Privacy Policy

This policy explains what personal data we collect when you use the Makhdoom platform through the website and the app, why we collect it, who we share it with, how long we keep it, and your rights over it. It applies to customers and to users of office accounts.

1. Who we are

1.1 The controller of your data is the operator of the platform: Makhdoom, referred to as "the platform" or "we".

1.2 To contact us about privacy: support@makhdoom.io.

2. The data we collect

2.1 Account data: phone number, name in Arabic and English (if you enter it), email address (optional for customers, required for office accounts), preferred language, governorate and area.

2.2 Identity data: when you enter your Civil ID number we store only an irreversible hashed form and its last four digits. We do not store the full Civil ID number.

2.3 Verification data: the steps of identity verification through the government apps, their result and timing, any document you upload as proof of verification when automatic verification is not possible, and the result of our team's review of it.

2.4 Booking data: the workers you booked, saved, compared or viewed, the office concerned, the status, steps and dates of each booking, and your acceptance of the terms with their version number.

2.5 Payment data: the amount, the payment method, the status of the transaction, its reference number at the payment gateway, and refund details if any. We do not receive or store your bank card number or security code. You enter those at the payment gateway directly.

2.6 Device and notification data: your app's notification token, the operating system type, the app language and version, and when it was last used.

2.7 Communications: support requests with their messages and attachments, and the log of notifications and messages we sent you with their status.

2.8 Technical data and logs: network (IP) address, browser or device type, sign-in time and the important actions taken from your account (such as accepting the terms, paying and cancelling), and error logs.

2.9 Marketing preferences: whether and when you agreed to receive marketing messages, and when you stopped them.

2.10 Office user data: name, email address, phone number, role in the office, and the office details and documents the office uploads (such as the licence, the commercial registration, proof of the owner's identity and bank account details).

2.11 We do not ask you for data that is not needed to provide the service, and we do not collect data about you from outside sources, apart from what the payment gateway tells us about the result of a payment.

3. Why we use your data

3.1 To provide the service you asked for: creating your account and signing you in with a verification code, showing workers, carrying out the booking, payment and refund, passing the booking to the office and following its steps.

3.2 To verify identity and to prevent fraud, duplicate accounts and misuse, and to protect the platform and its users.

3.3 To contact you about your account, your bookings and your support requests.

3.4 To meet our legal obligations, including keeping financial records and responding to requests from the competent authorities.

3.5 To improve the platform and measure its performance with internal statistics about the use of the service (such as the number of bookings and their steps).

3.6 To send marketing messages, only with your consent, which you can withdraw at any time.

3.7 We rely for this processing on: performing the agreement between you and the platform, your consent where we ask for it, our legal obligations, and our legitimate interest in securing and developing the service in a way that does not affect your rights.

4. Who we share your data with

4.1 The office concerned with your booking: we show it your name, your area, the booking details and the verification status needed to carry it out. The platform does not show the office your Civil ID number. What you give the office directly when contracting is the office's responsibility and subject to its practices.

4.2 Payment gateways: they receive the transaction details needed to complete the payment or refund, and they process the payment method details under their own terms and policies.

4.3 Technical service providers: the app notification service (Firebase Cloud Messaging by Google) to deliver notifications to your device, SMS and email providers to deliver messages, and the hosting provider. They receive only what they need to perform their service.

4.4 Official and judicial authorities: where there is a legal obligation or a binding request from a competent authority in the State of Kuwait.

4.5 Our successor in operating the platform: if the operation of the platform passes to another entity, subject to that entity following this policy and to notice to you.

4.6 We do not sell or rent your personal data, and we do not share it with advertisers.

5. Workers' data

5.1 Workers' information, photos and documents are uploaded by the office, which is responsible for the lawfulness of collecting and publishing them and for the consent of the persons concerned.

5.2 This information is shown to customers for the purpose of choosing and booking only, and copying or circulating it outside the platform is prohibited. Workers' documents are not shown to customers and are limited to review by the platform team.

6. How long we keep data

6.1 We keep your account data for as long as the account exists.

6.2 When the account is closed we remove your identifying data: name, phone number, email address, the last four digits of the Civil ID, governorate and area, and we delete the notification tokens of your devices.

6.3 After closure we keep the following, without your identifying data:

• Booking, payment, refund and invoice records, because they are financial records that must be kept under the laws in force.
• The log of important actions and the records of acceptance of the terms, to prove what took place and to protect rights.
• The irreversible hashed form of the Civil ID number, to prevent duplicate accounts.

6.4 Technical logs and logs of sent messages are kept for a limited time, as needed for operations and security.

7. How we protect your data

7.1 We apply reasonable technical and organisational measures, including:

• An encrypted connection between your device and the platform.
• Storing the Civil ID number in an irreversible hashed form, and storing passwords in hashed form.
• Keeping uploaded documents in private storage that is not open to the public and is opened only to those with permission.
• Defined permissions for each role in the platform team, so staff see only what they need for their work.
• A log of administrative and financial actions that cannot be edited.
• Limits on requesting and entering verification codes, and automatic expiry of app sessions.

7.2 No protection is complete. If a breach affects your data we take the steps needed to contain it and we notify you and the competent authorities as the law requires.

7.3 You are responsible for protecting your phone and your verification code and for not sharing them.

8. Your rights

8.1 Access: you can see your account and booking data inside your account, and ask for a copy of what we hold about you.

8.2 Correction: you can edit your data on the account page or ask for it to be corrected.

8.3 Closure and deletion: you can ask to close your account and remove your identifying data as described in clause 6.

8.4 Stopping marketing: from your account settings or through the unsubscribe link in any marketing message.

8.5 Withdrawing consent and objecting: you can withdraw your consent to any processing based on consent, and object to processing you consider unnecessary.

8.6 To exercise any right, open a support request from your account or write to us at support@makhdoom.io. We may ask for proof of your identity before acting on the request, and we reply within a reasonable time.

8.7 Some data cannot be deleted because there is a legal obligation to keep it, as in clause 6.3.

9. Children

9.1 The platform is for adults only. We do not knowingly collect data from anyone under the age of majority. If we learn that we have, we close the account and remove its data.

10. Processing outside Kuwait

10.1 Some of your data may be processed or stored by service providers whose servers are outside the State of Kuwait, such as the app notification service, the payment gateways and hosting. We limit this to what is needed to provide the service and choose providers that apply suitable protection measures.

11. Cookies and local storage

11.1 The website uses strictly necessary cookies only: the session cookie that keeps you signed in and remembers your language choice, and the token that protects against forged requests. We do not use advertising cookies or third-party tracking tools.

11.2 The browser may store display preferences locally for the dashboards used by offices and the platform team.

11.3 The app stores your sign-in token in secure storage on your device, and your preferences such as language.

11.4 Disabling the necessary cookies prevents signing in.

12. Changes to this policy

12.1 We may change this policy. Every change is published as a new version with a number and a date. If the change is material we ask for your acceptance before you continue to use your account.

13. Law and language

13.1 This policy is governed by the laws and regulations in force in the State of Kuwait, including those on personal data protection and electronic transactions.

13.2 This policy is written in Arabic. The English translation is for convenience. If the two differ, the Arabic text prevails.

14. Contact us

14.1 For any question or request about your data: support@makhdoom.io, or through a support request from your account.

14.2 Operator: Makhdoom.