سياسة الخصوصية

يزدان للتجارة والاستثمار ش.ش.و (Commercial Registration No. 1567309), 18 November Street, Building 432, Unit 5, Muscat, Sultanate of Oman (“SafaHost”, “we”, “us”) is the controller of the personal data described in this policy. We process personal data in accordance with the Personal Data Protection Law issued by Royal Decree 6/2022 and its Executive Regulations (Ministerial Decision 34/2024), and — for customers in the UAE — with Federal Decree-Law No. 45 of 2021 where it applies.

1. Data we collect

• Account data: name, company, email, phone number, billing address, password (stored only as a salted Argon2id hash).
• Verification data: identity document, proof of address, commercial registration and verification results. These files are encrypted (AES-256-GCM) and accessible only to authorised compliance staff.
• Billing data: invoices, payment status and transaction references. Card details are processed by our payment provider and never stored by us.
• Technical data: IP addresses, device and browser information, sign-in history, security logs.
• Support data: ticket messages and attachments you send.
• Domain registrant data required by registries (WHOIS/RDAP).

2. Why we use it and our legal basis

• To provide and bill for services (performance of contract);
• to verify identity and prevent fraud, spam and abuse (legal obligation and legitimate interest in protecting our network and customers);
• to comply with law and lawful requests from competent authorities (legal obligation);
• to send service and security notices (performance of contract);
• to send marketing emails only where you gave explicit consent, which you can withdraw at any time via the unsubscribe link or your profile.

3. Automated assistance

Support tickets may be answered with the help of an AI system that drafts replies from our knowledge base and your account context (name, verification status and service list). The AI cannot change your account, issue refunds or see passwords or documents. Billing disputes, legal matters and abuse reports are always handled by staff. You can ask for a human review of any reply.

4. Sharing

We share personal data only with: payment providers; domain registries and accredited registrars; certificate authorities; data-centre, email and messaging providers (including Meta’s WhatsApp Business Platform for verification codes, and our AI provider for ticket drafting); professional advisers; and competent authorities where required by law. Each processor is bound by contract to protect your data. We never sell personal data.

5. International transfers

Some providers and the server locations you choose (Germany, United Kingdom, France, United States, Hong Kong) are outside Oman. Where we transfer personal data abroad we do so in accordance with the Executive Regulations, assessing the level of protection and applying contractual safeguards. Data on servers you choose is placed there at your instruction.

6. Retention

• Account and billing records: for the life of the account and ten (10) years after, as required for commercial and tax records.
• Verification documents: for the life of the account and up to five (5) years after closure, for fraud-prevention and legal purposes.
• Security logs: up to twelve (12) months. Hosted content: deleted within thirty (30) days of termination.

7. Security

We use encryption in transit (TLS 1.2+) and at rest for sensitive data, hashed passwords, optional two-factor authentication, access controls, audit logging and regular security reviews. We will notify you and the competent authority of a personal data breach as required by law.

8. Your rights

Subject to the law, you may request access to, correction of, or deletion of your personal data, withdraw consent, object to processing, or request a copy of your data. Write to [email protected]. We respond within the period required by law. You may also complain to the Ministry of Transport, Communications and Information Technology.

9. Cookies

We use only strictly necessary cookies: a session cookie that keeps you signed in and protects forms against forgery. We do not use advertising or third-party tracking cookies.

10. Children

Our services are not directed at persons under 18 and we do not knowingly collect their data.

11. Changes

We will post updates here and notify customers of material changes by email.