Privacy policy

1. Who is responsible for your data

KULNA SHOPPING (commercial registration 1-200104, Kingdom of Bahrain), which operates Arkan, is the controller of the personal data collected through your account and your use of the website. When you place an order, the shop you buy from receives the details it needs to fulfil it and is responsible for that data on its own behalf, as the seller.

We process personal data in line with the personal data protection law of the Kingdom of Bahrain and, where it applies, the data protection law of the country you are in.

2. What we collect

Account details: your name, email address, phone number and password (stored only in protected form).

Delivery details: the addresses and locations you save and the contact details for delivery.

Order details: what you bought, from which shop, when, for how much, and its status.

Payment details: handled entirely by our licensed payment provider. We receive a confirmation and a reference, never your full card number.

Usage and device details: pages visited, language and country chosen, device type and browser, and the technical logs needed to keep the platform secure.

Messages: what you send to our support and, where they pass through the platform, your messages to a shop.

3. Why we use it

To provide the service you asked for: creating your account, taking and delivering your orders, processing payment and refunds, and answering your requests. This is necessary to perform our contract with you.

To keep the platform safe: preventing fraud, securing accounts and detecting abuse. This is our legitimate interest and yours.

To meet legal obligations, such as keeping transaction records for the period tax and commercial law require.

To send you marketing about the platform, only with your consent. You can withdraw it at any time from your settings or from any message we send, and we will stop within ten working days at the latest.

4. Who we share it with

The shop you buy from, for the order you place with it: your name, delivery address, phone number and the order itself.

Our payment service provider, to process your payment and any refund.

Delivery partners, where the shop or the platform uses one, for the delivery details only.

Service providers that host and run the platform for us (hosting, email, error monitoring), under contracts that limit them to working on our instructions.

Public authorities, when the law requires it or to protect the platform, a shop or a user from fraud or harm.

We do not sell personal data, and we do not share it with anyone for their own marketing.

5. How long we keep it

Account data is kept while your account is open. Order and payment records are kept for as long as tax and commercial law require after the order, then deleted or anonymised. Security logs are kept for a short, fixed period. When you close your account we delete or anonymise what the law does not require us to keep.

6. Your rights

You can ask to see the personal data we hold about you, correct it, or delete it. You can object to processing, including marketing, and withdraw any consent you gave. Most of this you can do yourself from your account settings; for the rest, contact us and we will respond within the time the law sets.

If you believe we have not handled your data properly, you can complain to us, and you have the right to complain to the personal data protection authority in the Kingdom of Bahrain or the equivalent authority in your country.

7. Cookies

The platform uses only the cookies it needs to work: to keep you signed in, to keep your cart, and to remember your language, country and theme. It does not use advertising or cross-site tracking cookies. Because none of them is optional to the service, there is no cookie banner to dismiss.

8. Security

Data is encrypted in transit, passwords are stored only as protected hashes, and access to systems is limited to the people who need it. Card data never touches our systems. No system is perfectly secure; if a breach affects you, we will tell you and the authority as the law requires.

9. Children

The platform is for adults. We do not knowingly collect personal data from anyone under 18; if you believe we have, contact us and we will delete it.

10. Changes and contact

We may update this policy. The date at the top shows the current version, and we will tell you about material changes through the platform. Questions and requests about your data go to our support address on the support page.