Privacy Policy
Effective July 2025 · Governed by Jordan's PDPL No. 24 of 2023
1. Who We Are
This Privacy Policy describes how مؤسسة فرح و هديه ("Hadiyye", "we", "our", "us"), operating the Hadiyye gifting platform at hadiyye.com, collects, uses, and protects your personal data.
We are based in the Hashemite Kingdom of Jordan and comply with Jordan's Personal Data Protection Law No. 24 of 2023 (PDPL).
Questions about this policy? Contact us at privacy@hadiyye.com.
2. Data We Collect
We collect the following categories of personal data:
Account & Profile Data
- First and last name
- Email address
- Phone number (optional)
- Profile picture (optional)
- Password (stored as a one-way hash — we never see your plaintext password)
Event Content
- Event title, description, date, and location
- Cover photos and wish-list images you upload
- Wishlist items and nqoot fund settings
Payment & Financial Data (Event Hosts only)
- Bank account number or IBAN, collected only when you request a payout
- Nqoot transaction history (amounts, dates, sender references)
Usage & Technical Data
- IP address and approximate location (country/city)
- Device type, browser, and operating system
- Pages visited, click paths, and time on page
- Error logs and crash reports
Communications
- Emails and messages you send to our support team
- Wish messages left on event pages
3. How We Use Your Data
| Purpose | Legal Basis (PDPL) |
|---|---|
| Create and manage your account | Contract performance |
| Display your event page to guests | Contract performance |
| Process nqoot payments and payouts | Contract performance |
| Send transactional emails (verification, receipts) | Contract performance |
| Detect fraud and prevent abuse | Legitimate interest / legal obligation |
| Improve and debug the Platform | Legitimate interest |
| Send product updates and offers (optional) | Consent — you can opt out anytime |
| Comply with Jordanian law or court orders | Legal obligation |
4. Who We Share Your Data With
We do not sell your personal data. We share it only with:
- Payment processors — Bank Al-Etihad / CyberSource, for processing card transactions. They operate under their own PCI-DSS and privacy obligations.
- Cloud infrastructure — our hosting and database providers (e.g. Railway, AWS). Data is processed under contractual data-processing agreements.
- Email service providers — for sending verification and transactional emails.
- Law enforcement or regulators — when required by a valid Jordanian legal order.
All third parties are contractually required to protect your data and process it only for the purposes we specify.
5. Data Retention
- Account data — retained for as long as your account is active, plus 3 years after deletion for legal and fraud-prevention purposes.
- Transaction records — retained for 7 years to comply with Jordanian financial record-keeping requirements.
- Event content — deleted within 90 days after you delete an event or close your account.
- Support communications — retained for 2 years.
6. Your Rights Under the PDPL
Under Jordan's Personal Data Protection Law No. 24 of 2023, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Correction — ask us to correct inaccurate or incomplete data.
- Erasure — request deletion of your data (subject to legal retention obligations).
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — opt out of marketing communications at any time.
To exercise any right, email privacy@hadiyye.com. We will respond within 15 business days.
7. Cookies & Tracking
We use the following types of cookies and local storage:
- Strictly necessary — session tokens and authentication state. Cannot be disabled.
- Functional — language preference, theme colour. Can be cleared via browser settings.
- Analytics — aggregate usage data to improve the Platform (no personal profiling). You may opt out by emailing us.
We do not use third-party advertising or cross-site tracking cookies.
8. Data Security
- All data in transit is encrypted via TLS 1.2+.
- Sensitive data at rest (bank account details, passwords) is encrypted using industry-standard algorithms.
- Access to production systems is restricted to authorised personnel and protected by multi-factor authentication.
- We conduct periodic security reviews and vulnerability assessments.
Despite our best efforts, no system is 100% secure. If you discover a security vulnerability, please responsibly disclose it to security@hadiyye.com.
9. International Data Transfers
Your data may be processed on servers outside Jordan (e.g. cloud infrastructure in the EU or US). When this occurs, we ensure appropriate safeguards are in place — including standard contractual clauses — consistent with the PDPL.
10. Children's Privacy
The Platform is available to users of all ages, but nqoot payments require a valid payment method typically held by adults. We do not knowingly collect data from children under 13 beyond what is necessary to operate the Platform. If you believe a child has provided personal data without parental consent, please contact us at privacy@hadiyye.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or a banner on the Platform at least 14 days before the change takes effect. The "Effective date" at the top of this page always reflects the most recent version.
12. Contact & Complaints
For privacy enquiries or to exercise your rights:
- Email: privacy@hadiyye.com
If you are not satisfied with our response, you have the right to lodge a complaint with Jordan's National Centre for Security and Crisis Management (NCSCM) or the relevant data protection authority.