Privacy policy
Who is responsible
Cova House is a collectibles house based in Dubai, United Arab Emirates, and is the controller of the personal data described here. Every privacy question, request or complaint is handled by Client Services at support@covahouse.com.
What the House collects, and why
| Data | Why it is held | Where it lives |
|---|---|---|
| Name, email address, and a telephone number only where you give one | To confirm an order, arrange delivery and answer enquiries | The House's commerce platform |
| Delivery address | To deliver the object and to satisfy the carrier | The House's commerce platform, and the carrier for that shipment |
| Order and payment records: what was bought, when, the amount, the currency and the payment status | To complete the sale, to account for it, and to handle returns, guarantee claims and disputes | The House's commerce platform, with financial records also held by the payment provider |
| Card details | The House never sees or stores these. They go directly to the payment provider | Payment provider only |
| Account details, where you create an account | To show you your own orders | The House's commerce platform |
| Enquiry correspondence, including Price on Request and Sell With Us enquiries | To answer the enquiry and keep a record of what was agreed | The House's business email provider |
| Object records linked to a sale, including Object Passport evidence where one is issued | To prove what was sold and to honour the guarantee | The House's secure systems |
| Website usage data | To keep the site working and secure | The House's commerce platform |
The House collects only what a genuine business, transaction, security or service purpose requires. It does not build behavioural profiles for advertising, it does not sell personal data, and it does not share a customer's identity with a seller or a seller's identity with a buyer.
Why the House is allowed to hold it
The House relies on the grounds permitted by UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, as follows.
| Purpose | Ground |
|---|---|
| Completing an order, delivering an object, handling a return or a guarantee claim, answering an enquiry | Necessary to perform a contract with you, or to take steps at your request before one |
| Keeping accounting, tax and transaction records | Necessary to comply with a legal obligation |
| Protecting the store and its customers from fraud and abuse, and keeping the site secure | Necessary for the legitimate interests of the House, weighed against your own interests |
| Anything optional, including any future marketing message | Your consent, which you may withdraw at any time by writing to support@covahouse.com |
The House does not send marketing email without consent, and it does not make decisions about you by automated means alone.
Who else handles this data
| Who | Role |
|---|---|
| The House's commerce platform | The storefront, the checkout, customer accounts and order records |
| The payment provider | Card processing and settlement. The provider is named at checkout before you pay |
| Carriers | Delivery, and the address and contact details needed for it |
| The House's secure systems | Object records and guarantee evidence |
| The House's business email provider | Correspondence with Client Services at support@covahouse.com |
Each of these acts on the House's instructions under a contract, and none of them may use your data for its own purposes. The House will tell you which providers it uses if you ask Client Services. The House does not sell personal data and does not share it with advertisers or data brokers. It discloses data to a public authority only where the law requires it.
Data leaving the United Arab Emirates
These services operate internationally, so your data may be processed outside the United Arab Emirates. The House transfers personal data abroad only where the destination is recognised as providing an adequate level of protection, or where its contract with the processor imposes protection equivalent to that required by UAE law, or where the transfer is necessary to perform the contract you have asked for. You may ask support@covahouse.com which safeguard applies to a particular service.
How long the House keeps it
| Record | Retention |
|---|---|
| Order, payment, tax and accounting records | At least five years from the end of the financial year the record belongs to, as UAE tax and commercial record-keeping law requires, and longer only while a dispute or claim remains open |
| Object Passport and guarantee evidence for a sold object | For as long as the object's record and any guarantee obligation exist |
| Enquiry correspondence that did not lead to a sale | Twelve months from the last message, then deleted |
| Customer account data | While the account exists. If you close it, the account is deleted within thirty days, apart from the order records the House must keep above |
| Security, fraud and access records | Twelve months, and longer only where a specific investigation or legal obligation requires it |
The House does not keep behavioural detail indefinitely simply because it can. Anything outside the table above is deleted or aggregated once it has served its purpose.
Your rights
Under UAE data protection law you may ask what the House holds about you and receive a copy of it, ask for it to be corrected or completed, ask for it to be deleted where no legal obligation requires the House to keep it, ask for its use to be restricted, object to processing carried out for the House's legitimate interests, ask to receive it in a portable machine-readable form, and withdraw any consent you have given.
Write to support@covahouse.com. The House will ask you to confirm your identity, so that no one else can obtain your data, and will not ask for more identification than that needs. The House will respond within the time required by applicable law. Exercising a right is free, and it never affects the service you receive.
If you are not satisfied with the outcome, you may complain to the UAE Data Office, the national data protection regulator, and to any other authority competent for you.
Security
Access to customer records is limited to what each system needs, the House's own records require separate credentials from the storefront, administrative accounts require multi-factor authentication, and data is encrypted in transit and at rest. Payment card data never reaches the House. No system is perfect: if a breach occurs that is likely to affect your data, the House will notify the UAE Data Office and the affected customers without undue delay, saying plainly what happened, what it affects and what to do about it.
Cookies
This store uses only the cookies needed to make it work: to keep a cart and a session, to keep the checkout secure, and to remember a language choice. The House does not use advertising or cross-site tracking cookies. Your browser can block or delete cookies; the checkout will not function without the essential ones.
Children
The House is intended for adults and does not knowingly collect personal data from children. If the House learns that it holds a child's data, it deletes it.
Changes
The House publishes the date of the current version and keeps it accurate. If it changes anything that matters to you, it will say so here rather than quietly.
Last updated: 19 September 2026.