Privacy policy

Last updated: 20 October 2026

This policy explains how Musalla & Co collects, uses and protects your personal information when you visit our website, buy from us, sign up to our emails or get in touch. We've kept it as clear and short as we can. If anything is unclear, email us at musallaco@gmail.com.

1. Who we are

Musalla & Co is run by Omar Mahmoud, a sole trader based in the United Kingdom. Under UK data protection law, Omar Mahmoud trading as Musalla & Co is the "controller" of your personal information. This means we decide how and why it is used, and we are responsible for looking after it.

You can contact us about anything in this policy at musallaco@gmail.com. Our postal address is available on request.

2. The information we collect

Depending on how you use our website, we may collect:

  • Contact and delivery details: your name, email address, phone number, and billing and delivery addresses.
  • Order details: what you buy, how much you paid, any discount codes you used, and any returns or refunds.
  • Payment details: payments are handled securely by Shopify Payments and, if you choose it, Klarna. We never see or store your full card number. We only receive limited details, such as the card type, the last four digits and whether the payment went through.
  • Account details: if you create an account, your login details and order history.
  • Messages: anything you tell us when you email us, use our contact form or send a wholesale enquiry.
  • Marketing preferences: whether you've signed up to our emails, and how you interact with them, for example whether you open an email or click a link.
  • Reviews: if you send us a review or testimonial, your name, town or city, photo and comments. We only publish these with your permission.
  • Device and usage information: your IP address, browser, device type and how you use our website, collected through cookies and similar technologies (see section 8).

We collect most of this information directly from you. Some of it comes from the services we use to run our shop, such as Shopify, Klarna and our delivery partners.

3. How we use your information and why

UK data protection law says we must have a valid reason, called a "lawful basis", for each way we use your information. Here is what we do and the lawful basis we rely on:

  • To process and deliver your order, take payment, handle returns and refunds, and keep you updated about your order.
    Lawful basis: to perform our contract with you.
  • To keep financial and tax records.
    Lawful basis: legal obligation.
  • To prevent fraud and keep our website secure, including automatic fraud checks on payments.
    Lawful basis: our legitimate interests in protecting our business and our customers.
  • To answer your questions and handle wholesale enquiries.
    Lawful basis: our legitimate interests in running our business and replying to you, or taking steps you've asked for before entering into a contract.
  • To send you marketing emails, including your welcome discount, new designs and offers.
    Lawful basis: your consent. You can unsubscribe at any time using the link at the bottom of every email.
  • To show reviews and testimonials on our website.
    Lawful basis: your consent.
  • To understand how our website is used and improve it, using analytics cookies.
    Lawful basis: your consent, given through our cookie banner.
  • To show you relevant adverts on Facebook, Instagram, Google and TikTok, and to measure how well our adverts work.
    Lawful basis: your consent, given through our cookie banner.
  • To comply with the law, respond to lawful requests from authorities and deal with any legal claims.
    Lawful basis: legal obligation, or our legitimate interests in protecting our legal rights.

You don't have to give us your personal information. However, we need your contact, delivery and payment details to fulfil an order, so without them we can't sell to you.

4. Who we share your information with

We never sell your personal information. We only share it with trusted companies that help us run our shop, and only as much as they need:

  • Shopify, which hosts our website and online shop and provides our checkout, card payments (Shopify Payments), email marketing (Shopify Messaging) and order tools. If you use Shop Pay, Shopify also handles your information under its own privacy policy.
  • Klarna, if you choose to pay with Klarna. Klarna may check your identity and assess whether its payment options are right for you. It uses your information under its own privacy notice.
  • Delivery companies, which receive your name, address and contact details so they can deliver your order.
  • Meta (Facebook and Instagram), Google and TikTok, if you accept analytics or marketing cookies, to help us measure and show our adverts.
  • Professional advisers, such as our accountant, where needed.
  • Authorities, such as HMRC or the police, where the law requires us to.
  • A new owner, if our business is ever sold or transferred.

5. International transfers

Some of the companies above store or process information outside the UK, for example in Canada, the United States or the European Economic Area. When this happens, your information is protected by safeguards recognised under UK law, such as adequacy regulations, the UK-US Data Bridge or the UK International Data Transfer Agreement.

6. How long we keep your information

  • Orders and payment records: 6 years, as required for tax and accounting.
  • Your account: until you ask us to close it.
  • Marketing emails: until you unsubscribe. After that, we keep your email address on a "do not contact" list so we don't email you again by mistake.
  • Customer service and wholesale enquiries: 2 years after we were last in touch.
  • Reviews and testimonials: for as long as they appear on our website, or until you ask us to remove them.
  • Cookies: from the end of your visit up to 2 years, depending on the cookie, or until you clear them from your browser.

7. Your rights

Under UK data protection law, you have the right to:

  • ask for a copy of the personal information we hold about you;
  • ask us to correct information that is wrong or incomplete;
  • ask us to delete your information;
  • ask us to limit how we use your information;
  • object to how we use your information, including an absolute right to stop direct marketing;
  • ask us to send your information to you or to another company in a commonly used format;
  • withdraw your consent at any time where we rely on it (this doesn't affect anything we did before you withdrew it);
  • not be subject to decisions made only by automated means that have a significant effect on you.

To use any of these rights, email us at musallaco@gmail.com. It's free, and we'll reply within one month. We may need to confirm your identity first. Some rights only apply in certain situations, so if we can't fully meet your request, we'll explain why.

8. Cookies

Cookies are small files stored on your device when you visit a website. We use three types:

  • Essential cookies that make our shop work, such as remembering what's in your basket and keeping checkout secure. These are always on.
  • Analytics cookies from Shopify and Google that help us understand how people use our website.
  • Marketing cookies from Meta, Google and TikTok that help us show and measure our adverts.

We only use analytics and marketing cookies if you agree to them through our cookie banner. You can change your mind at any time by clearing cookies in your browser, after which we'll ask you again.

9. Children

Our website isn't intended for children under 13, and we don't knowingly collect their information. If you think a child has given us their details, please contact us and we'll delete them.

10. Keeping your information safe

Our website and checkout are encrypted, and card payments are handled by providers that meet the Payment Card Industry Data Security Standard (PCI DSS). Only people who need your information to run our shop can access it. No system is completely secure, but we take sensible steps to protect your information.

11. Complaints

If you're unhappy with how we've handled your information, please email us first at musallaco@gmail.com. We'll acknowledge your complaint within 30 days and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top. If we make important changes, we'll let you know by email or on our website where appropriate.