Privacy Policy

1. Who is responsible for your data

The controller is THE FIRST PROJECT S.P.C, registered in the Sultanate of Oman, at Ghala.

You can write to us at the address at the end of this notice about anything in this document, including to complain.

Oman’s Personal Data Protection Law applies to everything described here.

2. The basis on which we process it

Your explicit consent, given when you create an account. Oman’s law provides consent as the basis for processing personal data, and we do not claim another one.

Consent is recorded as an event rather than as a tick that disappears: what you agreed to, the version of the wording you saw, the moment you agreed, and in which language. If the wording changes, that is a new version and we ask again.

You can withdraw consent at any time, from Consent in your account. Because the account cannot operate without processing the data that makes it work, withdrawing stops the account: it cannot be used until you agree again. You can also close your account yourself, from Security or Consent in your account. For 90 days signing in lets you reopen it; after that, what identifies you is removed and only what the law makes us keep remains, as section 8 says.

3. What we collect

Everything below is a field that exists. Nothing is collected in case it becomes useful later.

• Your account: your name, email address, the country you registered in, your language, and a profile image if you upload one. Also when you registered, whether your email address has been proven, whether two-step sign-in is on, and, if you close the account, when.
• Your password: stored only as a hash that cannot be turned back into the password.
• Signing in with Google, if you choose it: which Google account signs in as you. Nothing else Google sends is kept.
• Your second factor, if you turn it on: the secret behind the codes, your recovery codes, and a count of wrong codes, so guessing can be stopped. For two minutes after a code is used, a fingerprint of it, so the same code cannot be used twice.
• Each sign-in session: the IP address it came from, the browser it used, when it started and ends, and when it passed the second step of sign-in, if it did.
• Sign-in attempts and other counted requests: the address that was typed or the network a request came from, kept only as a keyed fingerprint that cannot be turned back into it, and a running count, so guessing and flooding can be slowed. It is kept whether or not the address belongs to an account.
• Your registration, until it is finished: the answers you have given so far, so you can pick up where you stopped.
• Your company: the roles it plays on Sooqban, its legal and trading name, registration number, jurisdiction, address, website, description, year established, business hours, and where it applies, production capacity, main products, markets served and export countries. Plus a logo and banner if uploaded.
• Your membership of a company: which company, the role you hold, your job title, and whether the membership is active.
• Invitations: the email address of a person you invite, who invited them, the role intended for them, and whether they accepted. Held whether or not they ever sign up.
• What you did in a company: each invitation you sent, withdrew or accepted, each colleague you removed or whose role you changed, your leaving a company, and each reply you sent to staff. For each, what was done, to what kind of record, and when.
• Consents: the purpose, the wording version, when it was given and, if it was, withdrawn, the language, and where it was given.
• Requests you make to staff: what you write in them, and the decision with its reason.
• Verification work: documents you submit for an audit, the result, and a record of which staff member read what, which is what makes a verification decision defensible.
• Notices we send you: what each is about, whether you have read it, and whether its email was sent.
• A staff seat, if you hold one: its level, whether it is active, and when it ended. The access granted to it: which department and categories, from when and until when. And what it did: each decision and change it recorded, on what kind of record, when, and the reason given; the evidence it accepted, against which line and until when; and the homepage pictures it added.

4. What we do not collect

No phone number. No location or GPS data. No payment card details. The platform takes no payments at this stage. No delivery addresses, no order history, and no browsing profile built for advertising.

If that changes, this notice changes with it, as a new version you will be asked about.

5. What we use it for

Each purpose below is the reason a field above exists.

• Creating and running your account, and proving that your email address is yours.
• Showing your company to other businesses once it is verified, and never before.
• Verification: checking documents, registrations and licences, and publishing the audit report the way the platform’s rules require.
• Security: stopping password guessing, protecting sign-in, investigating misuse, and keeping a record of who did what in a company and on a staff seat.
• Answering you when you write to us, and recording what was decided and why.
• Meeting legal obligations, including sanctions screening and record-keeping.

6. Who else processes it

These are the only ones, and each is named because a category is not a disclosure.

• Hetzner Online, in Germany. The servers, the file storage and the backups.
• Scaleway, in France. The emails the platform sends you, and an encrypted copy of every backup, which Scaleway cannot read.
• MihanWebHost, on a server in Germany. The mail you send to our addresses, such as privacy@ and support@, and our replies to it.
• Google. Only if you choose to sign in with Google, and only for that.
• Have I Been Pwned. When you choose a password, the first five characters of its cryptographic fingerprint are checked against a public list of breached passwords. The password itself and anything identifying you never leave our servers.

7. Where your data is, and the transfer out of Oman

Your data is stored in Germany, an encrypted copy of the backups is kept in France, and the emails we send you pass through France. That means personal data leaves Oman, and we ask for your explicit consent to it when you register, which is why the consent is written into the same act as accepting these terms.

We do not move your data outside these arrangements. If we ever needed to, we would ask first.

This is an area where Omani law is specific, and we are taking advice on it. This notice states what actually happens rather than a conclusion we have not yet earned.

8. How long we keep it

Each period below is the one we decided on, with the reason. Oman’s law sets no universal period, it requires each to be specific and proportionate to what it is for, so these are our numbers and you can hold us to them.

• Your account: 90 days after you close it, so a closure you regret can be undone. Then your name, email address, country and image are removed, with your password, your second factor, your sessions, your notices and your unfinished registration, and the account can never be signed into again. What the law makes us keep stays, for the periods below.
• The IP address and browser of each session: 90 days. That is the window in which a compromise is investigated.
• Sign-in attempt counts: 30 days, and the same for the counts of other requests. They serve only to slow repeated attempts, and nothing else reads them.
• An invitation nobody accepted: 12 months, then the invited address is deleted.
• Consent records: 10 years after the account closes. They are the evidence that the processing was lawful and have to outlive both the account and any question about it.
• Verification documents, the audit trail behind a verification, and screening results: 10 years. Oman’s Law of Commerce requires ten years for commercial records, and a published audit is defensible only while its evidence exists.
• What you did in a company or on a staff seat: 10 years from each act. The access granted to a staff seat is kept 10 years after it ended, and the seat itself 10 years after it was closed, once nothing it did is still kept. It is the record of who did what, which every decision and every change of access has to be able to answer to. An act on a verification is part of that verification’s record and is kept as long as it is.
• Analytics events, when they exist: 24 months, then deleted or turned into figures that are no longer about anyone.
• Backups of the database: each copy is kept 30 days, locked so that nobody, us included, can change or delete it sooner, and then deleted. Whatever is deleted from the platform, an account included, is gone from the backups at most 35 days later, when the last copy holding it is deleted.

9. Your rights

You can ask us to:

• Give you a copy of your data, in a form you can take elsewhere.
• Correct anything that is wrong.
• Delete your data. You can begin it yourself by closing your account. Where a record must survive, a consent record, an audit trail, we remove what identifies you rather than keep a file we told you was gone.
• Stop your account, by withdrawing consent: it stays stopped until you agree again, or until you close it.
• Explain any decision made about you that was reached automatically, and have a person look at it.

10. How to ask, and how to complain

Write to us at the address below. We answer within 45 days, which is the period Oman’s law sets, and if we need something from you to identify your account we will ask for the least we can.

If you are not satisfied, you can complain to the Ministry responsible for data protection in the Sultanate of Oman. Telling you that is part of the notice, not an invitation to go away.

11. If something goes wrong

If there is a breach of personal data that may put anyone’s rights at risk, we notify the regulator within 72 hours of becoming aware of it. Where a breach is likely to cause you serious harm, we tell you as well, and we tell you what we know rather than what sounds reassuring.

12. Children

Sooqban is a platform for businesses and is not intended for children. We do not knowingly collect data from anyone who is not old enough to act for a business.

13. Changes to this notice

This notice carries a version and a date. A change of wording is a new version, and where it is material you are asked to consent to it before continuing to use your account.

Older versions stay available, so you can see what you agreed to and when.