Privacy Policy

Mwl Industries FZE, trading as The Flat Set ("we", "our" or "us"), operates theflatset.com and is responsible for the personal information described in this policy.

By using our services you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use our services.

When you order: your name, email address, phone number, delivery and billing addresses, and the items you bought.

When you contact us, send a trade enquiry, request swatches or join the newsletter: the details you enter in the form.

If you create an account: your email address and password, stored in hashed form.

To make, ship and deliver your order, clear it through customs, send order and tracking updates, handle returns, answer your messages, prevent fraud and meet our legal obligations.

We send marketing emails only if you joined the newsletter, and you can unsubscribe at any time.

Payments are processed by Stripe. Your card details go directly to Stripe and are never stored by us.

We also use providers for website hosting, email delivery and error monitoring, and we share delivery details with the freight and customs partners who carry your order. We may disclose information when the law requires it.

We do not sell or share your personal information for advertising.

Your cart and chosen delivery country are kept in your browser’s local storage so they survive a page reload. The site does not use advertising trackers. You can clear this storage through your browser settings.

Google Analytics loads by default on permitted public pages using Consent Mode v2. Analytics cookie storage defaults to denied in these regions: AT, BE, BG, BR, CH, CY, CZ, DE, DK, EE, ES, FI, FR, GB, GR, HR, HU, IE, IS, IT, JP, LI, LT, LU, LV, MT, NL, NO, PL, PT, RO, SE, SI, SK; it defaults to granted elsewhere. Google resolves the region, not the page language or delivery country. Advertising storage, advertising user data and personalization remain denied. Only for an undecided regional denied default, the tag can still send cookieless visits, scrolling and SDK session measurements; denied does not mean zero network. GPC/DNT and private-page restrictions may block the tag more strictly. Enquiry/newsletter consent is separate.

Google receives the permitted page path, a generic page title, cookie-based pseudonymous identifiers and browser/device and session information. Google also receives network information such as your IP address when requests are sent, and may infer approximate location. Our manual pageviews do not include order-access URLs, query strings, fragments, form text or a business user identity.

Google may process this information outside your country, including in the United States. Its handling is described at https://policies.google.com/privacy and https://policies.google.com/technologies/partner-sites. This is not a promise that Google receives no personal information.

We configure _ga and _ga_7G48JRCT3R for at most 180 days from creation without renewing expiry on each visit; browsers may shorten that lifetime. Your explicit analytics-cookie choice is saved separately in first-party local storage (flatset:analytics-consent:v1) until you change it or clear browser storage. A stored refusal/withdrawal overrides regional defaults before tag configuration or events. Missing storage uses regional defaults; malformed or inaccessible preferences fail closed to denied. A denial-only first-party preference cookie (flatset-analytics-denied-v1, up to 365 days) backs up refusal if local storage cannot be updated. It contains no identifier; a new explicit permission must be saved successfully before collection resumes.

Google's configured retention is 2 months for event-level data and 14 months for user-level data; new activity resets the user-data retention period. These settings are separate from the browser-cookie lifetime, do not promise deletion of every aggregate report at those dates, and are not changed by withdrawing consent.

You can reject analytics or withdraw using the controls at the bottom of a public page. An explicit rejection, withdrawal or saving failure hard-stops this GA4 property before any consent update and blocks new page events, including late SDK callbacks. It also attempts to remove this property's analytics cookies. Refresh, SPA navigation and existing preferences do not undo that refusal; only new explicit permission may resume collection. Vendor code already downloaded may remain in memory, and in-flight requests are not recalled. If no browser storage can save your refusal, the page stops and warns that persistence failed; no website can promise a durable preference when all storage is blocked. Withdrawal does not automatically delete data Google already received. Use the privacy contact below for data-rights requests.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods may vary based on the type of information and applicable legal requirements.

We implement appropriate technical and organizational measures to protect your personal information. However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Depending on your location, you may have the right to access and obtain a copy of your data, correct inaccurate information, request deletion of your data (subject to legal limitations), opt out of marketing communications, and withdraw consent where applicable.

Email hello@theflatset.com for any privacy request.

Your information may be transferred to and processed in countries other than your country of residence, including where our production and customer service are run (Foshan, Guangdong, China). These countries may have different data protection laws. By using our services, you consent to such transfers.

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete such information.

We reserve the right to modify this Privacy Policy at any time. Changes will be effective immediately upon posting. Your continued use of our services after any changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

Email: hello@theflatset.com

Registered office: Mwl Industries FZE, Sharjah Publishing City Free Zone, Business Centre, Emirate of Sharjah, United Arab Emirates.