Privacy Policy

1. Who is responsible for your data

The controller is [LEGAL ENTITY NAME], registered in the Sultanate of Oman, at [REGISTERED ADDRESS, SULTANATE OF OMAN].

The Data Protection Officer is [DATA PROTECTION OFFICER — NAME], reachable at the address at the end of this notice. You can write to them about anything in this document, including to complain.

Oman's Personal Data Protection Law applies to everything described here.

2. The basis on which we process it

Your explicit consent, given when you create an account. Oman's law provides consent as the basis for processing personal data, and we do not claim another one.

Consent is recorded as an event rather than as a tick that disappears: what you agreed to, the version of the wording you saw, the moment you agreed, and in which language. If the wording changes, that is a new version and we ask again.

You can withdraw consent. Because the account cannot operate without processing the data that makes it work, withdrawing means closing the account — and we will tell you plainly what that removes and what the law makes us keep.

3. What we collect

Everything below is a field that exists. Nothing is collected 'for future use'.

• Your account: your name, email address, the country you registered in, your language, and a profile image if you upload one.
• Your password: stored only as a hash that cannot be turned back into the password.
• Your second factor, if you turn it on: the secret behind the codes, and your recovery codes.
• Each sign-in session: the IP address it came from, the browser it used, and when it started and ends.
• Sign-in attempts: the address that was typed and a running count, so guessing can be slowed. It is kept whether or not the address belongs to an account.
• Your company: legal and trading name, registration number, jurisdiction, address, website, description, year established, business hours, and where it applies, production capacity, main products, markets served and export countries — plus a logo and banner if uploaded.
• Your membership of a company: the role you hold and your job title.
• Invitations: the email address of a person you invite, who invited them, and the role intended for them — held whether or not they ever sign up.
• Consents: the purpose, the wording version, the time, the language, and where it was given.
• Requests you make to staff: what you write in them, and the decision with its reason.
• Verification work: documents you submit for an audit, the result, and a record of which staff member read what — which is what makes a verification decision defensible.

4. What we do not collect

No phone number. No location or GPS data. No payment card details — the platform takes no payments at this stage. No delivery addresses, no order history, and no browsing profile built for advertising.

If that changes, this notice changes with it, as a new version you will be asked about.

5. What we use it for

Each purpose below is the reason a field above exists.

• Creating and running your account, and proving that your email address is yours.
• Showing your company to other businesses once it is verified, and never before.
• Verification: checking documents, registrations and licences, and publishing the audit report the way the platform's rules require.
• Security: stopping password guessing, protecting sign-in, and investigating misuse.
• Answering you when you write to us, and recording what was decided and why.
• Meeting legal obligations, including sanctions screening and record-keeping.

6. Who else processes it

These are the only ones, and each is named because a category is not a disclosure.

• Hetzner Online, in Germany — the servers, the file storage and the backups.
• Scaleway, in France — the emails the platform sends you.
• Google — only if you choose to sign in with Google, and only for that.
• Have I Been Pwned — when you choose a password, the first five characters of its cryptographic fingerprint are checked against a public list of breached passwords. The password itself and anything identifying you never leave our servers.

7. Where your data is, and the transfer out of Oman

Your data is stored in Germany, and the emails we send you pass through France. That means personal data leaves Oman, and we ask for your explicit consent to it when you register — which is why the consent is written into the same act as accepting these terms.

We do not move your data outside these arrangements. If we ever needed to, we would ask first.

This is an area where Omani law is specific, and we are taking advice on it. This notice states what actually happens rather than a conclusion we have not yet earned.

8. How long we keep it

Retention periods: [RETENTION PERIODS — SET WITH COUNSEL].

What is already decided is the shape: your account data lives while the account does; a consent record outlives the account, because it is the evidence that the processing was lawful; the audit trail behind a verification decision is kept because it is what makes that decision defensible; and screening results are kept as the record of a legal obligation.

9. Your rights

You can ask us to:

• Give you a copy of your data, in a form you can take elsewhere.
• Correct anything that is wrong.
• Delete your data. Where a record must survive — a consent record, an audit trail — we remove what identifies you rather than keep a file we told you was gone.
• Stop processing, by withdrawing consent, which closes the account.
• Explain any decision made about you that was reached automatically, and have a person look at it.

10. How to ask, and how to complain

Write to the Data Protection Officer at the address below. We will answer within the period the law requires, and if we need something from you to identify your account we will ask for the least we can.

If you are not satisfied, you can complain to the Ministry responsible for data protection in the Sultanate of Oman. Telling you that is part of the notice, not an invitation to go away.

11. If something goes wrong

If there is a breach of personal data that may put anyone's rights at risk, we notify the regulator within 72 hours of becoming aware of it. Where a breach is likely to cause you serious harm, we tell you as well, and we tell you what we know rather than what sounds reassuring.

12. Children

Sooqban is a platform for businesses and is not intended for children. We do not knowingly collect data from anyone who is not old enough to act for a business.

13. Changes to this notice

This notice carries a version and a date. A change of wording is a new version, and where it is material you are asked to consent to it before continuing to use your account.

Older versions stay available, so you can see what you agreed to and when.