🛍️Buyer LegalPrivacy & DataPrivacy and DataVersion 2.3FWR-BUY-005

Privacy Policy

Every category of personal data we process, why, on what legal footing, who receives it and for how long.

📅Effective: 26 July 2026🔄Last updated: 28 July 2026⏱️21 min read🌐Available in Arabic & English

1. Introduction and purpose#

1.1 This policy explains how Fawran collects, uses, discloses, retains and protects your personal data when you use the Fawran buyer platform, and the rights you have over that data.

1.2 We process personal data under the Personal Data Protection Law No. (24) of 2023 (the “Law”) and other applicable legislation.

1.3 This policy also serves as the prior notice required by Article 9 of the Law, which obliges the controller to inform the data subject — in writing or electronically, and before processing begins — of six matters: the data to be processed and the date processing will commence; the purpose; the period; the processor participating alongside the controller; the security, safety and protection controls; and information on profiling. Those six matters are in sections 3, 4, 6, 7, 10 and 11 below.

2. Who is responsible for your data#

2.1 FAWRAN LLC, operating under the trade name FAWRAN, operates the FAWRAN marketplace and is responsible for the personal data described in this policy. Fawran provides marketplace services to customers in Jordan.

2.2 Privacy requests, data-rights requests and related complaints go to the legal and privacy contact address shown in the “Operator and contact details” section at the foot of this document. The detailed route is in the Data Rights and Privacy Requests Policy.

2.3 Some of the infrastructure the Platform runs on is operated by the service providers named in section 6, whose systems are located outside the Kingdom. Section 7 sets out what that means and the footing for it.

3. The personal data we process#

The “required or optional” column exists so you know exactly what the service cannot work without.

3.1 Data you give us#

Category	What it includes	Required or optional
Email address	The address you enter to sign in	Required — it is how an account is created and how you sign in
Name and contact details	Your name and phone number	Required to fulfil and deliver an Order
Other profile details	Profile image, date of birth, gender	Optional — the account works without them
Delivery addresses	The address text, and coordinates and a location description if you set the location on the map	Required to deliver your Order
Order content	Items, quantities, and any notes you attach	Required to fulfil the Order
Return requests	Reason for return, the condition you declare, and any images you attach	Required to process a return request
Reviews and ratings	Review text, rating, attached images, display name	Optional
Support messages	The text of your support tickets and any attachments	Optional — only if you contact us
Shipment messages	Messages you exchange with the Captain about a live delivery	Optional — only if you use the shipment chat
Account preferences	Language, currency and notification preferences	Optional

3.2 Data created as you use the Platform#

Category	What it includes	Required or optional
Sign-in verification records	The record that a one-time code was issued to your email address and verified. A code expires ten (10) minutes after it is issued	Required to sign you in
Order and purchase history	Your Orders, their contents, their status and their history	Required to operate the service
Payment records	The transaction status, the authorisation result, the last four digits and card type, and a reference identifier	Required for a card payment
Cash-on-delivery records	The amount due, the handover and the collection record	Required for a cash-on-delivery Order
Wallet records	Your wallet balance and the transactions that moved it	Required to operate the wallet
Refund records	The refund amount, its destination and its status	Required to execute a refund
Sponsored-placement records	That a sponsored placement inside Fawran was shown to you, that you tapped it, and whether an Order followed	Required to bill and measure placements inside the Platform
Notification token	The device token the mobile app registers so order and shipment notifications reach your device	Required for notifications in the mobile app
Service and security records	Connection and service records, and aggregate usage and session records used to keep the Platform running, diagnose faults and protect accounts	Required to operate and secure the service
Device details attached to a support ticket	If you open a support ticket, the browser or operating-system description of the device you opened it from is attached to that ticket	Optional — only if you contact us

3.3 Kept on your device, and not sent to us#

Your cart, wishlist, recently viewed Items, search history, language and chosen market are stored by the application on your own device. They are not uploaded to us and are not attached to your account. Clearing your browser or app storage removes them.

Search terms are separately counted in an aggregate tally used to show trending searches. That tally holds the term and how many times it has been searched. It is not linked to you or to your account.

3.4 Your location#

3.4.1 Fawran processes location information only when you actively choose to share it — for example when you select or confirm a delivery location on the map, or use the “current location” control. We then use the location permission you granted to obtain coordinates and convert them into an address. Typing an address by hand also causes the maps provider to convert that address into coordinates.

3.4.2 We do not collect your location at any other time, and we do not use it to follow your movements.

3.4.3 You can always enter an address by hand instead of granting the location permission, and you can withdraw the permission in your device settings at any time.

3.5 Data that reaches us from others#

Source	What reaches us
The payment service provider	Transaction status, authorisation result, last four digits and card type, and a reference identifier — we never receive the full card number or the security code
The Seller	Item preparation status and shipment information in the FBS model
The delivery partner and Captain	Delivery attempt status, time of handover, and reason for a failed attempt

3.6 Data we do not collect#

We do not collect sensitive personal data as defined in Article 2 of the Law (such as health, biometric or genetic data, or religious or political beliefs) in the ordinary course of shopping, and we do not ask you for it.
We do not store your full card number or its security code; that is handled by the payment service provider.
We do not track you across other companies' apps or websites, and we place no third-party advertising network on the Platform.
We do not listen to your microphone, and we do not use your camera or photo library except for an image you choose to attach — to a return, a review or a support ticket — or an image you use to search, which is matched on your device and is not uploaded.
We do not sign you in with a password, a social account or a text message. Signing in is by a one-time code sent to your email address, and nothing else.

4. Purposes of processing and their legal footing#

4.1 Article 4(A) of the Law provides that every natural person has the right to protect their data, and that it may not be processed except after obtaining the prior consent of the data subject, or in the situations permitted by the Law.

4.2 Article 6(A) lists the situations in which processing is lawful without prior consent, including processing required or authorised under legislation or a ruling of a competent court, processing necessary for the prevention or discovery of a crime by a competent authority, and data made available to the public by the data subject.

4.3 Our legal footing for ordinary processing is your prior consent, given when you create your account and place your Order.

Purpose	What it covers	Footing
Creating your account and signing you in	Sending a one-time code to your email address, verifying it, creating the account or signing you in, and keeping your session	Your prior consent
Fulfilling your Order	Pricing, availability checks, collecting payment, preparation, delivery	Your prior consent
Returns and refunds	Processing the return request, arranging collection, inspection, executing the refund	Your prior consent
The wallet	Holding a balance, crediting a refund to it, and spending it inside the Platform	Your prior consent
Customer service	Answering your tickets, and verifying your identity before disclosing anything	Your prior consent
Shipment messages	Passing your messages to the Captain handling your live delivery	Your prior consent
Operational messages	Order, return and security status notifications	Your prior consent (and not switchable off while you have a live Order — see section 12)
Ordering suggestions on the home page	Ordering suggested Items using the categories in your recent Orders — see section 5	Your prior consent. You may object to it under Article 4(B)(6) by writing to the privacy contact address
Measuring sponsored placements inside Fawran	Recording that a placement was shown, tapped and whether an Order followed, so a placement can be billed and measured	Your prior consent
Keeping the service running and secure	Service records, fault diagnosis, and protecting accounts and the Platform	Necessary to provide and protect the service you asked for, and to protect the rights of the parties under Article 6(A) of the Law
Legal and accounting obligations	Keeping financial records and responding to requests from competent authorities	Legal obligation, under Article 6(A) of the Law

4.4 What happens if you do not provide the required data? We cannot create your account, accept your Order, or deliver it. Nothing else follows, and we do not stop you browsing.

4.5 What happens if you decline the optional data? The service works in full. You simply will not have a profile image, a date of birth, a review, a support ticket or a shipment conversation that you did not create.

5. Personalisation and automated decisions#

5.1 What we actually do. On the home page, some suggested Items are ordered using the categories that appear in your recent Orders. It changes the order in which Items are presented to you. It produces no legal effect on you.

5.2 What we do not do. We do not build an advertising profile of you, and we do not sell or share your behaviour with an advertising network.

5.3 A core safeguard: no permanent decision affecting your account is taken by automated processing alone. Before an account is suspended or terminated, or a return refused on abuse grounds, a member of staff reviews the case, and you may object under the Acceptable Use Policy and the Customer Complaints and Escalation Policy.

5.4 Article 4(B)(6) of the Law gives you the right to object to processing and profiling where it is not necessary for the purposes for which the data was collected, or is excessive, or is discriminatory, prejudicial, or contrary to the Law. Write to the privacy contact address to exercise it.

6. Who receives your data#

6.1 We do not sell your personal data.

6.2 We share data, only to the extent necessary, with the following categories.

6.2.1 Service providers processing data on our behalf#

Provider	Service	Data it processes
Google — Firebase platform	Sign-in infrastructure, database, file storage, and delivery of push notifications	Account, order, address, review and attachment data
Google — Maps Platform	Maps, address autocomplete, and converting an address into coordinates	The address text you enter, and coordinates when you set a location
Apple — Push Notification service	Delivering notifications to an Apple device	The device notification token and the notification itself
Stripe	Card payment processing, saved cards, and wallet top-up	Card data (held by them), the amount, and the transaction identifier
Resend	Delivering our email, including your one-time sign-in code	Your email address and the content of the message
Vercel	Hosting and content delivery for the buyer website and the buyer application interfaces	Connection records, including your IP address

6.2.2 These providers process data on our instructions and for the specified purpose only, and are subject to confidentiality obligations.

6.2.3 Parties involved in fulfilling your Order#

The Seller: receives what is needed to prepare your Order and process your return, including the recipient name, contact details and address in the FBS model.
The Captain and delivery partner: receives the name, contact details, address and location description, the amount due on cash-on-delivery Orders, and any message you send through the shipment chat.

6.2.4 Competent authorities#

We disclose data to competent authorities where the law or a court order requires it, or to protect the rights or safety of people, and only to the narrowest extent that achieves the purpose.

6.3 Article 14 of the Law requires, for the transfer or exchange of data with any other person including a recipient, the consent of the data subject, that the transfer realise legitimate interests, that you have full sufficient knowledge of the recipient and the purposes of use, and that the purpose not be marketing unless you consent to that. The recipients are named in this section, and what reaches each of them is limited to what its service requires.

7. ★ Transfers outside the Kingdom#

7.1 A plain disclosure: the service providers named in section 6 run their infrastructure outside the Hashemite Kingdom of Jordan. Your data is therefore stored and processed, in part, outside Jordan.

7.2 Article 15(A) of the Law provides that data shall not be transferred to a person outside the Kingdom where the level of protection that person offers is lower than that provided in the Law, except in certain cases — one of which is the data subject's consent to the transfer after being made aware that no sufficient level of protection exists.

7.3 Article 15(B) obliges us, before beginning the transfer, to verify the level of protection the recipient provides outside the Kingdom.

7.4 What we do in practice: we contract with providers who are contractually bound to protection, confidentiality and security standards; we limit what reaches them to what their service requires; and we review this periodically.

⚠️

When you create an account and place an Order, you are informed that part of the processing of your data takes place outside the Hashemite Kingdom of Jordan, and you consent to that transfer for the purposes set out above. This is not optional processing: the Platform runs on that infrastructure, so withdrawing this consent means the service cannot be provided.

8. Data security#

8.1 We apply technical and organisational controls proportionate to the nature and volume of the data, including:

encryption of the connection between your device and our servers;
access control, so that a member of staff reaches only what their work requires;
separating sensitive payment data from our systems and delegating it to a specialist provider;
logging and traceability of sensitive operations;
verifying the identity of anyone requesting data before disclosing it.

8.2 What you can do: because sign-in works through a one-time code sent to your inbox, securing your email — with two-step verification, and by never sharing codes — is the single most important thing you can do to protect your account.

9. Data breach#

9.1 Article 20(A) of the Law provides that, on a breach of the security and integrity of data that is likely to lead to severe harm to the data subject, the controller shall:

notify the affected data subjects within twenty-four (24) hours of the time the breach was discovered, and provide them with the measures necessary to avoid its consequences;
report to the Unit within seventy-two (72) hours of discovery of the breach, stating its source and mechanism, the data subjects affected, and any other available information.

9.2 Those are the timeframes we hold ourselves to.

9.3 Article 20(B) provides that a controller who commits a gross fault or wilful misconduct is obliged to compensate the data subject.

10. Retention, and what deleting your account does#

10.1 Article 6(B) of the Law provides that data which has been processed shall not be retained after the fulfilment of the purpose for which it was processed, unless legislation provides otherwise.

10.2 We therefore apply the following periods:

Data category	Retention	Reason
Account and profile data, saved addresses and preferences	While the account exists; deleted when the account is deleted	Purpose fulfilled when the relationship ends
One-time sign-in codes	Expire ten (10) minutes after they are issued	Purpose fulfilled
Notification tokens	Revoked when the account is deactivated	Purpose fulfilled
Order, invoice, payment and cash-on-delivery records	Kept after account deletion for the period required by accounting and tax legislation and for evidencing the transaction	Legal obligation — the exception in Article 6(B)
Return and refund records	As for order records, being part of the evidence of the financial transaction	Legal obligation
Wallet balance and wallet transactions	As for order records	Legal obligation
Support correspondence and shipment messages	The operational content remains once any linked dispute has closed, with your identity removed from it	Evidence, then de-identified
Reviews and posted content	Detached from your identity on account deletion, so the review text remains without anything identifying you — unless you ask for the text itself to be deleted	Interest of other buyers, with identity removed
Policy acceptance records	Kept while the contract subsists and for the period needed to evidence it afterwards	Evidencing the contract
Sponsored-placement records	Kept for the period needed to bill and reconcile the placement	Billing and reconciliation
Service, session and security records	Kept for a bounded period for operations and security, then destroyed or aggregated so that they identify no individual	Purpose fulfilled
Aggregate search tally	Kept while it is useful; it identifies no individual	Not personal data

10.3 Legal hold: if your data is the subject of a live dispute, claim, investigation or court order, we retain what is necessary until that concludes, and we tell you so when we answer a deletion request.

10.4 ★ What deleting your account actually does. Asking us to delete your account is not a switch that erases everything in the same instant, and it is not a cosmetic flag either:

When	What happens
The moment you ask	The account is deactivated at once — sessions end on every device, sign-in stops, personalised suggestions stop, any usage record stops being linked to your account, notification tokens are revoked, and your cart and wishlist are cleared
For the next 30 days	A recovery period. You can bring the account back with a one-time code sent to your email address, followed by an explicit confirmation from you. Entering the code alone does not restore anything
After the period ends	Your personal data is deleted or detached from your identity, permanently, and the account cannot be recovered
After that	Only the records in the table above that we are required to keep remain, in a restricted scope

10.5 Retained records are not an account. They are reachable only by the roles that need them for the stated purpose; they are never used for marketing, recommendations, personalisation or any commercial contact; they do not appear in buyer lists or active-user statistics; and each category carries a review or expiry date. We keep nothing indefinitely.

10.6 Reviews you have posted stay on the product page after deletion with your name replaced by a neutral label and every link back to you removed — unless you expressly ask for the review text itself to be deleted, in which case we delete it.

10.7 If you also hold a Fawran seller or captain account under the same email address, deleting the buyer account removes the buyer role and its data only. Your sign-in identity and your other role keep working.

10.8 The full treatment of each category, how deletion is started, the recovery process, the wallet rule and the email-reuse rule are set out in the Account Deletion and Data Deletion Policy.

11. Your rights#

11.1 Article 4(B) of the Law gives you the following rights:

to know, review, access and obtain the data held by the controller;
to withdraw prior consent;
to correct, amend, add to or update the data;
to restrict processing to a specific scope;
to erase or conceal the data in accordance with the Law;
to object to processing and profiling, as set out in section 5 above;
to transfer a copy of your data from one processor to another;
to be notified and aware of any breach, infringement or prejudice to the security and integrity of your data.

11.2 Article 4(C) provides that your exercise of these rights shall not entail any financial or contractual consequences. We charge nothing for a rights request, and we do not change your terms because you made one.

11.3 How to exercise each right, response times, and identity verification are set out in the Data Rights and Privacy Requests Policy.

11.4 Article 17(E) of the Law gives the Personal Data Protection Council competence to consider complaints and requests submitted by a data subject against a controller. Article 18(B) provides for the Unit to receive and investigate notifications and complaints relating to breaches of the Law. You may complain to them at any time; going through us first is not a precondition.

12. Messages and preferences#

12.1 Operational messages — the one-time sign-in code, order confirmation, shipment status, security alerts — are part of the service and cannot be switched off while you hold an account or have a live Order.

12.2 We do not currently send marketing or promotional messages to buyers. If that changes, this policy and the Communications and Marketing Preferences Policy will say so before any such message is sent.

12.3 Notification categories are switched in your account settings, and app notifications can be turned off in your device settings.

13. Children#

13.1 The Platform is not directed at persons without legal capacity to contract.

13.2 We do not knowingly collect children's data. If we learn that we hold a child's data without the consent of a parent or guardian, we delete it.

13.3 Article 5(A)(4) of the Law requires prior consent, in the case of a person lacking legal capacity, to be given by one of the parents or the legal guardian, or by a judge on the Unit's request where that is in the best interest of that person.

13.4 If you are a parent or guardian and believe we hold your child's data, contact us at the legal and privacy contact address.

14. Cookies and device storage#

What the website keeps in your browser, what the app keeps on your device, the purpose of each, and how to clear it, are set out in the Cookie and Device Storage Policy.

15. External links and services#

15.1 The Platform may contain links to sites we do not operate. We do not control them and are not responsible for their policies.

15.2 Once you leave the Platform, the privacy policy of the site you moved to applies.

16. Changes to this policy#

16.1 We may amend this policy. Each amendment is issued with a version number and an effective date and preserved in the policy changelog.

16.2 The current version is always published here, and the version history at the foot of this document records what changed. Where a change is material we publish it before it takes effect, and we seek fresh consent where the Law requires it — Article 5(B)(2) provides that consent is not treated as having been obtained where the nature, type or objectives of the processing are altered without obtaining consent for that change.

17. Complaints#

17.1 If you object to how we process your data, write to us first at the legal and privacy contact address; we undertake to respond within the timeframes in the Data Rights and Privacy Requests Policy.

17.2 You may at any time complain to the competent personal-data-protection regulator in the Kingdom, under Articles 17(E) and 18(B) of the Law.

18. Version history#

Version	Date	What changed
1.0	26 June 2026	Initial publication.
2.0	26 July 2026	Actual service providers named for the first time; express disclosure of transfers outside the Kingdom and their basis in Article 15; category table added showing what is required and what is optional; retention periods added per category; breach notification timeframes added under Article 20; each purpose tied to its legal footing under Articles 4 and 6.
2.1	26 July 2026	Data controller identified as FAWRAN LLC.
2.2	27 July 2026	Section 10 rewritten to state what deleting an account actually does: immediate deactivation, a thirty-day recovery period, then deletion or de-identification, with retained records held in a restricted scope and carrying a review date.
2.3	28 July 2026	Updated controller wording, authentication disclosures, data categories, retention language and processing descriptions to align with the current Buyer application. Sign-in is described as it works — an email address and a one-time code sent to it. The data-category tables were rebuilt from the categories the application actually processes, including date of birth, gender, the wallet, shipment messages and the notification token; the categories kept only on your own device are now separated from those that reach us; and the service-provider table lists only providers actually in use. Location wording now matches when the permission is actually used. A correction of description: no processing purpose is added, no right is narrowed, and the effective date is unchanged.

Operator and contact details

These details apply to every document in the Legal Center.

Contracting entity: FAWRAN LLC
Trading as: FAWRAN — فورا
Operating market: Marketplace services for customers in The Hashemite Kingdom of Jordan
Registered Office: FAWRAN LLC 131 Continental Drive, Suite 305 Newark, Delaware 19713 United States of America
Legal and privacy contact: admin@fawra.net
Customer support: https://help.fa9ran.com
Governing law: the laws of the Hashemite Kingdom of Jordan
Dispute venue: the competent courts of Amman