HANDEED
LEGAL  ·  PRIVACY
PRIVACY POLICY

Effective date26 April 2026
Last updated26 April 2026
Version 1.0
Controller Handeed, Amman, Jordan
Privacy contact privacy@handeed.com
 

1.  About this policy
Handeed (“we”, “us”, “our”) operates an online multi-vendor marketplace that connects buyers with independent vendors offering handcrafted goods, traditional Jordanian crafts, jewellery, home and lifestyle products, and other items. This Privacy Policy explains what personal information we process when you use our website, mobile experiences, vendor dashboards, customer-support channels, and related services (the Platform).
This policy applies to processing for which Handeed is the controller. Where vendors process your personal information for their own purposes — for example, after they have received an order from you — they act as separate controllers and are responsible for their own privacy practices.
This policy is written to comply with the Jordanian Personal Data Protection Law No. 24 of 2023 and, where applicable to users in the European Economic Area or the United Kingdom, the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK GDPR.
Plain language. We have written this policy in clear, accessible language. If anything is unclear, write to privacy@handeed.com and we will explain it.

2.  Definitions
Throughout this policy:
Personal dataAny information relating to an identified or identifiable natural person.
ProcessingAny operation performed on personal data — collection, storage, use, disclosure, or deletion.
ControllerThe party that determines the purposes and means of processing. Handeed is the controller for the activities described in this policy.
ProcessorA party that processes personal data on behalf of the controller.
Data subjectThe individual to whom the personal data relates — in most cases, you.
VendorAn independent seller who lists products on the Platform.
ConsentA freely given, specific, informed, and unambiguous indication of the data subject’s wishes.
Supervisory authorityAn independent public authority responsible for monitoring data-protection law in a given jurisdiction — for example, the Personal Data Protection Council in Jordan, or a national Data Protection Authority in the EU.

3.  Who we are
Handeed is the controller of your personal information for the purposes of this policy.
Trading nameHandeed 
HeadquartersAmman, Hashemite Kingdom of Jordan 
General support support@handeed.com  ·  +962 79 0000000 
Privacy contact privacy@handeed.com  
 Note. If you are in the EU, EEA, or UK and you wish to exercise your rights or raise a concern, you may write to us at privacy@handeed.com.

4.  Information we collect
We collect the following categories of personal information.
4.1  Account information
When you create a customer or vendor account, we collect your name, email address, mobile number, password (stored only in hashed form), preferred language and currency, and — if you choose to provide them — profile photo and date of birth.
4.2  Order, billing, and delivery information
When you place an order, we process the shipping and billing addresses you supply, contact details for delivery, the contents of your cart and wishlist, order history, coupon codes redeemed, and metadata about the transaction (timestamps, currency, amount, status). We do not store full payment-card numbers. Card and other payment details are submitted directly to our payment processors, which return only a tokenised reference and limited metadata (such as the card brand and last four digits) for receipts and dispute handling.
4.3  Vendor information
Vendors provide additional information necessary to operate a storefront, including legal or trading name, business address, national identification or commercial registration details, tax identifiers, payout-account details, product catalogues, shipping policies, and identity-verification documents where required by law or for fraud prevention.
4.4  Communications and user-generated content
We collect the content of messages you exchange with vendors through the Platform chat, customer-service requests sent via the contact form or support channels, product reviews and ratings, questions and answers posted on product pages, and any media you choose to attach. Content posted to public areas of the Platform is visible to other users.
4.5  Automatically collected information
When you visit the Platform, we and our service providers automatically collect:
Device and browser information (device type, operating system, browser version, screen resolution, language settings).
Network information (IP address, approximate geolocation derived from IP, internet service provider).
Usage information (pages viewed, products and stores browsed, search queries, referring URLs, session duration, click paths, errors encountered).
Cookie identifiers and similar identifiers placed on your device. See Section 10.
4.6  Information from third parties
We may receive personal information about you from the sources listed in Section 5.

5.  Where we collect it from
We collect personal information from three sources:
Directly from you — when you sign up, place an order, contact us, leave a review, or fill in a form.
Automatically — through cookies and similar technologies on the Platform.
From third parties — specifically:
Payment processorsTransaction outcome, fraud signals, tokenised card metadata.
Shipping and logisticsDelivery status and tracking events.
Social-login providersBasic profile data (name, email, profile picture) where you choose to sign in via a social account.
Analytics and advertisingAggregate and pseudonymous usage data; advertising identifiers where you have consented.
Public sourcesLimited information used to verify a vendor’s identity or to prevent fraud (for example, sanctions or company registers).

6.  How we use your information and our legal bases
Under the GDPR, every processing activity must rest on a specific legal basis. The Jordanian PDP Law applies an analogous framework. The table below sets out, for each of our processing purposes, the categories of personal data involved and the legal basis we rely on.
PurposeCategories of dataLegal basisCreate and manage your account, authenticate you, and keep your credentials secure.Account, technical.Performance of a contract (Art. 6(1)(b) GDPR).
Display, route, and fulfil your orders, including by sharing necessary details with the relevant vendor and shipping partner.Account, order, address, communications.Performance of a contract.
Process payments, refunds, and chargebacks; detect and prevent fraudulent transactions.Order, payment metadata, device.Performance of a contract; legal obligation (Art. 6(1)(c)) for tax and AML; legitimate interests (Art. 6(1)(f)) in fraud prevention.
Provide customer support and resolve disputes between buyers and vendors.Account, order, communications.Performance of a contract; legitimate interests in providing quality service.
Operate marketplace features such as search, recommendations, wishlist, comparison, reviews, coupons, and order tracking.Account, usage, order.Performance of a contract; legitimate interests in maintaining a usable Platform.
Personalise the products, stores, and content shown to you.Usage, preferences.Consent (Art. 6(1)(a)) where required for non-essential cookies; otherwise legitimate interests.
Send transactional communications (order confirmations, shipping updates, account notices).Account, contact, order.Performance of a contract.
Send marketing communications about Handeed and similar products.Account, contact.Consent; or legitimate interests for soft opt-in to existing customers, where permitted by law.
Measure and improve the Platform through analytics, A/B testing, and usability research.Usage, device.Consent for non-essential cookies; otherwise legitimate interests.
Maintain the security and integrity of the Platform, investigate misuse, and enforce our Terms.Account, transaction, device, log data.Legitimate interests in protecting the Platform; legal obligation where applicable.
Comply with legal, tax, accounting, regulatory, and law-enforcement obligations.Various.Legal obligation.

6.1  Legitimate interests — specifics
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. The specific interests we rely on are:
Preventing fraud, money laundering, and abuse of the Platform.
Securing our network and systems, and investigating security incidents.
Operating, maintaining, and improving the Platform and our services.
Understanding our customers and developing new features.
Direct marketing of our own similar products to existing customers, on a soft-opt-in basis where permitted.
Establishing, exercising, or defending legal claims.
You have the right to object to processing based on legitimate interests at any time — see Section 13.

7.  How we share your information
We do not sell your personal information. We share it only with the categories of recipient described below, and only to the extent necessary.
7.1  Vendors on the marketplace
When you place an order, we share with the vendor the information they need to prepare and ship it — typically your name, delivery address, contact number, the items ordered, and any delivery instructions. Vendors are contractually required to use this information only to fulfil your order and to comply with applicable privacy law.
7.2  Payment processors
Payments are handled by licensed payment service providers. Card details are submitted directly to those providers under their own privacy and security standards (including PCI-DSS). We receive only the information necessary to confirm the transaction and to handle refunds or disputes.
7.3  Shipping and logistics partners
Couriers and logistics providers receive the recipient’s name, address, and contact number to deliver your order and to provide tracking updates.
7.4  Service providers (processors)
We engage trusted third parties to host the Platform, send emails and SMS, run analytics, deliver customer-support tooling, prevent fraud, and manage advertising. These providers process personal information under written agreements that comply with Article 28 GDPR (or its Jordanian equivalent) and restrict their use to our instructions, with appropriate confidentiality and security obligations.
7.5  Legal, regulatory, and safety disclosures
We may disclose personal information where we are legally required to do so — for example, in response to a court order, lawful request from a government or regulator, or to comply with tax or anti-money-laundering obligations. We may also share information where necessary to investigate suspected fraud or abuse, protect the rights, property, or safety of Handeed, our users, or others, or to enforce our Terms of Service.
7.6  Corporate transactions
If Handeed is involved in a merger, acquisition, restructuring, financing, or sale of assets, personal information may be transferred to the relevant party as part of that transaction, subject to appropriate confidentiality protections.

8.  International transfers
Handeed is based in Jordan. Some of our service providers, vendors, and shipping partners are located outside Jordan and outside the European Economic Area, including in jurisdictions that may not provide an equivalent level of protection.
Where we transfer personal information across borders, we rely on one of the following safeguards:
Adequacy decisions — where the European Commission has determined that the destination country provides an adequate level of protection.
Standard Contractual Clauses (SCCs) — the Commission-approved clauses for transfers from the EU/EEA to third countries, supplemented where necessary by additional technical, organisational, or contractual measures following a transfer-impact assessment.
UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, for transfers from the United Kingdom.
Explicit consent — only where no other safeguard is available, and after we have informed you of the possible risks.
Right to obtain a copy. You have the right to ask for a copy of the safeguards we rely on for any specific transfer. Write to privacy@handeed.com and we will provide it, redacted only as necessary to protect commercial confidentiality.

9.  Automated decision-making and profiling
We use automated processing in limited ways, including to recommend products, rank search results, detect fraudulent transactions, and personalise the content shown to you. We do not make decisions that produce legal effects concerning you, or similarly significant effects, solely on the basis of automated processing within the meaning of Article 22 GDPR.
If we ever introduce such decisions — for example, automated approval of a vendor application or automated blocking of an account — we will obtain your explicit consent, or rely on a permitted legal basis, and provide you with the right to obtain human intervention, to express your point of view, and to contest the decision.

10.  Cookies and tracking technologies
We use cookies and similar technologies (such as local storage and pixel tags) to operate the Platform, remember your preferences, secure your session, measure traffic, and — with your consent — personalise content and advertising.
We classify cookies into four categories:
Strictly necessaryRequired for the Platform to function (for example, authentication, cart contents, security). These do not require consent.
FunctionalRemember your preferences such as language and currency.
AnalyticsHelp us understand how visitors use the Platform.
MarketingDeliver relevant advertising and measure its effectiveness.
In the EU/EEA and UK, prior consent is required for all non-essential cookies under the ePrivacy Directive (and its national implementations) and Regulation 6 of the Privacy and Electronic Communications Regulations (PECR). You can grant or withdraw consent through our cookie banner and through the cookie preferences page on the Platform. You can also block or delete cookies through your browser controls; doing so may affect parts of the Platform.

11.  How long we keep your information
We keep personal information only for as long as necessary for the purposes for which it was collected and for any retention period required by tax, accounting, or other legal obligations. The table below sets out our default retention periods. Where a longer period is required by law, that longer period applies.
CategoryRetention periodAccount data (profile, preferences)For the life of your account, plus up to 24 months after closure to handle disputes and legal claims.
Order and transaction recordsFor the period required by Jordanian tax and commercial law (currently up to 10 years from the end of the relevant financial year).
Payment metadataUp to 7 years for chargeback windows and accounting obligations.
Vendor verification and KYC dataUp to 10 years after the vendor relationship ends, where required by anti-money-laundering law.
Customer-support correspondenceUp to 3 years after resolution of the matter.
Marketing dataUntil you withdraw consent, or after 24 months of inactivity, whichever occurs first.
Server logs and security telemetryUp to 12 months, except where extended retention is required to investigate an incident.
CookiesVariable; see our cookie banner for the lifetime of each cookie.
At the end of the relevant period, we securely delete or anonymise the data so that it can no longer be linked to you.

12.  Security
We apply technical and organisational measures appropriate to the risk, designed to protect personal information against unauthorised access, disclosure, alteration, and loss. These include:
Encryption of data in transit (TLS) and, where appropriate, at rest.
Access controls on a need-to-know basis, with role-based permissions and audit logging.
Hashed passwords and multi-factor authentication for sensitive accounts.
Vendor due diligence and Article 28 data-processing agreements with all processors.
Security monitoring, incident-response procedures, and staff training.
Regular review of our measures in light of evolving risks and the state of the art.
No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and — where the risk is high — we will also notify you without undue delay, in accordance with Articles 33 and 34 GDPR and the equivalent provisions of the Jordanian PDP Law.

13.  Your rights
Subject to applicable law, you have the following rights in relation to your personal information:
Access (Art. 15)Confirmation that we process your data and a copy of it.
Rectification (Art. 16)Correction of inaccurate or incomplete information.
Erasure (Art. 17)Deletion of your personal information where it is no longer necessary, where you withdraw consent, or where processing is unlawful.
Restriction (Art. 18)Limitation of how we use your information in defined circumstances.
Portability (Art. 20)Receipt of certain data in a structured, commonly used, machine-readable format, and transmission to another controller.
Objection (Art. 21)Objection to processing based on legitimate interests, including profiling for direct marketing — in which case we will stop unless we have compelling grounds that override your rights.
Withdraw consentWithdrawal of any consent you have given, at any time, without affecting the lawfulness of prior processing.
No automated decisions (Art. 22)Not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.
Lodge a complaintComplaint to the Personal Data Protection Council in Jordan, or to your local supervisory authority — see Section 18 for EU/EEA and UK details.
To exercise any of these rights, write to privacy@handeed.com. We will respond within one calendar month of receipt of your request, extendable by a further two months for complex or numerous requests, in which case we will let you know within the first month. Requests are handled free of charge, except where they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request. We may need to verify your identity before acting on the request.

14.  Whether providing your information is required
Some of the information we collect is necessary to enter into a contract with you, or required by law:
Necessary for a contract: name, email, password, delivery address, and payment information are required to create an account and place an order. Without this information, we cannot provide the Platform or fulfil your order.
Required by law: certain transaction and identity records must be retained to satisfy tax, accounting, and anti-money-laundering obligations.
Optional: profile photo, date of birth, marketing preferences, and similar information are entirely optional. Not providing them does not affect your ability to use the Platform.

15.  Marketing communications
We send marketing communications only where the law permits — typically with your consent, or to existing customers about similar products on a soft-opt-in basis where permitted by national rules. Every marketing email and SMS we send includes a clear and free way to unsubscribe, and you can also manage your preferences in your account settings. Unsubscribing from marketing does not stop transactional messages, which we send to manage your orders and account.

16.  Children’s privacy
The Platform is intended for adults. We require account holders to be at least 18 years old, which is the minimum age for entering into a binding contract under the law of the Hashemite Kingdom of Jordan.
Under Article 8 GDPR, the minimum age for the lawful provision of information-society services to a child on the basis of consent is 16, although member states may set a lower threshold (down to 13). Because account creation on Handeed requires the legal capacity to enter into a contract, our minimum age (18) is higher than the GDPR threshold for consent-based services.
We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us at privacy@handeed.com and we will take appropriate steps to delete it.

17.  Third-party links
The Platform may contain links to third-party websites, social-media pages, or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy notices before providing them with personal information.

18.  Information for EU/EEA and UK users
If you are located in the European Economic Area or the United Kingdom, the GDPR or UK GDPR applies to our processing of your personal information. The whole of this policy is written to comply with those regimes; this section sets out information of particular relevance to you.
18.1  Our representative
Where required, Handeed has appointed a representative under Article 27 GDPR for matters relating to data subjects in the EU/EEA, and a separate representative for data subjects in the UK. Their contact details are set out in Section 3 of this policy.
18.2  Lead supervisory authority
Where Handeed is engaged in cross-border processing within the meaning of Article 4(23) GDPR, the lead supervisory authority will be determined by reference to our main establishment in the Union (where applicable). Until a main establishment in the Union is designated, you may complain to the supervisory authority in the EU/EEA member state where you live, where you work, or where the alleged infringement took place.
18.3  How to complain
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. A list of national authorities is maintained by the European Data Protection Board at edpb.europa.eu. UK users may complain to the Information Commissioner’s Office at ico.org.uk.

19.  Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will notify you through the Platform or by email before they take effect. The “Last updated” date at the top of this document indicates when the policy was most recently revised. We will keep prior versions on file and make them available on request.

20.  Governing law and jurisdiction
This Privacy Policy is governed by the laws of the Hashemite Kingdom of Jordan. Any dispute arising out of or in connection with this policy is subject to the exclusive jurisdiction of the competent courts of Amman, Jordan, without prejudice to mandatory consumer-protection and data-protection rights you may have in your country of residence — in particular, the rights conferred on you by the GDPR or UK GDPR, which remain enforceable in their respective jurisdictions.

21.  Contact us
If you have any question about this policy, our privacy practices, or your personal information, please contact us:
Privacy enquiries privacy@handeed.com
Data Protection Officer dpo@handeed.com   
General support support@handeed.com  ·  +962 79 0000000
Postal address Handeed, Amman, Jordan