate in a promotion, provide feedback or subscribe to communications.
- Automatically through cookies, pixels, tags, server logs, local storage and similar technologies when you use our websites.
- From authorised third-party payment service providers, acquiring banks and fraud-prevention services in connection with payment authorisation, settlement, refunds, disputes and chargebacks.
- From courier, delivery, warehouse and fulfilment partners in connection with delivery, failed delivery, collection, return, exchange and shipment-status activity.
- From hosting, e-commerce, customer-support, communications, analytics, advertising, security and integration service providers used to operate our business.
- From social-media or advertising platforms when you interact with our pages, advertisements or campaigns, subject to the platform settings and your consent choices.
Why We Use Personal Data
We process personal data only for specific, legitimate purposes and on an available lawful basis, such as consent, performance of a contract, compliance with a legal obligation, protection of rights and security, or legitimate interests recognised under applicable law.
| Purpose | How the Data Is Used |
|---|---|
| Orders and Accounts | To create and manage accounts; accept, verify and fulfil orders; issue invoices; process payments and refunds; provide order updates; and maintain purchase history. |
| Delivery and Logistics | To share the customer's name, mobile number, delivery address, delivery instructions, order reference and related information with approved delivery or fulfilment partners so they can deliver, collect, return or replace products. |
| Returns, Exchanges and Warranties | To validate purchases; assess eligibility; arrange collection or replacement; investigate product or delivery issues; process refunds; prevent abuse; and maintain service and warranty records. |
| Customer Service | To answer enquiries, complaints and product questions; investigate missing, damaged or incorrect shipments; and maintain communication records. |
| Payments and Fraud Prevention | To authorise and reconcile payments through authorised third-party payment providers; process refunds and chargebacks; detect suspicious activity; secure transactions; and comply with payment-provider, banking and legal requirements. |
| Website Operation and Analytics | To operate shopping carts, account functions and checkout; diagnose technical issues; understand website usage; measure performance; and improve navigation, content, products and the overall customer experience. |
| Marketing and Advertising | To send email or WhatsApp marketing communications, measure campaign performance, build advertising audiences and personalise communications where consent or another lawful basis is available. |
| Legal and Business Records | To maintain accounting, VAT, audit, reconciliation and compliance records; respond to lawful requests; prevent misuse; and establish or defend legal claims. |
Marketing Communications
We may use your name, email address, mobile number, country, purchase interests and campaign interactions to send promotional communications by email, WhatsApp or other approved channels. This may include future product launches, brand news, offers, restock alerts, events and recommendations. We will obtain consent where required and will not make acceptance of unrelated marketing a condition of completing a purchase.
- You may unsubscribe at any time by using the unsubscribe link or instructions in the message, adjusting available account or cookie preferences, replying with an opt-out request where supported, or contacting us at care@hilsoncreekglobal.com.
- Withdrawal of marketing consent does not affect necessary non-marketing messages, including order confirmations, payment receipts, delivery updates, return or warranty communications, security notices and responses to customer requests.
- We may retain a limited suppression record, such as your email address or mobile number and opt-out status, to ensure that your unsubscribe choice continues to be respected.
- Marketing and advertising service providers may process limited contact or identifier data only for approved campaigns and subject to applicable consent and contractual controls.
Cookie Policy
What cookies and similar technologies are
Cookies are small files or identifiers placed on or accessed from your device. Our websites may also use pixels, software development kits, tags, local storage and similar technologies. In this section, these technologies are collectively called cookies.
Categories of cookies
| Cookie Category | Purpose |
|---|---|
| Strictly Necessary | Required for security, account login, shopping cart, checkout, payment routing, fraud prevention, load balancing and other functions needed to provide the website and requested services. |
| Preferences | Remember choices such as language, region, account settings, display preferences and items placed in the shopping cart. |
| Analytics and Performance | Help us understand website traffic, user journeys, errors and overall website performance so that we can improve our services and user experience. |
| Advertising and Social Media | Support campaign measurement, audience creation, remarketing, frequency controls and more relevant advertising, where enabled and permitted. |
Analytics and advertising tools
Subject to the tools actually enabled on a website and your consent choices, we may use services such as Google Analytics, Google Ads, Google Tag Manager, Meta Pixel, Meta Ads and related Google or Meta measurement and advertising technologies. These providers may place or read cookies, receive device and usage identifiers, measure visits or conversions, and combine information with data held in accordance with their own privacy terms and your platform settings.
We may also use functional, security, payment, customer-support or e-commerce cookies supplied by our website platform and approved service providers. The cookie banner or preference centre will identify the available categories and allow you to make choices where required.
Your cookie choices
- Strictly necessary cookies cannot normally be disabled through our preference centre because the requested website or checkout functions may not operate without them.
- Non-essential analytics, advertising and social-media cookies will be activated only in accordance with applicable consent requirements.
- You may accept, reject or change non-essential cookie choices through the website cookie banner or preference centre and may also control cookies through your browser or device settings.
- Disabling cookies may affect some website functions, saved preferences, account features or checkout performance.
Cookie duration
Some cookies expire when you close your browser, while others remain for a defined period. Cookie duration depends on the provider and purpose and will be described in the cookie preference centre where reasonably available. We periodically review non-essential cookies and remove or disable those that are no longer required.
Payments and Third-Party Payment Providers
Online payments are processed through one or more authorised third-party payment gateways or payment service providers, together with relevant acquiring banks and payment-service participants. The relevant provider may process your card or wallet information directly through its secure hosted payment environment under its own privacy notice and security terms.
- Hilson Creek does not intend to collect or store complete card numbers, CVV security codes, PINs or payment authentication credentials. These details are entered into and processed through the secure payment environment operated by the relevant third-party payment provider.
- We may receive and retain a payment token, transaction reference, card type, limited masked card details, authorisation result, fraud indicators, settlement status and refund or chargeback information for order fulfilment, reconciliation, customer service and legal compliance.
- Third-party payment service providers and other payment-service participants operating in the UAE are required, where applicable, to comply with relevant Central Bank of the UAE requirements, including the Retail Payment Services and Card Schemes Regulation, and recognised card-data security standards such as PCI DSS.
- Payment information may be shared among the relevant third-party payment provider, acquiring bank, card scheme, issuing bank, wallet provider, fraud-prevention service and other participants necessary to authorise, settle, refund or dispute a transaction.
- Third-party payment providers operate independently and process payment data under their own privacy and security practices. We select payment providers using reasonable compliance and security considerations.
When We Share Personal Data
We do not sell personal data. We may disclose only the information reasonably necessary for the stated purpose to:
- Authorised third-party payment providers, acquiring banks, card schemes, wallet providers and fraud-prevention services for payment processing, refunds, reconciliation, dispute handling and transaction security.
- Courier, delivery, warehouse and fulfilment partners for shipment preparation, delivery, delivery verification, failed delivery, collection, returns, exchanges and replacements.
- Website, hosting, cloud, cybersecurity, e-commerce, integration and technical-support providers used to operate and protect our websites and services.
- Email, WhatsApp, customer-support, analytics and advertising service providers used for approved communications, measurement and campaigns.
- Professional advisers, auditors, insurers and consultants subject to appropriate confidentiality obligations.
- Government, court, customs, tax, law-enforcement, data-protection or regulatory authorities where disclosure is legally required or permitted.
- A purchaser, investor, financier or successor in connection with a proposed or completed corporate transaction, subject to appropriate confidentiality and legal safeguards.
Service providers are expected to process personal data only for authorised purposes, apply appropriate security measures and comply with contractual and legal obligations appropriate to their role.
International Data Transfers
Because we currently serve customers across the GCC and may use regional or international service providers, personal data may be stored or processed outside the country in which it was collected. Where personal data subject to the UAE PDPL is transferred internationally, we will apply the transfer requirements and safeguards required by the UAE PDPL, which may include assessing the destination, contractual protections, approved mechanisms, security controls and restrictions on further use or disclosure.
Customers located in GCC countries outside the UAE acknowledge that their information may be processed in the UAE or in other locations used by our service providers, subject to applicable mandatory local rights.
International Data Transfers
Customer personal data is generally retained for eight years from the later of the most recent transaction, account closure, final delivery, completion of a return or warranty matter, or closure of the relevant customer-service case. We may delete or anonymise data earlier when it is no longer required. We may retain specific records longer where required by UAE tax, accounting, regulatory or legal obligations, to investigate fraud, to resolve disputes, or to establish or defend legal claims.
| Record Category | Retention Approach |
|---|---|
| Customer Accounts and Profiles | Retained for the life of the account and generally for eight years after account closure or the last customer transaction, unless deletion is validly requested earlier or a longer retention period is required by law. |
| Orders, Delivery, Returns and Warranties | Generally retained for eight years from the completion of the relevant transaction or the resolution of any return, exchange, refund or warranty claim. |
| Customer-Service Communications | Generally retained for eight years after the relevant enquiry, complaint or service matter has been closed. |
| Payment and Fraud Records | Generally retained for eight years for merchant records, subject to any longer retention period required or independently applied by the relevant third-party payment provider, bank, card scheme or applicable law. |
| Marketing Records | Retained until consent is withdrawn, the processing purpose ends or the record is no longer required. A limited suppression record may be maintained to honour marketing opt-out requests. |
| Cookies and Analytics | Retained for the session or the fixed duration specified in the Cookie Preference Centre or by the relevant service provider. Data is then deleted, aggregated or anonymised where appropriate. |
| Tax, Accounting and Legal Records | Retained for any longer minimum period required under applicable UAE laws, including records containing customer-related transaction information. |
Data Security and Data Breach Notification
We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or misuse. Measures may include encrypted connections, restricted access, role-based permissions, password controls, multi-factor authentication where supported, monitoring, backups, vendor due diligence, confidentiality requirements and incident-response procedures.
If a personal-data breach occurs, we will assess its nature, scope, likely consequences and the measures required to contain and remedy it. Where notification is required under the UAE PDPL or another applicable law, we will notify the UAE Data Office or other competent authority and affected individuals within the legally required manner and timeframe. Affected customers may be provided with information about the incident, likely impact, protective steps and a contact point for further assistance.
No method of internet transmission or electronic storage is completely secure. Customers should use a strong, unique password and notify us promptly if they suspect unauthorised access to their account or communications.
Your Privacy Rights and Data Requests
Subject to applicable law and relevant exceptions, you may have the right to:
- Request information about the personal data we process, the purposes of processing, recipients, transfers and any relevant automated processing.
- Request access to a copy of personal data held about you.
- Request correction, updating or completion of inaccurate or incomplete personal data.
- Request deletion of personal data where the legal conditions are met.
- Request restriction, suspension or cessation of certain processing where applicable.
- Withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal.
- Object to direct marketing and unsubscribe from email or WhatsApp marketing at any time.
- Request eligible data in a structured and machine-readable format or request transfer where technically feasible and legally applicable.
- Raise a complaint regarding our processing or certain automated decisions.
How to access, modify or delete your data
You may update certain account information directly through your online account where that function is available. For access, correction, deletion, restriction or other privacy requests, email care@hilsoncreekglobal.com with the subject line “Privacy Request” and describe the data or account concerned and the action requested. We may ask for information reasonably necessary to verify your identity, protect the account and confirm your authority to act.
We will review and respond within the period required by applicable law. A request may be refused, limited or delayed where permitted or required by law, including where data must be retained for tax, accounting, payment, fraud-prevention, warranty, dispute or legal-claim purposes. Where deletion is approved, we will delete, anonymise or place the data beyond ordinary use, subject to technical backup cycles and lawful retention exceptions.
Children’s Privacy
Our online stores are intended for adult purchasers and are not designed to knowingly collect personal data directly from children. A person who has not reached the age required to enter into an online purchase contract should use the website only with the involvement of a parent or legal guardian. Where UAE law requires verified parental or guardian consent for processing a child’s personal data, we will seek that consent or refrain from the processing. If you believe a child has provided personal data improperly, contact us so we can review and take appropriate action.
Automated Processing and Personalisation
Our websites and service providers may use automated tools for fraud screening, website analytics, product recommendations, audience segmentation, advertising measurement or customer-service routing. We do not intend to make decisions producing legal or similarly significant effects solely through automated processing without providing the information, safeguards and rights required by applicable law.
Third-Party Websites, Platforms and Social Media
Our websites may contain links to third-party websites, hosted payment pages, courier tracking pages, embedded content, messaging services or social-media platforms. Those third parties may operate independently and process personal data under their own privacy and cookie notices. We encourage you to review the relevant third-party notice and account settings before providing information or enabling optional integrations.
Changes to This Privacy Policy
We may update this Privacy Policy when our practices, brands, service providers, technologies, products or legal obligations change. The revised version will be published on the relevant website with an updated date. Where a change materially affects your rights or our use of personal data, we may provide an additional notice through the website, account or registered contact details where appropriate.
Contact Us and Complaints
Hilson Creek General Trading LLC
Dubai, United Arab Emirates
Customer support and privacy requests: care@hilsoncreekglobal.com
Telephone: +971 4 287 0872
Please contact us first if you have a privacy question or complaint. You may also have the right to submit a complaint to the UAE Data Office, another competent UAE authority, or the data-protection authority having mandatory jurisdiction in your country or region.
