Privacy Policy and Data Protection

1. Who we are and our role

The Establishment is registered in the Hashemite Kingdom of Jordan as a sole proprietorship under the legal name BarmajTek and the trade name BarmajTek. We provide software solutions and SaaS platforms for businesses in Jordan and the Arab region.

• When you visit our website or subscribe to our services directly, we act as the "data controller" and determine the purposes and means of processing.
• When a business customer (clinic, gym, restaurant, store, teacher, etc.) uses our platform to manage their own end-users' data (patients, members, students, buyers), the customer is the "controller" and we act as a "processor" on their behalf under the Data Processing Addendum (DPA).

2. Data we collect

3. Purposes and legal basis

• Providing the service: creating accounts, operating the platform, and delivering features — based on performance of our contract with you.
• Billing and subscription collection: issuing invoices and tax compliance (ISTD/JoFotara) — based on contract and legal obligation.
• Support and operational communication: responding to your requests and sending important notices — based on contract and legitimate interest.
• Service improvement and security: analytics, fraud prevention, and protecting our systems — based on legitimate interest.
• Marketing: sending offers or newsletters — based on your consent, which you may withdraw at any time.

4. Cookies

We use cookies that are necessary to run the website, plus preference and analytics cookies. Details of the types and how to control them are in our Cookie Policy.

5. Data sharing and third parties

We do not sell your personal data. We may share it with trusted service providers only as needed to operate our services:

• Cloud hosting and infrastructure to store and run the platform.
• WhatsApp / messaging providers to send notifications, reminders, and codes.
• Payment channels (CliQ / banks) to process subscriptions.
• The national JoFotara e-invoicing system and the Income and Sales Tax Department (ISTD) for tax compliance.
• Email and analytics services to deliver messages and measure performance.
• Authorities where there is a legal obligation or court order.

These providers are contractually bound to protect the data and use it only for the specified purpose.

6. International transfers

Some data may be stored or processed on servers outside Jordan by our cloud providers. In that case we apply appropriate safeguards consistent with the Personal Data Protection Law No. (24) of 2023 to ensure an adequate level of protection.

7. Data retention

We retain your data for the duration of the subscription and for as long as needed to fulfil the processing purposes or to comply with legal obligations (such as accounting and tax records). When the relationship ends, we delete or return customer data within 30 days of the request, unless the law requires otherwise.

8. Data security

• Encryption of data in transit (TLS) and hashing of passwords.
• Role-based access controls and per-customer data isolation (tenant isolation).
• Regular backups and security monitoring.
• Least-privilege access reviews.

Although we take reasonable measures, no transmission over the internet can be guaranteed to be perfectly secure.

9. Your legal rights

Under Jordanian law, you have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase data within the limits permitted by law.
• Object to or restrict certain processing.
• Withdraw consent at any time (for consent-based processing).
• Lodge a complaint with the competent supervisory authority in Jordan.

To exercise your rights, email info@barmajtek.com. We respond within the period set by law.

10. Children's data

Our services are directed at businesses and adults. We do not knowingly collect data from children below the legal age without parental consent. If a business customer uploads minors' data (e.g. paediatric patients in a clinic), the customer is responsible for obtaining the necessary consents.

11. Business customer data (controller/processor)

When your business uses our platform to manage your own customers' data, you are the "controller" and we are the "processor". This relationship is governed by the Terms & Conditions and the Data Processing Addendum (DPA), including our commitment to notify breaches within 72 hours and to delete/return data within 30 days.

12. Changes to this policy

We may update this policy from time to time. We publish the updated version with a new effective date and notify you of material changes by email or within the platform.

13. How to contact us