Privacy Policy

Privacy Policy

Last updated: 23 Oct 2026

1. Who we are

1.1 The Outer Muse Creations – F.Z.C, trading as Khutoot ("Khutoot", "we", "us", "our"), is the controller of personal data collected through khutoot.art (the "Website"). We are registered in the Ajman Free Zone, United Arab Emirates, under trade licence number 55400, with our registered address at Ajman Free Zone C1 Building, Ajman, UAE.

1.2 This policy explains how we collect, use, share and protect personal data of visitors, customers and newsletter subscribers. It is written to comply with:

  • UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data;

  • the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018; and

  • the EU General Data Protection Regulation (EU GDPR), for customers in the European Economic Area.

1.3 Privacy requests and questions: layth@khutoot.art.

2. Personal data we collect

2.1 Data you provide:

  • Order data: name, email address, phone number, billing and delivery addresses, products ordered, order value and currency.

  • Account data: name, email address, login credentials, saved addresses and order history.

  • Newsletter data: email address, name where given, subscription status and the date of consent.

  • Correspondence: the content of emails and form submissions you send us.

2.2 Payment data: card payments are processed by Stripe. We do not receive your full card number. We receive limited payment information, such as card type, the last four digits of the card and payment status.

2.3 Data collected automatically: IP address, browser and device type, approximate location derived from IP address, referring website, pages viewed and interactions with the Website. This is collected through cookies and Squarespace standard analytics, as set out in section 6.

2.4 We do not collect special category data, such as health, religious or biometric data.

3. How we use personal data

  • Processing, producing and delivering orders. Data used: order data, payment data. Legal basis: performance of a contract.

  • Creating and managing customer accounts. Data used: account data. Legal basis: performance of a contract.

  • Responding to enquiries and customer service. Data used: correspondence, order data. Legal basis: performance of a contract or steps before entering one; legitimate interests in responding to enquiries.

  • Sending the newsletter. Data used: newsletter data. Legal basis: consent.

  • Keeping accounting and tax records. Data used: order data, payment data. Legal basis: legal obligation.

  • Preventing fraud and securing the Website. Data used: order data, payment data, automatically collected data. Legal basis: legitimate interests in protecting our business and customers.

  • Measuring Website use through analytics. Data used: automatically collected data. Legal basis: consent, given through the cookie banner.

  • Establishing, exercising or defending legal claims. Data used: any relevant data. Legal basis: legitimate interests; legal obligation.

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights. We do not use personal data for automated decision-making that produces legal or similarly significant effects.

4. Who we share personal data with

  • Squarespace: website hosting, online store, customer accounts, newsletter delivery and analytics. Data shared: order, account, newsletter and automatically collected data.

  • Stripe: payment processing. Data shared: order and payment data.

  • Production partners in the UAE and the United Kingdom: producing and dispatching products, including made-to-order works. Data shared: name, delivery address, phone number, products ordered.

  • Collaboration partners: producing and dispatching Collaboration Products. Data shared: name, delivery address, phone number, products ordered.

  • Delivery carriers: delivering orders. Data shared: name, delivery address, phone number, email address.

  • Accounting software provider: bookkeeping and tax records. Data shared: order and payment data.

  • Professional advisers: legal, tax and accounting advice. Data shared: data relevant to the matter.

  • Public authorities and courts: compliance with legal obligations and legal claims. Data shared: data required by law.

4.1 Service providers process personal data on our instructions and under contractual confidentiality and security obligations. Stripe also processes payment data as an independent controller for fraud prevention and regulatory compliance, under its own privacy policy.

4.2 If Khutoot's business or assets are transferred to another party, personal data may be transferred as part of that transaction, subject to this policy.

4.3 We do not sell personal data.

5. International transfers

5.1 Khutoot is based in the UAE. Personal data you provide is processed in the UAE and by the recipients in section 4, some of which are located in other countries, including the United Kingdom and the United States.

5.2 The UAE is not covered by an adequacy decision of the UK or the European Commission. Where we transfer personal data of UK or EEA residents to another country, the transfer relies on one of the following:

  • an adequacy decision or adequacy regulations covering the destination country;

  • standard contractual clauses approved by the European Commission, with the UK International Data Transfer Addendum where applicable; or

  • the transfer being necessary to perform the contract you entered into with us, such as sending your delivery details to a production partner or carrier.

5.3 Transfers of personal data out of the UAE are made in accordance with Federal Decree-Law No. 45 of 2021.

5.4 You can request information on the safeguards used for a transfer by contacting layth@khutoot.art.

6. Cookies and analytics

6.1 Cookies are small files stored on your device when you visit a website. The Website uses two categories:

  • Strictly necessary cookies: required for the shopping cart, checkout, account login and security. These are set without consent because the Website cannot function without them.

  • Analytics cookies: used by Squarespace standard analytics to measure visits, page views, traffic sources and sales activity. These are set only if you accept them through the cookie banner.

6.2 You can accept or decline analytics cookies when the cookie banner appears on your first visit. To change your choice, clear the cookies for khutoot.art in your browser settings; the banner will then appear again.

6.3 You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies prevents the cart, checkout and account features from working.

6.4 The Website does not use advertising or third-party tracking cookies.

7. How long we keep personal data

  • Order and payment records: 7 years after the end of the tax period in which the order was placed, as required under UAE corporate tax law.

  • Account data: while the account is open; deleted on closure, except order records retained as above.

  • Newsletter data: until you unsubscribe; your email address is then kept on a suppression list only to ensure you are not contacted again.

  • Correspondence and enquiries: 2 years from the last contact.

  • Analytics data: in line with Squarespace's standard analytics retention.

When a retention period ends, personal data is deleted or anonymised.

8. Your rights

8.1 Depending on the law that applies to you, you have the right to:

  • be informed about how your personal data is used;

  • access your personal data and receive a copy;

  • have inaccurate data corrected;

  • have your data erased;

  • restrict or object to processing, including processing based on legitimate interests;

  • object to direct marketing at any time;

  • receive data you provided in a structured, machine-readable format and have it transmitted to another controller; and

  • withdraw consent at any time, without affecting processing carried out before withdrawal.

8.2 To exercise a right, email layth@khutoot.art. We may ask for information to verify your identity. We respond within one month of receiving the request. This may be extended by two further months for complex or numerous requests, in which case we will inform you within the first month.

8.3 Some rights are subject to exceptions. For example, order records required for tax purposes cannot be erased before the end of their retention period.

8.4 You can complain to a data protection authority:

  • United Kingdom: Information Commissioner's Office (ico.org.uk);

  • European Economic Area: the data protection authority in your country of residence;

  • United Arab Emirates: the UAE Data Office.

We ask that you contact us first so we can try to resolve the issue.

9. Security, children, changes and contact

9.1 We use technical and organisational measures to protect personal data against loss, misuse and unauthorised access, including encrypted connections (HTTPS), restricted access to customer data and the security controls of our service providers. No method of transmission or storage is completely secure.

9.2 The Website and our products are intended for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected such data, we delete it.

9.3 We may update this policy. The current version is published on the Website with its last updated date. Material changes are notified by email to account holders and newsletter subscribers.

9.4 Contact: The Outer Muse Creations – F.Z.C, trading as Khutoot, Ajman Free Zone C1 Building, Ajman, UAE. Email layth@khutoot.art. Phone +971 55 250 0887.