NINAWA Privacy Notice

1. Who we are

NINAWA operates the online marketplace at shop.ninawa.net and is the
controller for the marketplace processing described in this notice.

Privacy questions and requests can be sent to shahad.alabid@ninawa.net or
submitted through the Privacy Request Center. This mailbox is a privacy contact;
it is not presented as a Data Protection Officer address.

2. Who this notice covers

This notice applies to marketplace visitors, buyers, sellers and seller
representatives, people who contact support or submit complaints, and people who
exercise privacy rights through NINAWA.

3. Personal data we process

Depending on how you use NINAWA, we may process:

• account and contact details needed to create, secure and administer an account;
• buyer preferences, cart, wishlist and saved-address information you choose to use;
• seller, store, verification and settlement information;
• order, delivery, return, refund and transaction records;
• payment status and provider references, but not full card numbers or CVCs in the NINAWA application database;
• shipment, package, tracking and delivery-event information when shipping is used;
• reviews and other content you choose to submit or publish;
• support, complaint and privacy-request correspondence;
• authentication, security, IP address, user-agent and audit information where recorded for a defined security or accountability purpose; and
• cookie and analytics preferences.

Please do not enter passwords, full payment-card details, identity documents,
health information or other sensitive information in ordinary free-text fields.

4. Where data comes from

We receive data directly from you, from activity generated while you use the
marketplace, and from a seller or an activated payment or delivery service when
that information is needed to complete or support a transaction. A provider or
integration that only exists in source code is not treated as an active data
recipient.

5. Why we process data

We process data to provide accounts and requested marketplace features, create
and perform orders, support delivery and returns, communicate about the service,
review sellers and catalog content, protect accounts and the marketplace, comply
with applicable legal duties, and establish or defend legal claims.

Where applicable, we rely on performance of a contract or steps requested before
a contract, compliance with a legal obligation, legitimate interests such as
service security and abuse prevention, or consent for optional analytics. We do
not use contract necessity as a blanket basis for unrelated advertising or
profiling. Direct marketing, loyalty scoring and AI model training are not active
launch purposes for marketplace personal data.

6. Who receives data

Access is limited according to purpose and role. The seller responsible for an
order can receive the minimum order and fulfilment information needed for that
transaction. Authorized NINAWA personnel can access information needed for
support, review, security, finance and privacy operations.

NINAWA uses Hetzner Online GmbH infrastructure for application hosting, storage
and encrypted backups under an Article 28 data-processing agreement. NINAWA's
mail and optional Umami analytics services are self-hosted on NINAWA-controlled
infrastructure. Optional analytics remains off until the user allows it.

Stripe is currently limited to sandbox/testing and is not an active public card
payment method. Odoo and external shipping carriers are not treated as active
recipients unless they are separately enabled for a real production purpose.
We may disclose limited data to competent authorities when a valid legal duty or
proceeding requires it.

7. International transfers

The active marketplace, mail, analytics and backup services are operated on
Hetzner infrastructure. The Hetzner agreement states that data for an EU server
location is processed within the EU and that support for all server locations is
provided within the EU. If NINAWA later activates a provider involving processing
outside the EEA, the provider, location and applicable safeguard will be assessed
and this notice will be updated before that flow is represented as active.

8. Retention

We keep personal data only for as long as needed for the purpose for which it was
collected, applicable legal or accounting obligations, security, disputes and
legal holds. Different records have different lifecycles; we do not apply one
retention period to every dataset.

Operational encrypted backups rotate under NINAWA's documented backup schedule.
Deleting data from the active application does not necessarily erase every
historical backup immediately. Recovery procedures are designed to prevent data
that was erased or restricted from silently returning to active use.

9. Cookies and analytics

NINAWA uses storage needed for security, sessions and user-requested preferences.
Optional analytics is separate and remains disabled unless you allow it. Your
analytics choice is stored for up to 180 days and can be changed at any time from
Cookie Settings.

10. Public content

Content you intentionally publish, such as a product review, can be visible to
marketplace visitors. Reviews use a reduced public reviewer label rather than the
buyer's full account name. Publishing content does not make the underlying
account or transaction record public.

11. Security

NINAWA uses measures including password hashing, role-based access controls,
authentication safeguards, rate limiting, protected administrative access,
security logging, and encrypted backup and recovery controls. No internet service
can guarantee absolute security.

12. Your rights

Subject to applicable conditions and exceptions, you may request access,
correction, erasure or restriction, object to certain processing, and receive
portable data where the legal requirements apply. We may verify identity before
acting so that data is not disclosed or changed for the wrong person.

Use the Privacy Request Center or contact shahad.alabid@ninawa.net. The normal
GDPR response period is one month, subject to extensions permitted by law. You
also have the right to complain to the competent data-protection authority.

13. Age requirement

Marketplace account registration is limited to people who confirm they are at
least 18 years old. NINAWA does not currently provide a parental-consent account
flow for children.

14. Changes

This notice is stored as an immutable version with an effective date and content
hash. Material changes create a new version rather than rewriting historical
text. Where a change requires new transparency, consent or another user action,
NINAWA will apply the appropriate mechanism before relying on that change.

15. Contact

Controller: NINAWA

Privacy contact: shahad.alabid@ninawa.net

Privacy requests: https://shop.ninawa.net/privacy-request