Privacy Policy

We appreciate the trust you place in us when you entrust us with your personal and official documents for translation. This Policy explains clearly: what data we collect, why, who we share it with, how long we keep it, and what your rights are. It is built on the Omani Personal Data Protection Law issued by Royal Decree 6/2022 and its Executive Regulations Ministerial Decision 34/2024.

1. Who We Are

Data Protection Officer (DPO)

In accordance with Article 34 of the Executive Regulations:

2. Data We Collect

2.1 Identification Data

2.2 Authentication and Security Data

• You sign in with your phone number and a password, with a one-time code sent to your email, or through Google. We verify your phone number once, with a code sent by SMS or on WhatsApp.
• Your password is stored as an Argon2id hash and cannot be retrieved by anyone, including us.
• A code is stored as a hash, cannot be retrieved by anyone, and expires within 5 minutes. An SMS code is issued and checked by Google (see 5.2).
• Number of failed sign-in and code attempts (5 at most per code), and the lockout time.
• Last login timestamp.

2.3 Session Data

• IP address.
• Browser type and operating system (User-Agent).
• Last activity time and session expiry.

2.4 Payment Data

• Payment amount and currency.
• Card type (e.g., VISA, Mastercard).
• Last 4 digits of the card only (for invoicing).
• Thawani session identifier and time of completion.

Important: We never see or store the full card number, expiry date, or CVV.

2.5 Your Documents and Their Content

• The Original Document you upload for translation.
• The stamped Delivery Document from the office.
• Automatically extracted metadata: word count, page count.
• Document type and notes for the office.

2.6 Sensitive Data

If you select the document type "Medical Report", its content is classified as sensitive health data. We will request your separate consent before processing, and apply stricter access controls.

2.7 WhatsApp Data

• The phone number on which you receive our WhatsApp messages, and whether it is verified. Messages about your requests go only to a number whose ownership you proved with a code.
• The language you choose for messages from inside WhatsApp.
• Your choice to stop or resume messages (see 8.9).
• What you send to the platform's WhatsApp number. For a translation office, this includes the translation files it sends to be attached to a request.
• Meta's receipt for each message: sent, delivered, read, or failed.

We store WhatsApp message identifiers in a hashed form that does not reveal their owner's number, never as Meta issues them.

3. Purposes of Processing

We do not use your data for marketing in the first release. We will not send any promotional email.

4. Legal Basis for Processing

5. Who We Share Your Data With

5.1 Translation Offices

The office that accepts your Request receives: your Original Document, your name, and your notes. It does not see your other data.

5.2 Sub-Processors

5.3 Official Authorities

We disclose data only when legally required, when reporting a suspected criminal violation, or when defending our rights.

6. Cross-Border Data Transfer

Some infrastructure services operate from data centers outside Oman. Per Articles 37-39:

• We obtain your explicit consent before transfer.
• We select providers offering a protection level no less than Oman's standard.
• We sign Data Processing Agreements (DPAs) with each provider.

You may withdraw consent by contacting dpo@trjm.om; this may end service.

WhatsApp Messages, Machine Translation and Verification Codes

Meta processes WhatsApp messages in its data centers outside the Sultanate of Oman, as a data processor on our behalf. It uses them only to provide the service and keeps them for at most 30 days (see 7). Google processes a document's content when a translation office asks for a machine draft, in data centers that may be outside Oman. Google (Firebase) sends a verification code by SMS to your phone number when you ask for one, and checks it, in its data centers outside Oman.

7. Data Retention Periods

8. Your Rights Under the Data Protection Law

You have explicit rights, and we respond within a maximum of 45 days:

8.1 Right of Access

Request a copy of your data in a clear, readable format.

8.2 Right to Rectification

Correct your data directly from your account or by request.

8.3 Right to Erasure

Request deletion when the purpose ends, consent is withdrawn, or processing is unlawful. Exception: Data we must retain by law (e.g., payment records).

8.4 Right to Data Portability

Transfer your data to another controller in a machine-readable format.

8.5 Right to Withdraw Consent

Withdraw consent anytime without affecting prior processing.

8.6 Right to Object

Object to processing based on legitimate interest.

8.7 How to Exercise Your Rights

Send a request to dpo@trjm.om including: your name, account email, type of right, and a description of the data concerned.

8.8 Right to File a Complaint

You may file a complaint with the Ministry of Transport, Communications and IT or the National Centre for Information Safety.

8.9 Stopping WhatsApp Messages and Changing Their Language

Send "stop" (or «إيقاف») to the platform's WhatsApp number and request messages stop reaching your number; they reach your email instead, if your account has one. A sign-in code you ask for yourself still arrives. Send "start" (or «تشغيل») to resume, and "language" (or «لغة») to choose the language.

9. How We Protect Your Data

9.1 Encryption

• In transit: HTTPS with TLS 1.2+ and HSTS.
• At rest: email and phone with AES-256-CBC; documents encrypted in cloud storage; one-time codes and passwords as hashes.
• Your number and a message's variables are encrypted in the sending queues, and what has finished is removed from them after a limited time.

9.2 Access Control

• Download links time-limited (15 minutes).
• An office can only see its own Requests.
• Staff access on need-to-know basis with full audit logging.

9.3 Threat Protection

• Automatic ClamAV scanning.
• Rate limiting against brute-force.
• Account lockout after failed attempts.
• Strict HTTP security headers.

10. Data Breach

We apply a rapid-response plan per Articles 30 and 32:

11. Cookies

We use a very limited number of cookies, all essential:

We do not use cookies for advertising tracking or behavioral analytics.

12. Children's Privacy

The platform is not intended for anyone under 18. If we discover a minor's data, we delete it immediately and close the account.

13. Updates to This Policy

• We notify you of material updates by email at least 30 days before they take effect.
• Minor updates are published without notice.
• You may review all prior versions on request from the DPO.

14. Contact and Complaints

14.1 For Inquiries and Requests

14.2 Regulatory Authorities in Oman

• Ministry of Transport, Communications and IT — Personal Data Protection Unit.
• National Centre for Information Safety.
• Consumer Protection Authority: 80079009.

Thank you for your trust. Your privacy is our responsibility.