1Who we are
This notice is from Nashamaz Technologies (نشامى ز للتكنولوجيا), Amman, Jordan (“Nashamaz”, “we”, “us”). We are the controller of the personal data collected through our website, nashamaz.com: we decide why and how it is used. The notice is written to follow Jordan’s Personal Data Protection Law No. 24 of 2023 (“the law”).
For anything about your data, email info@nashamaz.com or call +962 7777 000 82.
2What this notice covers
It covers the website nashamaz.com and how we handle your data when you contact us. It also explains our role in the products we build and run for clients (Tfaddal, Mirsal, Afia, Sahtein and Kart) in the section “Our products”.
3What the website collects
- The contact form. When you send it, we receive what you enter: your name, your company (optional), your phone number and/or email, the service or product you chose, and your message (optional). We also record the language of the page you sent it from and the time.
- Spam check. Cloudflare Turnstile checks that the form is sent by a person. It looks at signals from your browser and your IP address.
- Abuse limits. To stop the form being misused, we count recent submissions per IP address and per email address. For this we keep only a one-way hash (SHA-256) of each, never the address itself, in Cloudflare’s cache: for 10 minutes for an IP address and 24 hours for an email address.
- Hosting and security. Like any website, our host Cloudflare receives your IP address and basic information about your browser when you open a page, to deliver the page and protect the site from attacks.
- Visit counts. We count page visits with Cloudflare Web Analytics. It uses no cookies and does not build a profile of you.
- Direct contact. If you call us, message us on WhatsApp or email us, we receive what you send through that channel. WhatsApp is run by Meta under its own terms and privacy policy.
The site sets no cookies of its own, runs no advertising or tracking scripts, and serves its fonts from our own domain rather than a third party.
4Emails we send
The form reaches our team as an email sent through Resend, an email delivery company based in the United States; our sending domain uses its region in Ireland. If you gave an email address, Resend also delivers one automatic confirmation to you. It names the topic you chose and never repeats your message. We send no newsletters or marketing emails from the form. Your inquiry is then kept in our mailbox at info@nashamaz.com.
5Why we use it
We use your data only to:
- reply to your inquiry and talk with you about the service you asked about;
- keep the website and the form safe from spam and abuse;
- prepare and manage our work together, if you become a client.
We rely on your consent when you send the form or contact us, and on the steps needed before and during a contract with you.
We do not sell, rent or trade personal data, and we do not use it for advertising.
6Who handles data for us
- Cloudflare, Inc. (United States, with data centres worldwide): hosting, security, Turnstile, Web Analytics and the cache used for abuse limits.
- Resend (United States, sending region in Ireland): delivering the form emails.
- Our email hosting (servers in the United States): keeping the inquiries we receive at info@nashamaz.com.
They handle data on our instructions and only for these purposes. We may also disclose data when the law requires it or a competent authority asks for it.
7Transfers outside Jordan
Cloudflare and Resend run their infrastructure outside Jordan, mainly in the United States and the European Union, our email is hosted on servers in the United States, and Cloudflare serves the site from data centres around the world. Your data may therefore be processed outside Jordan. We choose providers that protect data with recognised safeguards. By sending the form, you agree to this transfer for the purposes above. The section “Our products” names other providers used by Mirsal.
8How long we keep it
- Inquiries: 24 months after our last contact with you, then deleted, unless they become part of a client relationship whose records the law requires us to keep for longer.
- Abuse-limit hashes: 10 minutes for an IP address, 24 hours for an email address.
- Cloudflare logs and visit counts: for the periods Cloudflare sets.
- Kart guest replies: deleted 30 days after the wedding.
9Our products
We build and run software for businesses and individuals. In these products, the client who uses them decides what data is collected and why, and is the controller of that data. We process it on the client’s behalf, as a processor, under our agreement with them. If you are a customer of one of our clients, please contact that business first; we will help it answer you.
- Tfaddal, Mirsal and Afia. Each client has its own separate deployment, hosted on Cloudflare. One client’s customer data is never shared with another client. We access it only as needed to run, support and secure the service.
- Afia holds patient records. These are health data, which the law treats as sensitive. The clinic is responsible for its patients’ consent and decides who may see the records. Access is limited to the clinic’s authorised staff, and to us only where needed to run the service.
- Mirsal sends and receives WhatsApp messages through Meta’s WhatsApp Business Platform, using the client’s own WhatsApp Business account, so Meta’s terms and privacy policy also apply to those messages. To write its replies, Mirsal sends the text of the conversation to an artificial intelligence provider, currently OpenAI (United States), which processes it to produce the reply.
- Sahtein shows a restaurant’s menu. It holds menu content only: diners do not create accounts or give any personal data.
- Kart wedding invitations collect a guest’s reply: the name, the number of guests and an optional message. No phone number, email or IP address is stored with the reply. The couple sees the replies through a private link. Replies are deleted 30 days after the wedding, and invitation pages are hidden from search engines.
- Our internal client system. When you become a client, we keep your business contact and billing details in an internal system that only our team uses.
10Your rights
You can ask us to:
- tell you whether we hold data about you, and give you a copy;
- correct or update it;
- delete it;
- restrict how we use it, or object to its use;
- give it to you or to someone else in a usable format;
- withdraw your consent at any time, without affecting what was done before.
To use any of these rights, email info@nashamaz.com. We may ask you to confirm your identity first. We reply within 30 days of receiving your request.
If you are not satisfied with our answer, you can complain to the personal data protection authority at the Ministry of Digital Economy and Entrepreneurship.
11How we protect it
The site works only over an encrypted connection (HTTPS), the form is protected against spam and abuse, and access to inquiries is limited to our team. If a breach puts your personal data at risk, we will tell you and the competent authority as the law requires.
12Children
The website is meant for businesses and adults. We do not knowingly collect data from children through it.
13Effective date and changes
This notice takes effect on 11 October 2026. If we change it, we update the date at the top of this page and publish the new version here. If a change affects how we use data you have already given us, we will tell you where we can.
