PRIVACY POLICY 

Last Updated: 28 Aug 2026 

This Privacy Policy describes how GoShisha collects, uses, stores, shares, and protects your personal data when you visit our website, book with us, or use our services. 

We handle personal data in accordance with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act), the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and other applicable laws and regulations.  

According to the DPDP Act, GoShisha may be a Data Fiduciary, and the person whose personal data is processed is called a Data Principal. 

1. Identity and contact details 

Entity Name: Go Shisha  

Registered Address: [Address]  

Email: info@mazaaj.ae  

Phone / WhatsApp: +971 58 502 7295  

You may contact us using the details above for any privacy-related question, request or grievance.  

2. Personal data we collect 

We collect only the personal data that is reasonably required to provide our Services, complete bookings, meet legal requirements and operate our Website.  

Depending on how you use our Services, we may collect:  

• Identity information: Name, age or date of birth, and age-verification documents where required.  

• Contact information: Mobile number, email address and delivery or venue address.  

• Booking information: Event date and time, number of guests, venue details and service preferences.  

• Payment information: Billing details and transaction information. Payments may be processed through third-party payment providers, and GoShisha does not store complete card details.  

• Technical information: IP address, browser and device information, cookies and Website usage information.  

• Content you provide: Reviews, photographs, testimonials and other information that you voluntarily submit to us.  

We will not collect personal data that is not reasonably required for the relevant purpose.  

3. How we use your personal data 

We use your personal data only for clear and valid reasons connected to our Services. This can include: 

• Identity information: To verify your age where required by applicable tobacco laws and regulations.  

• Contact and booking information: To process and manage your booking, arrange the requested services, communicate with you and coordinate service delivery.  

• Payment information: To process payments, issue invoices and maintain transaction records.  

• Technical information: To operate, maintain, secure and improve our Website and understand how visitors use it.  

• Reviews, photographs and testimonials: To display or use content you voluntarily provide for marketing or promotional purposes, where you have given the required consent.  

We will use your personal data only for the purposes explained to you when it is collected or for other purposes permitted under applicable law.  

4. Consent 

Where consent is required, we will ask for your consent before collecting or using your personal data.  

Our privacy notices will explain, in clear and simple language:  

• what personal data we are collecting;  

• why we need it; and  

• how it will be used.  

You may refuse to provide consent where consent is optional. You may also withdraw your consent at any time by contacting us using the details provided in this Policy.  

If you withdraw consent, we may no longer be able to provide certain Services where the relevant personal data is necessary for that Service. Withdrawal of consent will not affect processing that was lawfully carried out before the withdrawal.  

5. Processing without consent 

Sometimes, we process personal data without asking for consent if the law allows it. 

This can include situations where we need to: 

• comply with a legal or regulatory requirement;  

• respond to a lawful order or request from a government or regulatory authority;  

• prevent or respond to an emergency involving a threat to life or health; or  

• carry out other purposes recognized as lawful under the DPDP Act.  

6. How we share your personal data 

We may share personal data with third parties where it is reasonably necessary to provide our Services or meet our legal obligations.  

This may include:  

• Employees and service professionals: To process and fulfil your booking.  

• Payment service providers and banking partners: To process payments and related transactions.  

• Government and regulatory authorities: Where disclosure is required by law or a lawful request.  

• Technology, cloud and service providers: To operate our Website, systems and business processes.  

Where we engage service providers to process personal data on our behalf, we take reasonable steps to ensure that appropriate privacy and security safeguards are maintained.  

We do not sell your personal data.  

Where personal data is transferred outside India, we will do so in accordance with applicable Indian laws and any restrictions or requirements notified by the Central Government.  

7. Data retention and deletion 

We retain personal data only for as long as it is reasonably required for the purpose for which it was collected or where retention is required by applicable law.  

For example, certain payment, billing and tax records may need to be retained for a specified period under applicable laws.  

When personal data is no longer required and there is no legal reason to retain it, we will delete or anonymize it, as appropriate.  

You may also request correction or erasure of your personal data, subject to applicable legal and operational requirements.  

8. Data security 

We use a range of technical and organizational steps to keep your personal data safe from unauthorized access, loss, misuse, changes, disclosure, or destruction. 

These steps may include: 

• We use access controls to limit who can view or use sensitive information. 

• We protect data with encryption and secure transmission methods. 

• Access to personal data is limited to only those who need it for their work. 

• Employees and service providers must follow strict confidentiality rules. 

• We also use appropriate security and monitoring measures to protect information. 

No method of storing or transmitting information over the internet can be guaranteed to be completely secure. However, we take reasonable steps to protect the personal data we hold.  

If a personal data breach occurs, we will take appropriate steps to contain, investigate and address the breach and provide notifications to the relevant authorities and affected individuals where required under applicable law.  

9. Your rights 

Subject to applicable law, you may have the following rights in relation to your personal data:  

• Access: Request information about the personal data we process and how it is being used.  

• Correction and updating: Request correction, completion or updating of inaccurate or incomplete personal data.  

• Erasure: Request deletion of personal data where it is no longer required, subject to applicable legal requirements.  

• Withdrawal of consent: Withdraw consent where processing is based on consent.  

• Grievance redressal: Raise a privacy-related complaint with us.  

• Nomination: Nominate another individual to exercise your rights in accordance with applicable law.  

To exercise these rights, please contact us using the details provided in Section 1.  

We will process your request within the period prescribed under applicable law.  

If GoShisha does not resolve your grievance, you may have the right to contact the Data Protection Board of India, depending on the relevant laws and procedures. 

10. Cookies and website analytics 

Our Website may use cookies and similar technologies to:  

• operate the Website;  

• remember your preferences;  

• improve Website performance; and  

• understand how visitors use our Website.  

You may manage or disable cookies through your browser settings. However, disabling certain cookies may affect some Website features or functionality.  

When necessary, we will get permission before using cookies or other similar technologies for any purpose for which permission is required by applicable law.  

11. Third-party websites and services 

The website might contain links to other websites which are operated by third parties, to payment platforms, to social media sites, or to other external services. 

These third parties have their own privacy policies and terms. GoShisha is not responsible for the privacy practices, security or content of third-party websites or services.  

We recommend reviewing the privacy policies of those third parties before providing them with your personal data.  

12. Children’s personal data 

GoShisha’s tobacco-related Services are intended only for individuals who are 18 years of age or older.  

We do not knowingly provide tobacco-related Services to persons below 18 years of age. Where age verification is required, we may request appropriate information or documentation to confirm that the customer meets the applicable age requirement.  

If we find out that personal data about a child has been collected through our Services without a legal reason, we will take reasonable steps to fix the issue as required by law. 

13. Changes to this privacy policy 

We may update this Privacy Policy from time to time to reflect:  

• changes in our Services or business practices;  

• changes in applicable laws or regulations; or  

• changes in our data-processing practices.  

Any updated version will be published on our Website with a revised “Last Updated” date.  

We encourage you to review this Policy periodically.