Personal data processing assessment and practical recommendations

BIOGLAM GLOBAL FZCO | Dubai, United Arab Emirates | bioglamglobal.com

21 July 2026

1. Scope and approach

This memorandum reviews the personal data processing carried out through the bioglamglobal.com Shopify store and connected tools against the requirements of the PDPL (Federal Decree-Law No. 45 of 2021), the E-Commerce Law (Federal Decree-Law No. 14 of 2023) and the Consumer Protection Legislation (Federal Law No. 15 of 2020 and Cabinet Decision No. 66 of 2023). It maps each processing activity, identifies BIOGLAM's role and the applicable legal basis, flags gaps, and sets out practical, prioritised recommendations. A key structural point frames the whole review: the BIOGLAM Longevity Evaluation collects lifestyle data (habits, sleep, nutrition, activity, goals), which is ordinary personal data collected under recorded written consent; the sensitive-data regime under the PDPL is engaged only at the later program stage where biomarker and laboratory results enter the stack, and the controls below are tiered accordingly.

2. Data flow map and analysis

2.1 Customer accounts

Shopify customer accounts store name, email, addresses, order history and login credentials. BIOGLAM is controller; Shopify is processor under the Shopify Data Processing Addendum, which is incorporated into the Shopify Terms of Service. Data is hosted on Shopify's global cloud infrastructure outside the UAE, engaging the PDPL cross-border transfer rules. Assessment: acceptable with contractual safeguards documented; ensure account creation is optional (guest checkout available) and that the Privacy Policy is linked at registration.

2.2 Checkout and payments

Checkout collects identity, contact, delivery and payment data. Card data is processed by Shopify Payments or other gateways under PCI DSS; BIOGLAM never receives full card numbers. Legal basis: performance of contract and legal obligation (tax invoicing). Assessment: low risk, provided the checkout displays the total price inclusive of VAT and delivery before payment, links the Privacy Policy and Sale Terms, and issues electronic invoices as the E-Commerce Law requires. Marketing consent at checkout must be a genuine unticked opt-in; Shopify's "email me with news and offers" checkbox must not be pre-selected.

2.3 Contact forms and support

Enquiries via Shopify contact forms or email create communications records. Legal basis: legitimate interest and contract. Assessment: low risk; define a retention period (recommended [36] months) and avoid inviting program details through general contact forms; route Evaluation responses and any future biomarker information only through the dedicated consented flows.

2.4 Newsletter subscriptions

The current "Opening soon" page collects email addresses for launch notification. This is marketing processing requiring opt-in consent under the PDPL and the E-Commerce Law's consumer marketing provisions. Assessment: three fixes needed now, before launch: add a short consent statement and Privacy Policy link beneath the capture field; ensure a working unsubscribe link in every email; keep a consent record (Shopify stores timestamp and source automatically, which should be preserved).

2.5 Intake forms (Tally)

Tally hosts the BIOGLAM Longevity Evaluation, a lifestyle questionnaire covering habits, sleep, nutrition, activity, stress management and goals, on EU-based infrastructure. Classification: ordinary personal data, not sensitive data, provided the questionnaire holds its design line; it must not ask about medical conditions, diagnoses, medications, symptoms or mental health, since any such question would reclassify the whole flow as sensitive. Requirements: a recorded written consent step at the start of the form, in plain language, stating what is collected, why, and with whom it may be shared; Tally's Data Processing Agreement accepted and archived; form access restricted; responses transferred into the controlled system of record rather than accumulating indefinitely; and a standing review rule that any new question is checked against the lifestyle-only design line before it ships. If a future program stage adds biomarker or laboratory results, that flow is sensitive data and takes the stricter regime: explicit consent naming the partner categories, plus the Airtable controls in 2.6.

2.6 Program database (Airtable)

Airtable will act as the operational database, including member lifestyle and wellness data, hosted in the United States. Requirements: execute Airtable's DPA; enforce workspace-level access controls, two-factor authentication and least-privilege sharing (no publicly shared views containing personal data); and record Airtable in the processing register as a cross-border transfer with contractual safeguards. Given sensitivity, consider Airtable Enterprise or an equivalent plan with granular permissions before scaling past the founding-member cohort.

2.7 Cookies, analytics and marketing tools

Shopify sets strictly necessary cookies (cart, session, security) plus analytics cookies; additional pixels (such as Google Analytics or Meta Pixel) may be added for launch marketing. Under the PDPL consent model, non-essential cookies require prior consent. Assessment: implement a consent banner integrated with Shopify's Customer Privacy API so that analytics and marketing tags fire only after consent; publish the cookie table page referenced in the Privacy Policy; and re-audit whenever a new app or pixel is installed.

2.8 Third-party Shopify apps

Every installed Shopify app that reads customer data is a processor or independent controller. Assessment: before launch, run an app audit; remove unused apps; for each retained app, record what data it accesses, where it is hosted, and the terms governing it. Adopt a standing rule that no app touching customer data is installed without this check.

3. Conclusion

The Bioglam Global, Web Site stack is workable under UAE law with the safeguards above. The critical items (published legal suite, cookie consent, clean marketing opt-in) and The Longevity Wellness Evaluation itself sits comfortably in the ordinary personal-data regime with recorded written consent.