PRIVACY NOTICE

Khimji’s Watches

Khimji Ramdas LLC, operating its watches business as Khimji’s Watches (“Khimji’s Watches”, “we”, “us” or “our”), respects your privacy and is committed to protecting your personal data. This Privacy Notice explains how we collect, use, disclose, transfer, retain and protect personal data when you visit our boutiques or digital channels, purchase or service a watch, register an interest or wishlist, attend an event, communicate with us, or otherwise interact with our watches business.

This Notice is intended to support compliance with the Oman Personal Data Protection Law issued by Royal Decree No. 6/2022 and its Executive Regulations issued by Ministerial Decision No. 34/2024 (together, the “Oman PDPL”).
Internal draft for legal and compliance review before publication.

1. Who We Are and How to Contact Us

Data Controller: Khimji Ramdas LLC - Khimji's Watches

Data Protection Officer: Mr. Ali Said Ali Al Kalbani
Email: privacy@kr.om
Telephone: +968 9851 5813
Our Data Protection Officer oversees privacy compliance and responds to questions and requests concerning the processing of personal data.

Address: P.O. Box 3295, Postal Code 112, Muscat, Sultanate of Oman

2. Scope and Our Role

Khimji's Watches generally acts as a Data Controller when it determines why and how personal data is processed for its retail, clientelling, service, marketing and business operations.

In limited circumstances, we may process personal data on documented instructions from another Data Controller, such as a corporate customer or brand partner. Where this occurs, our role and responsibilities will be governed by the applicable arrangement and the Oman PDPL.

3. Personal Data We Collect

We collect personal data that is reasonably necessary for the relevant purpose. The information may include:

· Identity data, such as name, title, date of birth, nationality, Civil ID or passport details where required for identification, legal, tax or transaction purposes.
·         Contact data, such as mobile number, email address, residential or delivery address, country of residence and preferred language.
·         Transaction data, such as products purchased, invoice details, purchase date, price, payment method, refunds, exchanges and related correspondence. We do not ordinarily retain complete payment-card details where payments are processed through authorised payment providers.
·         Watch, warranty and service data, such as brand, model, reference and serial number, warranty registration, authenticity records, repair history, service requests and technical observations.
·         Preference and clienteling data, such as wishlists, watch interests, preferred brands or models, sizes, purchase preferences, appointment history and communications with our team.
·         Marketing and consent data, such as marketing preferences, consent records, opt-outs and preferred communication channels.
·         Event data, such as invitations, attendance, guest details, dietary preferences where voluntarily provided, and photographs or recordings where appropriate notice or consent has been provided.
·         Digital and technical data, such as IP address, browser type, device information, operating system, cookie identifiers, website activity and security logs.
·         Communications data, including enquiries, complaints, feedback, call or message details, and correspondence through email, telephone, WhatsApp, social media or other approved channels.
·         Corporate customer data, such as employer, designation, authorised representatives, business contact information and records needed to fulfil corporate or government orders.

4. How We Collect Personal Data

We may collect personal data:

· directly from you in a boutique, through our website, forms, messaging channels, events, appointments, purchases or service interactions;
·  from an authorised person acting for you, a corporate customer, your employer or another party involved in a transaction;
· from our watch-brand partners, authorised service networks, payment, delivery, technology and marketing providers where permitted;
· automatically when you use our websites or digital services, through cookies and similar technologies; and
· from publicly available or lawfully obtained sources, where appropriate and permitted by law.

5. Why We Process Personal Data

We process personal data for the following purposes, as applicable:

·         to manage purchases, invoices, payments, deliveries, exchanges, refunds and other transaction-related services;
·         to identify customers where required and maintain accurate customer and transaction records;
·         to manage enquiries, appointments, wishlists, expressions of interest, product availability and allocations in line with our internal and brand requirements;
·         to register or support manufacturer warranties, verify authenticity and maintain watch, warranty and service records;
·         to provide repairs, maintenance, estimates, after-sales assistance and customer support;
·         to invite customers to events, communicate product or brand updates, and send marketing only where the required consent has been obtained;
·         to understand customer preferences and improve our boutiques, products, communications and service standards;
·         to operate and secure our websites, systems and business, detect fraud, investigate misuse and protect customers, staff and property;
·         to manage corporate and government customer relationships and fulfil related orders; and
·         to comply with applicable legal, regulatory, accounting, audit and brand obligations, and respond to lawful requests from authorities.

6. Legal Basis for Processing

We process personal data only where permitted under the Oman PDPL. Depending on the activity, we may rely on:

·         your explicit consent, including for direct marketing and optional brand communications;
·         processing necessary to enter into or perform a contract with you, such as completing a purchase, arranging delivery or providing a requested service;
·         compliance with a legal or regulatory obligation, court order or lawful authority request; and
·         other lawful grounds recognised under the Oman PDPL, where applicable.
Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal and may not affect processing required for another lawful purpose.

7. Manufacturer Warranty Registration and Brand Communications

For certain watch brands, information such as your name, contact details, watch model, reference or serial number, purchase date and warranty details may be entered into or shared through the manufacturer’s authorised systems. This may be necessary to register or administer an international manufacturer’s warranty, verify authenticity, maintain product or service records, or provide brand-supported after-sales services.

The relevant manufacturer may process this information as an independent Data Controller under its own privacy notice. The manufacturer’s name, logo or systems—and in some cases the Khimji’s Watches name or logo—may appear in communications connected with the registration or service. We encourage you to review the manufacturer’s privacy notice when your information is registered.

A manufacturer may also ask whether you wish to receive its news, product information, event invitations or other direct marketing. Such brand marketing is optional and is separate from the processing needed to register or administer a warranty. Where required, the manufacturer or Khimji’s Watches will obtain your explicit consent before using or sharing your details for these communications. Refusing or withdrawing optional marketing consent will not invalidate an otherwise valid product warranty.

Where a manufacturer acts as an independent Data Controller, privacy requests concerning data held in its systems should normally be directed to that manufacturer through its official website or privacy contact. If you are unsure whom to contact, email privacy@kr.om and we will provide the relevant brand contact details or reasonable guidance.

8. Marketing, Clienteling and Events

We send marketing, promotional messages, product updates or event invitations only where the required consent has been obtained. You may withdraw consent or change your preferences at any time by using the unsubscribe method in the communication, replying to the message, contacting your boutique representative, or emailing privacy@kr.om.

We may continue to send non-marketing communications that are necessary for a transaction or service, such as appointment confirmations, warranty or repair updates, collection notifications, security messages and responses to your enquiries.

9. Cookies and Analytics

Our digital channels may use strictly necessary cookies to operate securely and correctly. We may also use analytics or similar cookies to understand website performance and usage. Where required, non-essential cookies will be used only after you provide consent. You can manage available choices through the cookie settings presented on the relevant website.

10. Who We Share Personal Data With

Where necessary and permitted, personal data may be disclosed to:

·         watch manufacturers, their group companies, authorised distributors and service centres for warranty, authenticity, repair, after-sales support and separately consented brand communications;
·         payment processors, banks, delivery and logistics providers, IT, cloud-hosting, cybersecurity, customer-management, communications, analytics and professional service providers;
·         marketing, event and creative partners, but only for authorised activities and subject to applicable consent requirements;
·         Khimji Ramdas group entities where necessary for shared administration, finance, technology, compliance or customer service;
·         corporate customers, employers or authorised representatives where the transaction or service is arranged through them; and
·         courts, regulators, law-enforcement bodies, government authorities, auditors, insurers, advisers, prospective purchasers or other parties where disclosure is required or permitted by law, or in connection with a legitimate corporate transaction.
We require service providers acting on our instructions to process personal data only for authorised purposes and to apply appropriate confidentiality, security and data-protection safeguards.

11. International Transfers

Some watch manufacturers, authorised service centres and technology or cloud-service providers may be located outside the Sultanate of Oman. As a result, personal data may be accessed, stored or otherwise processed in another country.

Before transferring personal data outside Oman, we take the steps required under the Oman PDPL, which may include assessing the level of protection, implementing appropriate contractual and organisational safeguards, and obtaining consent where required.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide warranties and after-sales support, maintain transaction and service history, meet accounting, tax, audit, regulatory and dispute-management requirements, and establish or defend legal claims.

Certain transaction, warranty and service records may be retained for at least 10 years, or longer where required by applicable law, contractual obligations, an ongoing warranty or service relationship, or a legal hold. Other information, including wishlist and marketing information, will be reviewed and deleted or anonymised when no longer required, subject to applicable retention requirements.

13. Data Security

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, destruction, misuse, unauthorised access or disclosure. Depending on the system and risk, these measures may include:

·         access controls based on job responsibilities;
·         encryption in transit or at rest where appropriate;
·         system logging, monitoring, backups and security testing;
·         confidentiality requirements and staff privacy training; and
·         vendor due diligence and contractual data-protection requirements.
No method of storage or transmission is completely secure. We therefore continually review our measures and respond to identified risks.

14. Your Rights

Subject to the conditions and limitations of the Oman PDPL, you may have the right to:

·         be informed about how your personal data is processed;
·         access your personal data and obtain a copy;
·         request correction or updating of inaccurate or incomplete personal data;
·         request erasure or deletion where the applicable conditions are met;
·         withdraw consent at any time where processing is based on consent;
·         object to or request restriction of processing in applicable circumstances;
·         request transfer of your personal data in an applicable machine-readable format; and
·         submit a complaint concerning the processing of your personal data.
To exercise a right, contact privacy@kr.om. We may need to verify your identity and request information necessary to understand and respond to your request. Where data is controlled independently by a watch manufacturer, we may direct you to the manufacturer’s appropriate privacy channel.

15. Publicly Shared Information and External Links

Please do not disclose confidential or sensitive personal information in public comments, reviews or social-media posts. Information you choose to make public may be viewed, copied or used by other parties outside our control.
Our digital channels may link to websites or services operated by watch manufacturers or other third parties. Information submitted directly to those parties is governed by their own privacy notices. We recommend reviewing those notices before providing personal data.

16. Personal Data Breaches

We maintain procedures to identify, contain, investigate, document and remediate personal data breaches. Where required by the Oman PDPL, we will notify the Ministry of Transport, Communications and Information Technology and affected individuals within the applicable requirements.

17. Changes to This Privacy Notice

We may update this Privacy Notice to reflect changes in our services, systems, brand arrangements or legal requirements. The revision date shown at the beginning of the Notice indicates when it was last updated. We encourage you to review it periodically.

18. Questions and Complaints

If you have a question, wish to exercise a privacy right, or believe your personal data has been mishandled, please contact our Data Protection Officer at privacy@kr.om or +968 9851 5813.

If we are unable to resolve your concern, you may submit a complaint to the Ministry of Transport, Communications and Information Technology through its official Personal Data Protection channels.