Privacy Policy

Last updated: 16 October 2026

Fiorella ("Fiorella", "we", "us" or "our") is an Egyptian home-fragrance brand. We operate the online store at getfiorella.com (the "Site") and sell hand-poured candles and diffusers designed and made in Egypt.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have. It applies whenever you visit the Site, browse or buy our products, create an account, contact us, or otherwise interact with us — and it applies alongside our Terms.

We follow Egypt's Personal Data Protection Law No. 151 of 2020 and its executive regulations. Where the EU/EEA General Data Protection Regulation (GDPR) applies to you, we also honour the rights and protections it gives you. Where the two frameworks differ, we apply the standard that protects you best.

1. Who we are (data controller) and how to reach us

Fiorella is the controller responsible for the personal data described in this Policy. We are based in Egypt and sell within Egypt.

Store / trading name: Fiorella (فيوريلا)
Based in: Cairo, Egypt (online store)
Email: mina.elia192@gmail.com
Phone / WhatsApp: 01550243996

We have not named a registered legal entity here because the store is not currently registered as one. If that changes, we will update this Policy. For any question or request about this Policy or your personal data, contact us at the email above.

2. Information we collect

We collect personal data you give us, data generated when you use the Site, and data we receive from service providers.

Account and identity data

Name and email address when you register, sign in (including through Google sign-in if you choose it), or update your profile.
Password (stored hashed; never in plain text) and account preferences.
Optional phone number and referral information linked to your account.
Loyalty points balance and related account activity.

Contact and delivery data

Full name, email address and phone number used to process and confirm your order.
Delivery address, including street, city, governorate, building, floor, apartment and the nearest landmark.
Order notes or special instructions you choose to give us.

Order and transaction data

Order number, items purchased, quantities, prices, discounts, shipping charges and order total.
Order status, delivery updates, amounts recorded against your order, and the payment method used (for example InstaPay, Vodafone Cash or cash on delivery).
Coupon codes and loyalty points applied to an order.

Payment data

Orders are paid using the methods we show at checkout or send you directly: a deposit or full payment by InstaPay or Vodafone Cash, with the balance, when applicable, paid in cash on delivery. When a payment is arranged or collected, we record the amount and method so we can reconcile your order.
We do not collect or store full card numbers on the Site.

Communications data

Messages you send by email, WhatsApp, phone, contact forms or social media.
Records of order notifications and support conversations.
Newsletter subscription status and preferences, where you opt in.

Technical and usage data

IP address, browser type and version, device information and user-agent string.
Pages and products viewed, items added to the cart, checkout steps, and the referring page or campaign parameter.
Cookies and similar technologies, as described in Section 5, including advertising attribution identifiers.
Security and audit records, such as rate-limiting events and consent audit logs (which may include IP address and user agent).

3. Purposes and legal bases for processing

We only process your personal data when we have a lawful basis to do so. Depending on the purpose, we rely on one or more of the following bases under the Egyptian PDPL and, where applicable, the GDPR:

Create and manage your account — Registration, sign-in, profile and loyalty points — Performance of a contract
Process, ship and deliver orders — Order confirmation, packaging, delivery, order updates — Performance of a contract
Take and reconcile payment — InstaPay / Vodafone Cash payments, cash on delivery, receipts — Performance of a contract; legal obligation
Provide support — Email, phone and WhatsApp replies, returns handling — Performance of a contract; legitimate interests
Marketing and newsletters — Sending offers and updates you asked for — Consent
Advertising measurement — Meta Pixel and Conversions API performance tracking — Consent (where required)
Site analytics and improvement — Understanding how the Site is used and improving it — Legitimate interests
Security and fraud prevention — Detecting abuse, unauthorised access and incidents — Legitimate interests; legal obligation
Legal, tax and accounting compliance — Invoices, accounting and responding to lawful requests — Legal obligation

Consent — for marketing emails and newsletters, for non-essential cookies and advertising measurement where consent is required, and for any other processing where you have given us permission. You may withdraw your consent at any time (see Section 10).

Performance of a contract — to create your account, process, take payment for and deliver your order, and provide related support.

Legitimate interests — to secure and improve the Site, prevent fraud, and carry out marketing and analytics in a balanced way that does not override your rights.

Legal obligation — to keep tax, accounting, invoicing and other records required by law, and to respond to lawful requests from authorities.

4. How we use your information

In practice, we use your personal data to:

Create and manage your account and authenticate you.
Process, confirm, package, ship and deliver your orders, and contact you to confirm order or delivery details.
Record and reconcile payments and issue invoices or receipts.
Provide customer support and respond to your enquiries.
Operate loyalty points and referral features.
Prevent, detect and investigate fraud, abuse, unauthorised access and other security incidents.
Send you marketing and newsletters where you have opted in, and measure and improve our advertising and Site performance.
Analyse how the Site is used so we can improve our products, pages and services.
Comply with legal, tax, accounting and regulatory obligations, and enforce our terms.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not use it for medical or therapeutic purposes.

5. Cookies and similar technologies

We use cookies and similar technologies to run the Site, remember your preferences, keep your session secure, and measure and improve our marketing. We group them into two kinds.

Essential cookies (always active). These are needed for the Site to work and do not require consent because they are strictly necessary:

Session cookie: keeps you signed in and preserves your cart and checkout state.
CSRF cookie: protects forms and requests against cross-site request forgery.
Preference cookies: remember settings such as your selected language (English or Arabic).
Consent cookie: records the cookie choices you make so we can honour them.

Non-essential cookies (consent-based). These are used for advertising and measurement and are set only with your consent where consent is required:

Meta Pixel and Conversions API. We use these Meta tools to measure the performance of our advertising on Facebook and Instagram, and this is the only advertising/measurement pixel we currently use.
The Meta Pixel loads on the Site and records events such as PageView, ViewContent, AddToCart, InitiateCheckout and Purchase.
Meta sets and reads the _fbp cookie (a first-party advertising identifier generated by the Pixel) and, when you arrive from a Meta ad, the _fbc cookie, created from the fbclid click parameter in the ad URL. We also set these cookies from our own server so the server always has a value. They are stored for up to 90 days.
When you place an order, we send a Purchase event to Meta's Conversions API from our server. That event includes the order value, currency and purchased items, and identifiers such as your hashed email address and phone number, hashed name, an internal/external identifier, the _fbc and _fbp values, your IP address and your browser user-agent. We share a common event identifier with the browser so Meta can de-duplicate the two events.
This means purchase and conversion data, including hashed contact identifiers, is shared with Meta for advertising measurement and optimisation. We do not send your password, full payment card data, or the contents of your support messages to Meta.

Your cookie choices. We ask for your consent before setting non-essential cookies where the law requires it, and we are adding a cookie-consent banner through which you can accept or reject non-essential cookies and change your choice at any time. You can also control cookies through your browser settings — most browsers let you block or delete cookies. Advertising preferences can be adjusted through Meta's ad settings. Blocking essential cookies may prevent parts of the Site (such as checkout) from working correctly.

6. Sharing your information

We do not sell your personal data. We share it only with the categories of recipients below, and only as needed for the purposes in this Policy:

Delivery couriers and logistics providers — to deliver your order to the address you give us.
Payment providers and financial institutions — to process or reconcile payments made via InstaPay or Vodafone Cash, and to reconcile cash-on-delivery amounts, where applicable.
Hosting, infrastructure and communications providers — our cloud hosting, object storage, database, caching and transactional email/SMS providers, who host or transmit data on our behalf.
Meta — for the Pixel and Conversions API described in Section 5, and any similar measurement provider we may use.
Professional advisers — accountants, auditors, lawyers and insurers, where necessary.
Authorities and third parties — where the law, regulation, legal process or a valid government request requires it, or to protect our rights, property or users' safety.
Successors — in connection with a merger, acquisition, restructuring or sale of assets, subject to appropriate confidentiality safeguards.

Service providers that process data on our behalf are required to protect it and to use it only for the purposes we specify.

7. International transfers

Fiorella is based in Egypt. Some of our service providers — for example cloud hosting and advertising/measurement partners such as Meta — may store or process personal data on servers located outside Egypt.

Where personal data is transferred internationally, we take reasonable steps to keep it protected. These include requiring appropriate contractual safeguards from our providers, limiting each transfer to what is necessary for the relevant purpose, and applying additional measures where the destination country does not provide an equivalent level of protection. Under the Egyptian PDPL, transfers are made on a lawful basis and, where required, with your consent or under an available legal exception.

8. Data retention

We keep personal data only for as long as necessary for the purposes in this Policy, including to satisfy legal, tax, accounting and reporting requirements. In general:

Account data is retained while your account is active and for a reasonable period afterwards, or until you ask us to delete it.
Order, invoice and payment records are retained for the period required by applicable Egyptian tax, accounting and commercial law.
Marketing contact data is retained until you unsubscribe or withdraw consent, plus a short period to record your preference.
Technical, security and audit logs are retained for a limited period consistent with security and fraud-prevention needs.
Advertising attribution cookies expire within approximately 90 days, as described in Section 5.

When data is no longer needed, we delete it or anonymise it so it can no longer be linked to you.

9. Security

We use reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. These include:

Encryption in transit using HTTPS/TLS.
Encryption of sensitive configuration secrets at rest.
Access controls and role-based permissions.
Security logging and monitoring.
Bot protection on forms.

No method of transmission or storage is completely secure, so you share information with us at your own risk. Keep your account password confidential and contact us promptly if you suspect unauthorised use of your account. If we become aware of a breach that affects your personal data, we will notify you and the competent authority as required by law.

10. Your rights

Subject to applicable law — in particular the Egyptian PDPL, and the GDPR where it applies to you — you have the right to:

Access the personal data we hold about you and receive a copy.
Correct inaccurate or incomplete personal data.
Delete your personal data where there is no lawful reason for us to keep it.
Portability — receive personal data you provided to us in a structured, commonly used and machine-readable format, where technically feasible.
Object to or restrict certain processing, including processing based on our legitimate interests, and to object at any time to direct marketing.
Withdraw consent at any time, without affecting processing carried out before withdrawal.
Complain to a supervisory authority:
In Egypt, the competent authority is the Personal Data Protection Center (PDPC).
If you are in the EU/EEA, you may lodge a complaint with your local supervisory authority.

To exercise any of these rights, contact us at mina.elia192@gmail.com. We may need to verify your identity before responding, and we will aim to respond within the timeframe required by law. If we cannot meet a request, we will explain why.

11. How to contact us and opt out

Contact us about this Policy, your personal data, or any request:

Fiorella — Email: mina.elia192@gmail.com
Phone / WhatsApp: 01550243996
Based in: Cairo, Egypt (online store)

Opt out of marketing. Every marketing email we send includes an unsubscribe link, or you can email us at mina.elia192@gmail.com and ask to be removed. You will still receive essential order and delivery messages.

Opt out of non-essential cookies. Use the cookie-consent banner to accept or reject non-essential cookies and to change your choice later, or manage cookies in your browser settings. You can also adjust your advertising preferences in Meta's ad settings.

12. Children's privacy

The Site is intended for adults. It is not directed to, and we do not knowingly collect personal data from, children under 18. If you believe a child has provided us with personal data, contact us at mina.elia192@gmail.com and we will take appropriate steps to delete it.

13. Third-party links

The Site may contain links to third-party websites, plugins or services (for example our social media pages or payment services) that we do not control. This Policy does not apply to those third parties. We encourage you to review their privacy policies before providing any personal data.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology or legal requirements. The "Last updated" date at the top of this page shows when it was last revised. Where changes are significant, we will take reasonable steps to notify you, for example by posting a prominent notice on the Site or contacting you by email. Your continued use of the Site after an update means you accept the revised Policy.

15. Contact details

If you have questions, requests or concerns about this Privacy Policy or your personal data, please contact us:

Fiorella
Email: mina.elia192@gmail.com
Phone / WhatsApp: 01550243996
Based in: Cairo, Egypt (online store)

For related information, see our Terms, Returns & Refunds, Shipping, FAQ and Contact pages, or browse the shop.