Data Rights and Privacy Requests Policy

1. Purpose#

1.1 The Privacy Policy explains what we process and why. This document explains how you exercise your rights in practice: what to ask for, where to send it, how we verify it is you, how long we take, and what to do if you are not satisfied.

1.2 Your rights are exercised against the data controller: FAWRAN LLC, operating under the trade name FAWRAN. Its contact address is in the “Operator and contact details” section at the foot of this document. Every right below is available to you in full.

2. Your eight rights#

Article 4(B) of the Personal Data Protection Law No. (24) of 2023 gives you the following rights:

Exercising any of them carries no financial or contractual consequence, under Article 4(C) of the Law. The request is free, and it does not change your terms with us.

3. How to make a request#

3.1 What you can do yourself, straight away#

3.2 What needs a request#

For the remaining rights, send your request to the legal contact address shown in the “Operator and contact details” section at the foot of this document, or open a ticket through support.

So that we can act quickly, include:

1. the right you are exercising (from the table above);
2. the email address attached to your Fawran account;
3. the scope, if it is narrower than everything (for example “my orders in 2026”, or “my old address only”);
4. any detail that helps us locate the data you mean.

4. Verifying your identity#

4.1 We do not disclose or delete personal data until we are satisfied the request comes from the person it belongs to. This protects you.

4.2 Our verification is proportionate to the consequence of the request:

4.3 We will never ask you for your full card number, its security code, or a one-time sign-in code as a way of verifying you on a privacy request.

4.4 If we cannot reasonably verify you, we tell you why and what would complete the request — we do not use it as a way of avoiding the request.

5. Timeframes#

5.1 We hold ourselves to the following:

5.2 Time runs from the point at which the request is complete and your identity verified, not from an initial incomplete message.

6. When we may not be able to comply in full#

6.1 A request may be not fully actionable in limited cases:

6.2 In every case of partial or full refusal we:

• state the specific reason, not a generic phrase;
• carry out the part we can, rather than refusing the whole request because of one part;
• tell you how to escalate.

7. What a copy of your data contains#

When you ask for a copy, we give you what we hold about you in the categories that can be linked to you, which is normally:

• account data (name, email, phone, language, preferences);
• saved delivery addresses;
• order history, details and status;
• return and refund records, and wallet balance movements;
• reviews and content you posted;
• support correspondence;
• your policy acceptance records.

We provide it in a machine-readable format, with a short explanatory file describing what the fields mean.

8. Withdrawing consent#

8.1 You may withdraw any optional consent at any time, including your consent to the ordering of suggestions described in section 5 of the Privacy Policy.

8.2 Effect: future use for the withdrawn purpose stops. Withdrawal does not make what happened before it unlawful.

8.3 What cannot be withdrawn while keeping the service: processing necessary to fulfil a live Order, to secure your account, or to meet a legal obligation. Withdrawing consent to those is, in practice, ending the relationship — that is, deleting the account.

9. If you are not satisfied#

9.1 Escalation inside Fawran: under the Customer Complaints and Escalation Policy.

9.2 Complaint to the regulator: Article 17(E) of the Law gives the Personal Data Protection Council competence to consider complaints and requests submitted by a data subject against a controller and to take the necessary action. Article 18(B) provides for the Unit to receive and investigate notifications and complaints concerning breaches of the Law.

9.3 You do not have to complain to us first; you may go to the regulator directly.

9.4 The courts: Article 21(C) of the Law provides that applying any of the administrative measures does not prevent a person who has suffered harm from bringing a case claiming civil compensation for damage sustained as a result of a violation of the Law.

10. Version history#