Privacy and data protection policy

This document is required by Article (15/2) and complies with Article (18) of Decree-Law No. (21) of 2025 on Electronic Commerce (قرار بقانون رقم (21) لسنة 2025م بشأن التجارة الإلكترونية).

The principle

We collect the minimum data needed to conclude and perform your order, and we do not collect anything merely because it might be useful later. That is a legal obligation on us under Article (18/2/b), not a marketing choice.

1. Your consent

We do not collect your personal data without your consent, under Article (18/2/a). You give that consent by creating an account and using the service, and you can withdraw it at any time by deleting your account.

2. What we collect and why

• Name — to address you, and to identify the person the order belongs to for the driver and the business.
• Phone number — to verify the account and to contact you about the order.
• Email address (optional) — to send order confirmations, invoices and shipping notices.
• Delivery address and area — to deliver the order and calculate its fee.
• Order contents and history — to fulfil the order, issue the invoice, and provide after-sales service.
• Account picture (optional) — to personalise your account, nothing else.
• Device identifier for notifications — to send you the status of your order.
• In-app usage data — to improve the service and the ordering of what is displayed, in aggregate form.

We do not collect payment card data. Payment today is cash on delivery, and when electronic payment is enabled its data will be handled by a payment provider licensed by the Palestine Monetary Authority and will not pass through our servers (Article 17/2).

3. Who we share data with

We share only the minimum necessary to fulfil your order:

• The commercial business: your name, the contents of your order, and your notes.
• The driver: your name, phone number and delivery address — and only for as long as the order is being fulfilled.
• The shipping company (for shipped orders): your name, phone and address, to deliver the consignment and issue its waybill.
• Technical service providers acting for us: server hosting, the email sending service, and the notification service. They process the data on our instructions and for operational purposes only.
• Official authorities: on a binding legal request from a competent authority.

4. What we never do

Under Article (18/2/d) of the law:

• We do not sell your data.
• We do not share it with any other party for commercial or non-commercial purposes beyond what is set out above as necessary to perform the contract.
• We do not use your order data for purposes unrelated to the service.

5. Marketing messages

• Order notifications and emails (acceptance, delivery, invoice, shipping) are part of performing the contract and reach you for as long as you have an order.
• Promotional messages are entirely optional, and you can switch them off at any time from your account settings or from the unsubscribe link at the bottom of every message, without affecting your order notifications.

6. Protecting the data

We take the measures required to protect the data under Article (18/2/c): fully encrypted connections, passwords stored hashed so that they cannot be recovered, internal access restricted on a need-to-know basis, and administrator actions logged.

Even so, no system is absolutely secure, and we do not promise you what we cannot guarantee.

7. In the event of a breach

If we learn of any breach that leads to your data being disclosed, we notify the Ministry of National Economy and the competent authorities as soon as we know of it, under Article (18/2/e), and we tell you what concerns you and what steps to take.

8. Retention periods

• Account data: for as long as your account exists.
• Order and invoice records: for the period required by the tax and commercial legislation in force, even after the account is deleted, and separated from your identifying data as far as possible.
• Aggregated usage data: in a form that does not allow you to be identified.

9. Your rights

At any time you may:

• See the personal data we hold about you.
• Correct any inaccurate detail, directly from your account page.
• Ask for your account and data to be deleted — see the data deletion policy.
• Withdraw your consent to promotional messages.
• Complain to us or to the Ministry of National Economy.

10. Privacy contact

• Email: support@shoabalak.com
• Phone and WhatsApp: +970 56 970 3134
• Address: فلسطين