Privacy Policy

1. Who we are

Camel Mountain Ltd., company no. 515073732, 19 Shmutkin St., Rishon LeZion, Israel ("Camel Mountain", "we", "us"), runs the online store at www.camelmountain.com and its related digital services (together, the "site"). We respect the privacy of the people who use our services and handle personal information openly and in line with the law.

This policy explains what personal information we collect when you use the site and our services, why we use it and on what legal basis, who we share it with, how long we keep it, what your rights are and how to contact us. It forms part of our Terms of Sale.

We are the controller of your personal information for the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR and the Israeli Protection of Privacy Law, and we own the database in which it is kept.

You are not legally required to give us personal information. Without certain details, however, we cannot provide some services (for example delivering an order, giving support or taking payment).

We may update this policy to reflect changes in technology, our business or the law. The binding version is the one published on the site, with its date at the top. If we make a material change, we will tell you on the site or by email.

2. What information we collect

a. Information you give us: for example your first and last name, phone number, email address, shipping and billing address, order notes, preferences, messages and photos you send to customer service, and reviews.

b. Order and account information: your purchase history, order status, rewards balance, and payments made through our secure payment processor. We do not store full card numbers; we receive only the last four digits, the card type and an approval number.

c. Technical and usage information: IP address, online identifiers, browser and device type, operating system, pages visited, time spent, referring pages and interactions. Information collected by analytics and advertising cookies is collected only with your consent (section 6).

d. Information from third parties: for example delivery status from postal and delivery companies, payment confirmations from the payment processor, and, if you choose to contact us there, your WhatsApp or social media name and number.

e. Job and supplier applications (if any): the CV and contact details you send us on your own initiative.

We do not ask for sensitive information (such as health data), and we ask you not to send it to us.

3. How we collect information

• Directly from you when you browse, register, buy, contact customer service, fill in forms or join our mailing list.
• Automatically through cookies and similar technologies (section 6).
• From third parties acting for us, under the law and our agreements with them (for example delivery companies, the payment processor, email and analytics providers).

4. Why we use it, and the legal basis

• a. To perform our contract with you and provide our services (GDPR Art. 6(1)(b)): processing and delivering orders, taking payment, customer service, returns, exchanges, warranty claims and repairs, your account and rewards.
• b. To comply with legal obligations (Art. 6(1)(c)): keeping tax and accounting records, issuing invoices, preventing fraud, and keeping records the law requires.
• c. For our legitimate interests (Art. 6(1)(f)): securing our systems, preventing fraud and abuse, improving the site and our products, aggregated statistics, handling technical faults, and defending legal claims. We use this basis only where our interests are not overridden by your rights. You may object (section 12).
• d. With your consent (Art. 6(1)(a)): marketing emails, and analytics, advertising and session-recording cookies. You can withdraw consent at any time, without affecting what was done before.

5. Accounts, sign-in and payments

When you create an account or place an order, we ask for the details needed to identify you and complete the transaction. If you create an account, please choose a personal password and keep it secret.

Payments are processed by our payment processor, CreditGuard, and the card's acquiring bank, which comply with the PCI-DSS card security standard. We do not keep card details on our servers. The processor may issue us a unique transaction reference. If you pay with PayPal, PayPal processes the payment under its own privacy statement and sends us the transaction number and the paying account's email and ID.

6. Cookies and similar technologies

The site uses cookies and similar technologies (such as local storage and pixels). Some are needed to run the site; others are used only if you accept them:

• Essential: running the site, the cart, checkout, sign-in, security and remembering your cookie choice. These are always on, because the site cannot work without them.
• Analytics: measuring how the site is used so we can improve it (Google Analytics; Microsoft Clarity, which also records anonymized sessions and heatmaps).
• Advertising: measuring our ads and showing relevant ads (Meta Pixel for Facebook and Instagram; OpenAI advertising measurement).
• Functional: remembering preferences, such as accessibility settings.

Analytics and advertising cookies are used only after you choose "Accept" in our cookie notice. Closing the notice or continuing to browse is not consent. You can change your choice at any time with the button below, or by deleting the site's cookies and stored data in your browser. Blocking all cookies may stop parts of the site (such as the cart or checkout) from working.

These third parties process the information under their own privacy policies: Google (policies.google.com/privacy), Meta (facebook.com/privacy/policy), Microsoft (privacy.microsoft.com) and OpenAI (openai.com/policies/privacy-policy).

7. Who we share information with

We share personal information only as needed for the purposes in this policy, and only with providers bound by contract to protect it and to use it only on our instructions (processors):

• Hosting and infrastructure: DigitalOcean (servers, databases and file storage), Cloudflare (content delivery and security), Google Drive (encrypted backups).
• Payments: CreditGuard and the acquiring bank that processes your card, and PayPal when you pay with PayPal.
• Delivery: Israel Post and the postal services and delivery companies that carry your parcel in each country, and our overseas logistics partner, which may ship some orders on our behalf. They receive your name, address, phone, email and the contents of the parcel (which also appear on customs forms).
• Accounting and invoicing: our invoicing and bookkeeping system (iCount) and our accountant.
• Email and messaging: Google (Gmail / Google Workspace) and Resend for emails; WhatsApp (Meta) if you write to us there.
• Customer service tools: AI services (Anthropic, Google) that help our team draft replies to your messages; a person on our team reviews every reply before it is sent.
• Analytics and advertising, only with your consent: Google, Meta, Microsoft and OpenAI (section 6).

We may also disclose information: to authorities, when required by law, a court order or a competent authority, or to bring or defend legal claims, enforce our rights or prevent serious harm; and in a business transfer (a merger, sale or transfer of activity), provided the buyer undertakes to protect the information under this policy or an equivalent one.

Statistical, aggregated information that does not identify anyone may be used for business purposes and research.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

8. Marketing emails

We send offers, news and other marketing content only if you agreed to receive them (for example by ticking the newsletter box). Every marketing email has an unsubscribe link, and you can also ask customer service to remove you. Service emails about your orders, account, rewards balance or support requests are not marketing and are sent as part of our service.

9. International transfers

We are based in Israel, and your information is processed in Israel and by our providers in other countries, including the United States and the European Union.

The European Commission and the United Kingdom have recognized Israel as providing an adequate level of protection for personal information (adequacy decisions), so information can be transferred from the EU and UK to us in Israel.

Where our providers process information in other countries without such a decision (for example the United States), we rely on appropriate safeguards: the EU-US Data Privacy Framework (and its UK extension) where the provider is certified, or the European Commission's Standard Contractual Clauses (with the UK addendum). You can ask us for more information about these safeguards.

10. Information security

We use reasonable and appropriate security measures, including encryption in transit (TLS), access controls and hardened servers. No transmission or storage over the internet is completely secure, so we cannot promise absolute security. If a breach of your personal information is likely to put you at high risk, we will tell you as the law requires.

Using links to, or services of, third parties (websites, apps, maps, embedded tools) is subject to their own policies.

11. How long we keep information

We keep personal information only for as long as it is needed for the purposes for which it was collected, to meet legal and accounting obligations, to protect ourselves against claims and to prove transactions. Then we delete it or make it anonymous, securely. In general:

• Orders and invoices: 7 years from the end of the tax year, as Israeli tax law requires.
• Customer service messages: for as long as needed to handle your request, and then for up to 3 years.
• Your account and rewards: until you ask us to delete the account, or 3 years after your last activity.
• Marketing list: until you unsubscribe; we keep a record of the unsubscribe so we don't email you again.
• Analytics data: according to the retention settings of the tools in section 6, and no longer than 26 months.

We review periodically whether it is still necessary to keep information.

12. Your rights

Depending on the law that applies to you (including the GDPR, the UK GDPR and Israeli law), you have the right to:

• Access: get a copy of the personal information we hold about you.
• Rectification: have inaccurate or incomplete information corrected.
• Erasure: have your information deleted, where there is no longer a reason to keep it.
• Restriction: ask us to limit how we use your information in certain cases.
• Portability: receive the information you gave us in a structured, machine-readable format, or have it sent to another company.
• Objection: object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, where we rely on your consent (for example marketing emails or cookies), without affecting earlier processing.
• Complain to a data protection supervisory authority: in the EU, the authority of the country where you live or work; in the UK, the Information Commissioner's Office (ico.org.uk); in Israel, the Privacy Protection Authority.

To use your rights, write to support@camelmountain.com. To protect your privacy we may need to verify your identity. We reply within one month (this can be extended where the law allows, and we will tell you). Information we must keep by law will be kept as long as required. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

13. Children

The site is not intended for use by children under 18 without the consent of a parent or guardian, and we do not knowingly collect information from children under 16. If you believe a child has given us information, please contact us and we will act as the law requires.

14. Third-party links and services

The site may contain links, plugins and tools of third parties (for example delivery companies, payment, maps, social networks and chat services). Their use is subject to those third parties' policies. We do not control them and are not responsible for them.

15. Changes to this policy

We may update this policy from time to time. Material changes are marked with a new date at the top of the policy, and where appropriate we will also tell you by email or on the site.

16. Contact

For any question or request about privacy:

17. Governing law

This policy is governed by the laws of the State of Israel, without affecting the data protection laws that apply to you where you live (including the GDPR and the UK GDPR) or your right to complain to your local supervisory authority.

18. Final notes

• Continuing to browse, or closing an information notice, is not consent to non-essential cookies; consent is given only by choosing "Accept" in the cookie notice.
• If this policy conflicts with specific terms of a particular service, the specific terms prevail, subject to the law.

19. Note for California residents

If you live in California, the California Consumer Privacy Act (as amended by the CPRA) may give you the right to know what personal information we collect, use and disclose (described in sections 2, 4 and 7), to request its deletion or correction, and not to be discriminated against for using these rights.

We do not sell your personal information, and we have not sold it in the past 12 months. Advertising cookies (Meta Pixel, OpenAI advertising measurement) run only if you accept them; choosing "Decline" in the cookie notice, or changing your choice with the cookie settings button above, opts you out of any sharing of information for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16.

To make a request, email support@camelmountain.com. We will verify your request and reply within the time the law requires.