1. The data we collect
Horsie is the data controller for the personal information described below, and processes it in accordance with the Personal Data Protection Law No. 30 of 2018 of the Kingdom of Bahrain.
- Account data — name, email address, mobile number, preferred market and language.
- Delivery data — recipient name, phone number, and the full address including block, road, building, governorate and country.
- Payment data — payment method, transaction reference and the last four digits of a card. Full card numbers are handled by our licensed payment provider and never reach our servers.
- Pet profiles — species, breed, age and any care notes you choose to save. This data exists only to improve product recommendations and is never shared with vendors.
- Vendor data — commercial registration number, trade licence details, bank name, IBAN, account holder name and the identity of the nominated contact person.
- Technical data — IP address, device type, browser, pages visited, search queries and referral source.
2. How we use it
- To process and fulfil your orders, generate shipping labels, and route consignments to the correct carrier for the destination market.
- To hold your payment and release it to the vendor once the return window closes.
- To verify vendor licences and commercial registrations, and to meet our anti-fraud obligations.
- To personalise recommendations using your market, language and saved pet profiles.
- To send order updates and, where you have opted in, promotions and price alerts. Every marketing message carries a one-tap unsubscribe.
- To comply with Bahraini customs, tax and consumer protection record-keeping duties.
3. Who we share it with
We share personal data only with parties who need it to perform a specific function, and only to the extent necessary. We do not sell, rent or trade personal data to any third party for marketing purposes.
- Vendors — recipient name, delivery address and phone number for the consignment, plus the items ordered. Vendors never see your payment details.
- Carriers and customs brokers — the delivery data required to clear and deliver a cross-border shipment.
- Payment providers — transaction amounts and billing references.
- Regulators and law enforcement — only where a lawful, documented request obliges us to disclose.
4. Your rights under Bahraini law
Personal Data Protection Law No. 30 of 2018 gives you the following rights in respect of the data we hold about you. We respond to a valid request within 30 days and may ask you to verify your identity first.
- Right of access — obtain a copy of the personal data we hold about you.
- Right to rectification — correct inaccurate or incomplete data, including a wrong delivery address on an open order.
- Right to erasure — ask us to delete your data, subject to the retention obligations below.
- Right to object and to withdraw consent — stop marketing communications at any time without affecting the lawfulness of earlier processing.
- Right to lodge a complaint — with the Personal Data Protection Authority in Bahrain.
Exercise any of these rights by writing to privacy@horsie.bh with the subject line "PDPL request". There is no fee.
6. How long we keep it
| Data category | Retention period | Legal basis |
|---|---|---|
| Order and delivery records | 5 years from delivery | Tax and customs law |
| Vendor licence and banking data | 7 years after storefront closure | AML obligations |
| Account and pet profiles | Until you delete them | Consent / contract |
| Analytics and session data | 13 months | Legitimate interest |
After the retention period expires, data is deleted or irreversibly anonymised so it can no longer be linked to you.
7. Cross-border transfers
When you order for delivery to Saudi Arabia or the United Arab Emirates, your recipient name, address and phone number are transferred to the vendor, the carrier and the destination customs authority. That transfer is necessary to perform the contract you have entered into, and is the legal basis we rely on.
We do not transfer personal data outside Bahrain, Saudi Arabia and the UAE except to a cloud hosting provider operating under a written data processing agreement with equivalent safeguards. Where a transfer requires your consent, we ask for it explicitly and record the answer.
8. Security
All traffic is served over TLS 1.2 or higher. Access to personal data is restricted to named staff on a need-to-know basis and is logged. Bank details are held in an encrypted vault with keys managed separately from the application database. No system is perfectly secure; if a breach affecting your data occurs we will notify you and the Personal Data Protection Authority without undue delay.
9. Contact the data controller
Horsie Marketplace W.L.L., Building 1223, Road 2825, Block 428, Al Seef, Kingdom of Bahrain. Data protection enquiries: privacy@horsie.bh. General support: support@horsie.bh or +973 3000 0000, Sunday to Thursday, 9:00–18:00 AST.
Questions about this policy?
support@horsie.bh