Privacy Policy

1. Who is responsible for your data

The controller is THE FIRST PROJECT S.P.C, registered in the Sultanate of Oman, at Ghala.

You can write to us at the address at the end of this notice about anything in this document, including to complain.

Oman’s Personal Data Protection Law applies to everything described here.

2. The basis on which we process it

Your explicit consent, given when you create an account. Oman’s law provides consent as the basis for processing personal data, and we do not claim another one.

Consent is recorded as an event rather than as a tick that disappears: what you agreed to, the version of the wording you saw, the moment you agreed, and in which language. If the wording changes, that is a new version and we ask again.

You can withdraw consent at any time, from Consent in your account. Because the account cannot operate without processing the data that makes it work, withdrawing stops the account: it cannot be used until you agree again. You can also ask us to delete it, and we will tell you plainly what that removes and what the law makes us keep.

3. What we collect

Everything below is a field that exists. Nothing is collected in case it becomes useful later.

• Your account: your name, email address, the country you registered in, your language, and a profile image if you upload one.
• Your password: stored only as a hash that cannot be turned back into the password.
• Your second factor, if you turn it on: the secret behind the codes, and your recovery codes.
• Each sign-in session: the IP address it came from, the browser it used, and when it started and ends.
• Sign-in attempts: the address that was typed and a running count, so guessing can be slowed. It is kept whether or not the address belongs to an account.
• Your company: legal and trading name, registration number, jurisdiction, address, website, description, year established, business hours, and where it applies, production capacity, main products, markets served and export countries. Plus a logo and banner if uploaded.
• Your membership of a company: the role you hold and your job title.
• Invitations: the email address of a person you invite, who invited them, and the role intended for them. Held whether or not they ever sign up.
• Consents: the purpose, the wording version, the time, the language, and where it was given.
• Requests you make to staff: what you write in them, and the decision with its reason.
• Verification work: documents you submit for an audit, the result, and a record of which staff member read what, which is what makes a verification decision defensible.

4. What we do not collect

No phone number. No location or GPS data. No payment card details. The platform takes no payments at this stage. No delivery addresses, no order history, and no browsing profile built for advertising.

If that changes, this notice changes with it, as a new version you will be asked about.

5. What we use it for

Each purpose below is the reason a field above exists.

• Creating and running your account, and proving that your email address is yours.
• Showing your company to other businesses once it is verified, and never before.
• Verification: checking documents, registrations and licences, and publishing the audit report the way the platform’s rules require.
• Security: stopping password guessing, protecting sign-in, and investigating misuse.
• Answering you when you write to us, and recording what was decided and why.
• Meeting legal obligations, including sanctions screening and record-keeping.

6. Who else processes it

These are the only ones, and each is named because a category is not a disclosure.

• Hetzner Online, in Germany. The servers, the file storage and the backups.
• Scaleway, in France. The emails the platform sends you.
• Google. Only if you choose to sign in with Google, and only for that.
• Have I Been Pwned. When you choose a password, the first five characters of its cryptographic fingerprint are checked against a public list of breached passwords. The password itself and anything identifying you never leave our servers.

7. Where your data is, and the transfer out of Oman

Your data is stored in Germany, and the emails we send you pass through France. That means personal data leaves Oman, and we ask for your explicit consent to it when you register, which is why the consent is written into the same act as accepting these terms.

We do not move your data outside these arrangements. If we ever needed to, we would ask first.

This is an area where Omani law is specific, and we are taking advice on it. This notice states what actually happens rather than a conclusion we have not yet earned.

8. How long we keep it

Each period below is the one we decided on, with the reason. Oman’s law sets no universal period, it requires each to be specific and proportionate to what it is for, so these are our numbers and you can hold us to them.

• Your account: 90 days after you close it, then deleted. Long enough to undo a closure you regret.
• The IP address and browser of each session: 90 days. That is the window in which a compromise is investigated.
• Sign-in attempt counts: 30 days. They serve only the delay after repeated wrong passwords, which resets in minutes.
• An invitation nobody accepted: 12 months, then the invited address is deleted.
• Consent records: 10 years after the account closes. They are the evidence that the processing was lawful and have to outlive both the account and any question about it.
• Verification documents, the audit trail behind a verification, and screening results: 10 years. Oman’s Law of Commerce requires ten years for commercial records, and a published audit is defensible only while its evidence exists.
• Analytics events, when they exist: 24 months, then deleted or turned into figures that are no longer about anyone.

9. Your rights

You can ask us to:

• Give you a copy of your data, in a form you can take elsewhere.
• Correct anything that is wrong.
• Delete your data. Where a record must survive, a consent record, an audit trail, we remove what identifies you rather than keep a file we told you was gone.
• Stop your account, by withdrawing consent: it stays stopped until you agree again, or until you ask us to delete it.
• Explain any decision made about you that was reached automatically, and have a person look at it.

10. How to ask, and how to complain

Write to us at the address below. We answer within 45 days, which is the period Oman’s law sets, and if we need something from you to identify your account we will ask for the least we can.

If you are not satisfied, you can complain to the Ministry responsible for data protection in the Sultanate of Oman. Telling you that is part of the notice, not an invitation to go away.

11. If something goes wrong

If there is a breach of personal data that may put anyone’s rights at risk, we notify the regulator within 72 hours of becoming aware of it. Where a breach is likely to cause you serious harm, we tell you as well, and we tell you what we know rather than what sounds reassuring.

12. Children

Sooqban is a platform for businesses and is not intended for children. We do not knowingly collect data from anyone who is not old enough to act for a business.

13. Changes to this notice

This notice carries a version and a date. A change of wording is a new version, and where it is material you are asked to consent to it before continuing to use your account.

Older versions stay available, so you can see what you agreed to and when.