1.Introduction and General Provisions

1. This Privacy Policy (“Policy”) governs the collection, use, storage, disclosure, and protection of personal data on the Tolba Platform (“Tolba” or “Platform” or “we” or “us”), operated and managed by Authenticity and Modernity for Information Technology LLC (شركة الأصالة والمعاصرة لتكنولوجيا المعلومات ذ.م.م), a limited liability company registered in the Hashemite Kingdom of Jordan under No. 75739 and headquartered at Queen Noor Street, Housing Bank Complex, Building No. 93, Office 102, Shmeisani, Amman.
2. By registering, using, accessing, or browsing the Platform or any associated services, you ("User" or "You" or "Member") acknowledge that you have read and understood this Policy and consent to the processing practices it describes, in line with Jordanian law, including the Personal Data Protection Law No. 24 of 2023.
3. The Tolba Platform is intended solely for traditional marriage matchmaking, in alignment with the cultural and social values upheld in our region. It enables communication between men genuinely seeking marriage and the guardians of women who have willingly shared their guardian’s contact information, strictly for the purpose of traditional marriage.
4. Tolba reserve the right to amend, update, or change this Policy at any time. Your continued use of the Platform after any amendment constitutes your acceptance of such changes.
5. Capitalized terms used herein have the meanings assigned to them in our Terms & Conditions (the “Terms”). This Privacy Policy forms an integral part of the Terms and shall be read together with them, and the Terms are hereby incorporated by reference into this Privacy Policy.

2.Data We Collect

1. When you create an Account or update your profile, you share four main categories of information with us:

• Identification and Contact Details; your legal name, date of birth, nationality, country of residence, verified mobile number, and verified e‑mail address, plus a password that we store in encrypted form.
• Profile Attributes; items that make your profile visible and searchable, such as a profile photograph, nickname, short bio (Arabic and/or English), general physical appearance, and stated religious affiliation.
• Lifestyle and Preference Data; details that fine‑tune matching results, for example: education level, employment information, leisure interests, and social‑media presence style.
• Subscription and Payment Records; including the package selected, transaction reference issued by the secure payment gateway, and user email. We never retain full bank-account or full card numbers; those are handled solely by the payment gateway provider.

Certain additional data are role‑specific:

• A Female Member must provide her Guardian Contact Number and verify it by OTP before her profile is activated.

Each time you visit the Platform, our servers record technical information emitted by your device: IP address, approximate geolocation, device model, operating‑system version, browser type and language, time of access, navigation flows, and system diagnostics. We process these data to maintain security, detect fraud, and enhance overall performance.

3.How We Collect Data

1.  We acquire personal data whenever you interact with the Platform, including but not limited to: a) the creation, verification, or modification of an Account; b) the completion or amendment of profile details, the upload or replacement of a profile photograph, or the provision and OTP‑verification of the user’s number and the Female’s Guardian Contact Number; c) the purchase or renewal of a Subscription Package; and d) the filing of a report, complaint, or refund request. In each instance, the information supplied is strictly limited to that which is necessary to perform the service you have requested or to comply with our contractual obligations.
2.  When you access or navigate the Platform, our servers and security tools automatically record certain technical and usage information. Such collection happens through cookies and tracking technologies as set forth in Clause 10 and encompasses, inter alia, device identifiers, IP address, approximate geolocation, browser attributes, and interaction metrics. These data enable session management, fraud detection, performance optimization, and statistical analysis, all in accordance with the legitimate interests of the Company.
3. Limited categories of personal data may be transmitted to us by third parties where lawful and necessary. Integrated payment service providers communicate transaction identifiers and status codes to facilitate Subscription activation and the allocation of Communication Credits. In addition, judicial or regulatory authorities within the Hashemite Kingdom of Jordan may, pursuant to an applicable legal basis, furnish information to—or request information from—the Company in the context of investigations, enforcement actions, or other legal obligations.

4.Legal Bases for Processing 

1. Consent: Where the User has given clear, informed, and specific consent, such as when a Female Member provides her Guardian Contact Number or when any User discloses optional lifestyle information, the Company processes that data strictly for the purposes covered by the consent. The User may withdraw consent at any time ;(and cancel his account) withdrawal shall not affect the lawfulness of processing undertaken prior to such withdrawal.
2. Contractual Necessity: Processing is lawful when it is objectively required to enter into, perform, or administer the contractual relationship between the Company and the User. This ground covers Account creation and authentication, profile publication, Matching operations, Subscription activation, Communication‑Credit allocation, and the fulfilment of any services expressly requested by the User.
3.  Compliance with Legal Obligations: The Company may process or disclose personal data where such action is necessary to comply with a statutory requirement or an order of a competent judicial or regulatory authority within the Hashemite Kingdom of Jordan, including obligations arising under the Personal Data Protection Law No. 24 of 2023, Cybercrimes Law No. 17 of 2023, and any amendments thereto or any successor legislation.
4. Company’s Legitimate Interests: Processing is likewise lawful where it is necessary for the purposes of the Company’s legitimate interests, provided those interests are not overridden by the fundamental rights and freedoms of the data subject. Legitimate interests include fraud prevention, platform security, strike‑policy enforcement, service improvement, internal analytics, and the defense or establishment of legal claims.

5.Purposes of Processing 

1. The Company processes personal data to establish, authenticate, and administer User Accounts; to publish and update profile information for Matching purposes; and to otherwise make the core functionalities of the Platform available to Users.
2. For Female Members, the verified Guardian Contact Number is processed and, upon a confirmed Match, disclosed exclusively to the corresponding Users in order to facilitate traditional marriage introductions in accordance with the Platform’s stated purpose.
3. Transaction amounts identify package selections and Communication‑Credit balances.
4. Device, usage, and strike‑policy data are analyzed to detect and block unauthorized access, misuse, and fraudulent activity; to investigate reports or complaints; and to impose sanctions - including warnings, suspensions, or terminations - pursuant to the Terms & Conditions.
5. Personal data may be processed or disclosed where necessary to comply with applicable Jordanian laws, lawful requests of competent authorities, court orders, or to establish, exercise, or defend legal claims.
6. The Company does not process personal data for unsolicited marketing communications, third‑party advertising, or automated decision‑making that produces legal or similarly significant effects on Users.

6.Processing of Guardian Contact Information

1. As a condition precedent to activating her profile, a Female Member is required to supply a valid mobile number belonging to her Guardian (“Guardian Contact Number”). By entering that number, the Female Member represents and warrants that: a) the number is accurate and under the control of the stated Guardian; b) she has obtained the Guardian’s prior knowledge and consent to its disclosure for traditional‑marriage matchmaking purposes; and c) the Guardian understands that the number may be shared with a male User in accordance with this Policy and the Terms & Conditions.
2. Immediately upon submission, the Platform sends each subscriber a verification email and then a one‑time password (OTP) to verify user number and to the female user’s Guardian Contact Number. Members must enter the correct OTP to complete verification. Until verification is successful, the profile remains hidden from Matching results.
3. Once a Male Member becomes a Subscriber, achieves a mutual Match, and expends a valid Communication Credit, the verified Guardian Contact Number is disclosed to that male member alone. The disclosure is confined to facilitating an introductory telephone call aimed at traditional marriage arrangements; no further use or onward transfer is authorized.
4. The Female Member bears sole responsibility for maintaining the accuracy and continued operability of the Guardian Contact Number. The Company does not guarantee that the disclosed number will remain active, reachable, or cooperative, nor does it mediate communications occurring outside the Platform. Any misuse, falsification, or deliberate obstruction involving a Guardian Contact Number constitutes a violation of the Terms & Conditions and may trigger Suspension.

7.Data Retention 

1. As long as a User maintains an active Account, the Company retains the personal data necessary to render the services described in the Terms & Conditions and this Policy. Such data remain accessible to the User through the profile‑editing interface.
2. Upon voluntary deletion of an Account by the User or termination by the Company, the associated personal data—including profile details and any verified Guardian Contact Number—shall be placed in a restricted‑access archive for a period of twelve (12) months. The sole purposes of this temporary retention are: a) to fulfil potential legal, regulatory, or judicial requests; b) to resolve outstanding complaints or chargeback claims; and c) to deter and investigate fraud or misuse:
3. At the conclusion of the twelve‑month retention period, the Company shall irreversibly erase the personal data.

8.Data Subject Rights

Subject to verification of identity and to the limitations set out in the Personal Data Protection Law No. 24 of 2023 and related Jordanian legislations, every User enjoys the rights below over their data:

1. You may ask us for a copy of the data we hold about you. Where processing is automated and based on consent or contract.
2. If any of your data are inaccurate or incomplete, you can correct most fields directly in your Account settings or e‑mail us to make the change for you in case it was a non-editable field.
3. You may request that we delete your personal data when it is no longer needed, you have withdrawn consent, or it has been processed unlawfully. Legal or regulatory retention requirements as set forth in Clause 7 may prevent immediate deletion of certain records.
4. Where we rely on your consent such as for sharing a verified Guardian Contact Number, you may withdraw that consent at any time. This will not affect processing already carried out.

9.Cookies

1. When you visit or use the Platform, small data files known as “cookies” are placed on your browser or device. We use these technologies solely to maintain secure log‑in sessions, remember your language and display preferences, measure aggregate usage, and diagnose technical issues. We do not use cookies for third‑party advertising, behavioral profiling, or cross‑site tracking.
2. No marketing, targeting, or social‑media cookies are set by default, nor do we permit third‑party advertising networks to deposit cookies through the Platform.
3. Most web browsers accept cookies automatically, but you can alter your browser settings to delete or block cookies altogether. You may also clear stored data at any time. Please note, however, that rejecting strictly necessary cookies will impair or prevent access to secure areas of the Platform and may hinder overall functionality.
4. On your first sign up visit, a concise sentence informs you that the Platform uses cookies strictly for essential and analytical purposes. By continuing to browse you acknowledge and consent to our limited use of cookies in accordance with this Policy.
5. Where you access Tolba via the mobile‑application version, comparable tokens stored within the app serve the same session‑management and analytics functions described above. Removal is achieved by logging out and, if desired, uninstalling the application.

10.Data Security

1. All traffic and stored data between your device and our servers is encrypted and are accessible only through role‑based permissions and multi‑factor authentication.
2. A documented incident‑response plan governs containment, investigation, and remediation. If a breach is likely to compromise your rights or freedoms, we will inform both you and the competent Jordanian authority without undue delay, stating the nature of the breach and the corrective actions taken.
3. You are required to maintain a strong, unique password, safeguard your login credentials, keep your devices and applications up to date, and notify us immediately if you suspect any unauthorized access.
4. While we follow recognized industry standards and best practices, no online service can guarantee absolute security. The limits of our liability in this regard are set out in the Liability clause of the Terms & Conditions.

11.International Transfers

1. Whenever personal data are transmitted or stored outside Jordan, the Company ensures that a comparably adequate level of protection is maintained. This is achieved through one or more of the following mechanisms:

• encrypted transmission and storage;
• binding contractual clauses that impose data‑protection obligations on the receiving processor; and
• rigorous due‑diligence assessments of the processor’s technical and organizational security measures.

1. By continuing to use the Platform, you acknowledge that such cross‑border transfers may occur and consent to the Company’s implementation of the safeguards described above.

12.Children’s Privacy

1. The Tolba Platform is intended solely for persons eighteen (18) years of age or older. The Company does not knowingly collect or process personal data relating to minors. Should we become aware that a minor has submitted personal information, we will delete that information without undue delay and may take steps to disable the associated Account.

13.Governing Law and Jurisdiction

1. This Policy, its interpretation, and any dispute arising from or in connection with the Platform or its use are governed solely by the laws of the Hashemite Kingdom of Jordan, without regard to conflict‑of‑laws principles.
2. Any disputes arising from or related to this Policy or Platform usage shall be subject exclusively to the jurisdiction of the courts of Central Amman (Qasr Al-Adl).

14.Miscellaneous

1. If any provision of this Policy is held invalid, illegal, or unenforceable by a court of competent jurisdiction, that provision will be enforced to the maximum extent permissible, and the remaining provisions shall continue in full force and effect.
2. This Policy including Tolba Terms and Conditions and any other policies of the Platform constitute the entire agreement between Users and Authenticity and Modernity for Information Technology LLC (شركة الأصالة والمعاصرة لتكنولوجيا المعلومات ذ.م.م) concerning the Tolba Platform.
3. Users may not assign, delegate, or transfer their rights or obligations under this Policy.
4. Clauses related to intellectual‑property provisions, limitation of liability, indemnity, governing law, dispute resolution, and data‑retention obligations shall survive termination and shall remain in effect after any termination or deletion of a User’s account or this Policy.

15.Contact Information and Customer Support

For questions, assistance, or support regarding this Policy, or other services, you may reach Tolba through the following email address:

• Email: [privacy@tolba.world]

Address: Authenticity and Modernity for Information Technology LLC (شركة الأصالة والمعاصرة لتكنولوجيا المعلومات ذ.م.م), Queen Noor Street, Housing Bank Complex, Building No. 93, Office 102, Shmeisani, Amman, Jordan.