Consumer Protection & Complaints Procedure

This page combines Eastwood's Data Security and Storage Policy, Privacy Policy and Age Verification and Compliance Policy, together forming the Eastwood Consumer Protection & Complaints Procedure.

Data Security and Storage Policy

Eastwood is committed to protecting the security and integrity of all customer data collected through our website and mobile application. This Data Security and Storage Policy sets out our practices for collecting, storing and safeguarding your information in compliance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and international best practice.

Data Collection

We collect the following categories of data.

Personal Information

• Full name as shown on your Emirates ID or passport
• Date of birth (for age verification)
• Emirates ID number and copy (front and back)
• Contact details (email address, mobile number and landline, if applicable)
• Delivery address(es), including emirate, area, street, building and apartment or villa details
• Passport copy (for expatriate customers and visitors)

Financial Information

• Payment card details (processed through PCI-DSS compliant payment gateways)
• Transaction history and purchase records
• Billing address

Technical Information

• IP address and device identifiers
• Browser type and version
• Operating system and device information
• Cookies and similar tracking technologies
• Session duration and pages visited
• Geographic location data (with consent)

Transactional Data

• Order history and details, including invoices
• Product preferences and favourites
• Search queries and browsing behaviour
• Customer reviews and ratings
• Communication records (customer support enquiries, emails and chat logs)

Delivery Verification Data

• Photograph of the recipient's original Emirates ID or passport, captured at delivery
• Recipient's signature on the delivery receipt, as proof of receipt
• Delivery date, time and GPS location
• Delivery receipt slips
• Refused deliveries and the reasons for refusal

Purpose of Data Use

Your data is collected and processed for the following purposes:

• Order processing: to process, fulfil and deliver your alcohol orders
• Age verification: to verify that customers are 21 years of age or older, as required by UAE law, at registration and at delivery
• Payment processing: to process payments securely through our certified payment partners
• Customer support: to respond to enquiries, complaints and service requests
• Personalisation: to provide personalised product recommendations and user experience
• Legal compliance: to comply with UAE federal and emirate-level alcohol regulations
• Delivery records: to maintain the delivery records required by the Department of Culture and Tourism – Abu Dhabi ("DCT") and make them available for review
• Fraud prevention: to detect and prevent fraudulent transactions and unauthorised access
• Marketing communications: to send promotional offers and updates (with consent)
• Analytics: to analyse usage patterns and improve our services
• Regulatory reporting: to provide the reports required by UAE authorities by law

Data Storage

Storage Location

• Customer data is stored primarily on secure servers physically located within the United Arab Emirates
• We use UAE-based cloud infrastructure providers certified under ISO 27001 and SOC 2
• Data centres feature redundant power, climate control and physical security measures
• Backup data is also maintained within UAE jurisdiction

Data Retention Periods

• Personal identification data: retained for the duration of your account activity plus seven (7) years for regulatory compliance
• Verification and delivery records: retained for seven (7) years from the date of delivery
• Transaction records, including invoices: retained for ten (10) years
• Payment information: card details are not stored; transaction references are retained for seven (7) years
• Marketing consent data: retained until consent is withdrawn
• Browsing and technical data: retained for 24 months
• Customer support communications: retained for five (5) years

Data Deletion

Upon expiry of the applicable retention period, or on account closure where no retention obligation applies:

• data is securely deleted using industry-standard data sanitisation methods;
• multi-pass overwriting is performed for sensitive data;
• backups are purged in line with our backup retention schedule; and
• deletion certificates are maintained for audit purposes.

Security Measures

Encryption

• Data in transit: all data transmitted between your device and our servers is encrypted using the TLS 1.3 protocol with 256-bit encryption
• Data at rest: all stored data is encrypted using AES-256 encryption
• Database encryption: database files are encrypted at field level for sensitive information
• Payment data: payment card information is tokenised and processed through PCI-DSS Level 1 compliant payment gateways

Access Control

• Role-based access control (RBAC): access to customer data is restricted according to job function and necessity
• Multi-factor authentication (MFA): required for all administrative and system access
• Access logging: all data access is logged and monitored
• Regular access reviews: quarterly audits of user access rights
• Immediate revocation: access is revoked immediately when an employee leaves

Infrastructure Security

• Firewalls: next-generation firewalls with intrusion detection and prevention systems
• DDoS protection: advanced distributed denial-of-service attack mitigation
• Network segmentation: segregated networks for different security zones
• Vulnerability scanning: weekly automated scans and quarterly penetration testing
• Security patches: critical updates applied within 48 hours of release

Backup and Recovery

• Automated backups: daily incremental backups and weekly full backups
• Encrypted backups: all backups are encrypted to the same standard as primary data
• Offsite storage: backup copies are maintained in geographically separate UAE data centres
• Disaster recovery: tested recovery procedures with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour
• Business continuity plan: documented procedures for a range of incident scenarios

Regular Audits

• Internal audits: quarterly security assessments by our internal team
• External audits: annual third-party security audits by certified professionals
• Compliance assessments: regular reviews of compliance with UAE data protection law
• Log reviews: continuous monitoring of access logs and security events

Employee Training

• Security awareness: mandatory annual training for all employees
• Data protection: specialised training for staff who handle customer data
• Incident response: training on identifying and reporting security incidents
• Confidentiality agreements: all employees sign non-disclosure and data protection agreements

Data Sharing

We may share your data with the following categories of recipients.

Service Providers

All deliveries are made by Eastwood's own delivery staff. We may share data with:

• payment processors (banks and payment gateways);
• delivery-management and route-planning software providers;
• cloud hosting providers;
• customer relationship management systems;
• marketing and analytics platforms (with consent); and
• customer support software providers.

All service providers are:

• contractually bound by data processing agreements;
• required to maintain equivalent security standards;
• prohibited from using data for their own purposes; and
• subject to regular compliance audits.

Legal and Regulatory Authorities

We may share data with government authorities when:

• required by UAE law or regulation;
• responding to valid legal requests (court orders and subpoenas);
• complying with alcohol regulatory requirements, including making delivery records available to DCT for review;
• co-operating with law enforcement investigations; or
• protecting our legal rights and preventing fraud.

What We Do Not Do

• We will never sell your personal data to third parties.
• We will never rent your personal data to third parties.
• We will never share your data for marketing purposes without your explicit consent.

Customer Rights

Under UAE data protection law, you have the following rights.

Right of Access

• Request a copy of all personal data we hold about you
• Receive your data in a structured, commonly used format
• Response time: within 30 days of a verified request

Right to Correction

• Update inaccurate or incomplete information
• Self-service corrections are available through your account settings
• Contact customer support for assistance

Right to Deletion

• Request deletion of your personal data (subject to legal retention requirements)
• Account closure and data removal
• Note: verification, delivery and transaction records may be retained for legal compliance

Right to Withdraw Consent

• Withdraw consent for marketing communications at any time
• Opt out of personalisation and analytics
• Manage communication preferences in your account settings

Right to Object

• Object to the processing of your data for direct marketing
• Object to profiling and automated decision-making

Right to Data Portability

• Request your data in a machine-readable format
• Transfer your data to another service provider where technically feasible

How to Exercise Your Rights

To exercise any of these rights, please contact us:

• Email: support@eastwoodintl.com
• Telephone: +971 2 671 4300
• WhatsApp: +971 56 546 3446
• Online: through your account settings

Cookies and Tracking Technologies

We use cookies and similar technologies to enhance the user experience.

Types of Cookies

• Essential cookies: required for website functionality (shopping basket and login sessions)
• Performance cookies: analyse usage patterns and improve performance
• Functional cookies: remember preferences and settings
• Marketing cookies: deliver personalised advertisements (with consent)

Managing Cookies

• Browser settings can be adjusted to refuse cookies
• A cookie preference centre is available on our website
• Note: disabling essential cookies may affect website functionality

Data Breach Notification

In the unlikely event of a data breach:

• we will notify affected customers within 72 hours of discovering the breach;
• the notification will describe the nature of the breach, the data affected and the remedial action taken;
• the relevant UAE authorities will be informed as required by law; and
• containment and investigation procedures will be implemented immediately.

International Data Transfers

While we store data primarily within the UAE:

• any international transfer will comply with UAE data protection requirements;
• adequate safeguards will be implemented (such as standard contractual clauses or adequacy decisions); and
• transfers will be made only to jurisdictions with equivalent data protection standards.

Policy Updates

This Policy may be updated to reflect:

• changes in UAE data protection legislation;
• new data processing activities or technologies; and
• enhanced security measures.

Material changes will be communicated by email and website notice. Continued use of the Platform after an update constitutes acceptance.

Contact Information

For questions or concerns about data security:

• Email: support@eastwoodintl.com
• Telephone: +971 2 671 4300
• WhatsApp: +971 56 546 3446
• Online: through your account settings
• Business hours: seven days a week, 9:00 am to 6:00 pm (GST)

Privacy Policy

Eastwood ("we", "us" or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and safeguard your personal information when you visit our website (www.eastwoodintl.com) or use our mobile application, and when you purchase alcoholic beverages from us. This Policy complies with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and international privacy standards.

Information We Collect

Information You Provide Directly

Account registration:

• Full name (as shown on your Emirates ID or passport)
• Date of birth (for age verification – you must be 21 years of age or older)
• Email address
• Mobile telephone number
• Username and password
• Religion (to verify non-Muslim status as required by UAE law)

Identity verification:

• Emirates ID number
• Scanned copy of your Emirates ID (front and back)
• UAE Pass verification results
• Passport copy (for expatriate customers and visitors)
• Visa information (for expatriates and visitors)

Delivery information:

• Private residential delivery address (emirate, area, street, building and apartment or villa number)
• Delivery instructions and preferences
• Alternative contact numbers

Delivery verification:

• Photograph of your original Emirates ID or passport, captured at delivery
• Your signature on the delivery receipt
• Delivery date, time and location

Payment information:

• Payment card details (last four digits only – full details are processed by the payment gateway)
• Billing address
• Transaction history and invoices

Communications:

• Customer service enquiries and correspondence
• Product reviews and ratings
• Feedback and survey responses
• Marketing preferences

Information Collected Automatically

Device and usage information:

• IP address and device identifiers
• Browser type and version
• Operating system
• Mobile device model and manufacturer
• Screen resolution
• Time zone and language settings

Browsing activity:

• Pages viewed and products browsed
• Search queries
• Time spent on pages
• Click patterns and navigation paths
• Referral sources (how you found our website)

Location data:

• Approximate location based on IP address
• Precise location (with your consent, for delivery purposes)

Information from Third Parties

• Social media profile information (if you sign in via social media)
• Identity verification results from UAE Pass
• Payment verification from financial institutions
• Marketing analytics from advertising partners

How We Use Your Information

Order Fulfilment and Service Delivery

• Process and fulfil your orders
• Arrange delivery by our own delivery staff
• Send order confirmations and delivery notifications
• Process payments and prevent fraud
• Handle returns, refunds and exchanges

Legal Compliance and Age Verification

• Verify that you are 21 years of age or older, at registration and at delivery
• Confirm non-Muslim status as required by UAE alcohol regulations
• Comply with UAE federal and emirate-level alcohol laws
• Maintain delivery and verification records for DCT review and regulatory audits
• Report to authorities as required by law

Customer Support

• Respond to your enquiries and support requests
• Resolve complaints and disputes
• Provide product information and recommendations
• Conduct customer satisfaction surveys

Personalisation and Improvement

• Personalise your shopping experience
• Recommend products based on your preferences and browsing history
• Remember your preferences and settings
• Improve website and app functionality
• Analyse usage patterns and trends
• Conduct A/B testing and user research

Marketing Communications (With Your Consent)

• Send promotional offers and discounts
• Notify you about new products and arrivals
• Share newsletters and educational content
• Conduct promotional campaigns and competitions
• Display personalised advertisements

Security and Fraud Prevention

• Detect and prevent fraudulent transactions
• Protect against unauthorised access
• Monitor for suspicious activity
• Enforce our Terms and Conditions
• Investigate and resolve security incidents

Legal Basis for Processing

We process your personal data on the following legal bases:

• Performance of a contract: to create your account, process your orders and deliver your products
• Legal obligation: to verify your age and identity, and to maintain and provide the records required by DCT and other UAE authorities
• Legitimate interests: to prevent fraud, secure the Platform and improve our services
• Consent: for marketing communications, marketing cookies and precise location data
• Protection of rights, safety and security: to protect Eastwood, our customers and the wider community

How We Share Your Information

Service Providers and Business Partners

We share information with trusted third parties who assist in our operations.

Payment processing:

• Payment gateways and processors (PCI-DSS compliant)
• Banks and financial institutions
• Fraud detection services

Delivery and logistics:

• All deliveries are made by Eastwood's own delivery staff; orders are never passed to third-party couriers
• Route optimisation and delivery-management software providers

Technology infrastructure:

• Cloud hosting providers
• Content delivery networks
• Database management services
• Security and monitoring tools

Marketing and analytics:

• Email marketing platforms
• SMS notification services
• Analytics providers
• Advertising networks (with consent)

Customer support:

• CRM systems
• Help desk software
• Call centre services

All service providers:

• are contractually obliged to protect your data;
• may only use data for specified purposes;
• must maintain equivalent security standards; and
• are prohibited from selling or sharing data with others.

Legal and Regulatory Authorities

We may disclose information to government authorities when:

• required by UAE law or legal process;
• responding to valid court orders or subpoenas;
• complying with alcohol regulatory requirements, including DCT review of delivery records;
• co-operating with law enforcement investigations;
• protecting our legal rights or defending against claims; or
• preventing or investigating suspected illegal activity.

Business Transfers

In the event of:

• a merger, acquisition or sale of business assets;
• bankruptcy or insolvency proceedings; or
• corporate restructuring,

your information may be transferred to the new entity, subject to:

• continuation of this Privacy Policy or equivalent protection;
• advance notice to affected customers; and
• an opportunity to opt out of the transfer.

What We Never Do

• We never sell your personal information to third parties.
• We never rent or lease your personal information.
• We never share your data for third-party marketing without your explicit consent.

Data Retention

We retain your information for different periods, depending on the type of data:

Type of data	Retention period
Personal identification data	Duration of account activity plus seven (7) years
Verification and delivery records (including ID photographs and signatures)	Seven (7) years from the date of delivery
Transaction records, including invoices	Ten (10) years
Payment transaction references	Seven (7) years (card details are not stored)
Marketing consent data	Until consent is withdrawn
Browsing and technical data	24 months
Customer support communications	Five (5) years

After the retention period expires, data is:

• securely deleted or anonymised;
• removed from all systems, including backups; and
• logged as deleted, so that deletion can be verified.

Your Rights and Choices

Access and Portability

• Request a copy of all personal data we hold
• Receive your data in a structured, machine-readable format
• Transfer your data to another service provider
• Access your data via your account dashboard or by email request

Correction and Update

• Update account information through your account settings
• Correct inaccurate or incomplete data
• Add missing information
• Contact support for assistance with updates

Deletion and Erasure

• Request deletion of your account and personal data
• Close your account through your account settings or a support request
• Note: some data may be retained for legal compliance (e.g. verification, delivery and transaction records)
• Deletion requests are processed within 30 days of verification

Marketing Opt-Out

• Unsubscribe link in every marketing email
• SMS opt-out by replying STOP
• Manage your preferences in your account settings
• Note: you cannot opt out of transactional messages (such as order confirmations)

Objection and Restriction

• Object to processing for direct marketing
• Restrict processing while disputes are resolved
• Object to profiling and automated decision-making
• Disable personalisation features

Withdrawal of Consent

• Withdraw previously given consent at any time
• Withdrawal affects future processing only (not past activities)
• Withdrawal may affect service availability (e.g. account features)

How to Exercise Your Rights

Contact us through:

• Email: support@eastwoodintl.com
• Telephone: +971 2 671 4300
• WhatsApp: +971 56 546 3446
• Online: through your account settings

We will respond within 30 days. Identity verification may be required.

Cookies and Tracking Technologies

Types of Cookies We Use

Essential cookies (always active):

• Shopping basket functionality
• User authentication and session management
• Security features
• Age verification status

Performance cookies:

• Website analytics and usage statistics
• Error tracking and debugging
• Page load time measurement

Functional cookies:

• Remember language and region preferences
• Store delivery address selection
• Maintain filter and sort preferences

Marketing cookies (with consent):

• Personalised product recommendations
• Retargeting advertisements
• Social media integration
• Campaign effectiveness tracking

Managing Cookie Preferences

• Cookie banner settings on your first visit
• Cookie preference centre in your account settings
• Browser cookie controls and settings
• Third-party opt-out tools (e.g. NAI and DAA)

Other Tracking Technologies

• Web beacons and pixels (email tracking)
• Mobile device identifiers (advertising ID)
• Local storage and session storage

Data Security

We implement comprehensive security measures (detailed under Data Security and Storage Policy above), including:

• TLS 1.3 encryption for data transmission;
• AES-256 encryption for data storage;
• PCI-DSS compliant payment processing;
• multi-factor authentication;
• regular security audits and penetration testing;
• employee background checks and training; and
• incident response procedures.

International Data Transfers

Your data is stored primarily within the UAE. If an international transfer is necessary:

• we ensure that adequate safeguards are in place;
• standard contractual clauses may be used;
• data is transferred only to jurisdictions with equivalent data protection; and
• we comply with UAE cross-border data transfer requirements.

Age Restriction

Eastwood does not knowingly collect or solicit personal information from anyone under the age of 21.

• All users must be 21 years of age or older
• Age verification is required during registration and again at delivery
• If we learn that we have collected data from someone under 21, it will be deleted immediately, unless we are required by law to retain a record of a refused delivery
• Parents and guardians should contact us if they believe their child has provided information

Third-Party Links

Our website may contain links to third-party websites:

• we are not responsible for third-party privacy practices;
• please review the privacy policies of external websites;
• social media platforms have their own privacy policies; and
• third-party payment processors operate under their own policies.

Changes to This Privacy Policy

We may update this Policy to reflect:

• changes in UAE data protection laws;
• new features or services;
• enhanced security measures; or
• changes in our data processing practices.

When we make material changes, we will provide:

• email notification to registered users;
• a prominent website banner for 30 days;
• an updated "Last updated" date; and
• an opportunity to review the changes before continued use.

Contact Us

For privacy-related questions or concerns:

• Email: support@eastwoodintl.com
• Telephone: +971 2 671 4300
• WhatsApp: +971 56 546 3446
• Post: Eastwood General Trading L.L.C., Warehouse 09, KLP3, Kezad, Abu Dhabi, United Arab Emirates
• Online: through your account settings

Age Verification and Compliance Policy

Eastwood is committed to strict compliance with UAE regulations and DCT requirements governing the sale of alcoholic beverages. This Policy sets out our age verification procedures and legal compliance measures.

Legal Requirements

UAE federal and emirate-level regulations require:

• a minimum age of 21 years for the purchase and consumption of alcohol;
• that the purchaser is non-Muslim;
• that sale is not made in prohibited areas; and
• that only licensed retailers are authorised to sell.

The 21+ age restriction is displayed on the Eastwood app and website.

Multi-Stage Verification Process

Registration Stage

During account creation:

• Date of birth declaration (must be 21 or older)
• Identity verification through UAE Pass, or upload of your Emirates ID or passport (both sides)
• Automated OCR verification of identity documents
• Selfie verification for identity matching

Order Placement Stage

• Account verification status check
• Age confirmation prompt before checkout
• Delivery address validation: private residential addresses within the Emirate of Abu Dhabi only

Delivery Stage

• Mandatory ID verification at delivery
• The original, physical Emirates ID or passport must be presented to the delivery staff member (photocopies and digital images are not accepted)
• Visual age verification by trained staff
• The ID must match the registered account holder
• Delivery is made only at the private residential address on the order
• The ID is photographed for record-keeping
• The recipient signs the delivery receipt as proof of receipt, and a delivery receipt slip is issued

Delivery is refused if:

• the recipient is under 21 years of age, or cannot prove that they are 21 or older;
• the recipient is clearly intoxicated;
• the recipient appears to be under the influence of drugs;
• no original, valid ID is presented, or the ID does not match the account holder;
• the address is not a private residence; or
• the recipient refuses to complete verification or to sign for the order.

Document Verification Standards

Accepted Identification

UAE residents:

• Emirates ID (mandatory)
• Valid residence visa

Tourists and visitors:

• Valid passport with a UAE entry stamp
• Valid tourist visa or entry record

Document Quality Requirements

• Clear, legible images
• All four corners visible
• No glare or shadows obscuring information
• Text and photograph clearly visible
• Front and back captured separately

Fraud Detection

• Automated checks for document tampering
• Manual review of suspicious submissions
• A blacklist of known fake ID patterns
• Cross-referencing with previous submissions
• Immediate account suspension for fraud attempts

Tourists and Visitors

• Tourists may purchase with a valid passport and a UAE entry stamp or visa
• Delivery is made to a private residential address only; delivery to hotels or hotel apartments is not available
• Purchase limits may apply
• Eligibility is valid for the duration of the visitor's stay

Consequences of Non-Compliance

Account Actions

• Immediate account suspension for providing false information
• Permanent ban for repeat violations
• Any refund for an order cancelled due to verification failure is subject to review under the Eastwood Refund, Return & Exchange Policy
• Information shared with law enforcement where required

Legal Consequences

• Violations reported to the regulatory authorities
• Potential criminal charges under UAE law
• Fines and penalties in accordance with UAE regulations

Staff Training

All Eastwood personnel receive training on:

• UAE alcohol sale regulations;
• age verification procedures;
• document authentication;
• signs of fraud, intoxication and drug use;
• residential-address and safe transport requirements;
• delivery refusal procedures; and
• record-keeping and reporting requirements.

Record-Keeping

We maintain records of:

• all customer verification documents;
• age verification confirmations;
• invoices;
• delivery receipt slips and recipient signatures;
• recipient details and delivery ID checks (photographic evidence);
• the delivery date, time and address of every delivery;
• product details for every order; and
• refused deliveries and the reasons for refusal.

Verification and delivery records are retained for seven (7) years, and invoices and transaction records for ten (10) years, in accordance with applicable law. All records are available to DCT for review on request, within two (2) working days, or immediately during an inspection.

Contact Information