Your rights under Jordan's Personal Data Protection Law No. 24 of 2023.
This Notice supplements the Tayeb Privacy Policy and explains how we process your personal data in accordance with the Personal Data Protection Law No. 24 of 2023 of the Hashemite Kingdom of Jordan (the "PDPL"), which came into force on 17 March 2024 and became fully operational on 17 March 2025.
It sets out the lawful basis for processing, your rights as a data subject, our obligations as a data controller, and how to contact us or the regulator.
The data controller responsible for your personal data is:
Tayeb Portal for Internet Services (Private Shareholding Company)
96 Abu Rumman Street, Al Muqabaleen and Al Bunayyat Area, Amman, Jordan
Email: [email protected]
Because our core activities involve processing personal data, financial information, and the transfer of data to service providers outside Jordan, we are required under the PDPL to appoint a Personal Data Protection Officer (DPO).
You can contact our DPO at [email protected] for any questions or requests relating to your personal data.
A complete description of the personal data we collect is set out in the Privacy Policy. In summary, we process:
Under the PDPL, processing of personal data generally requires your explicit, informed consent. The law also permits processing without consent in specific circumstances set out in the law, such as where processing is necessary to perform a contract you are a party to, to comply with a legal obligation, to protect your vital interests, or to carry out tasks in the public interest.
| Purpose of Processing | Lawful Basis under PDPL |
|---|---|
| Creating and managing your account, processing orders, processing payments, coordinating delivery | Necessary for the performance of a contract |
| Sending essential service communications (order status, account notifications) | Necessary for the performance of a contract |
| Fraud detection, security monitoring, abuse prevention | Legal obligation and legitimate interest |
| Product analytics, performance monitoring, service improvement | Consent, which you can withdraw at any time |
| Marketing communications, promotional offers, advertising attribution | Consent, which you can withdraw at any time |
| Sharing data with third party tools that process outside Jordan (such as Meta, Google, Adjust) | Explicit consent after being informed of the destination's level of protection (see Section 6) |
| Tax, accounting, and regulatory record keeping | Legal obligation |
| Establishing, exercising, or defending legal claims | Legitimate interest |
The PDPL defines sensitive personal data to include data relating to a person's racial or ethnic origin, political opinions, religious or philosophical beliefs, health, genetic or biometric data, criminal records, financial data, and similar categories.
We do not intentionally collect or process sensitive personal data through the Tayeb application. Financial information necessary for payments is handled directly by licensed third party payment processors as described in our Privacy Policy.
Under the PDPL, personal data may not be transferred outside Jordan if the destination provides a lower level of protection than the PDPL requires, except in specific circumstances set out in the law or with your explicit and informed consent.
To deliver our Services, we work with international technology providers that process personal data on servers located outside Jordan, including:
By accepting our Privacy Policy and Terms of Service, and by enabling marketing and analytics permissions in the app, you provide informed consent to these transfers, having been informed that the destination jurisdictions may provide protections that differ from those guaranteed under the PDPL. You can withdraw this consent at any time by contacting [email protected], in which case certain features may no longer be available.
We apply appropriate technical and contractual safeguards, including encryption in transit, access controls, and data processing agreements with our providers.
We retain personal data only for as long as necessary for the purposes for which it was collected, to comply with legal, tax, accounting, and regulatory obligations, or to resolve disputes and enforce our agreements. When no longer needed, personal data is deleted or anonymized.
As a data subject, you have the following rights under the PDPL:
To exercise any of these rights, contact us at [email protected] or [email protected], describing your request clearly. We may need to verify your identity before responding.
We will respond to your request within the timeframe required by the PDPL and its implementing regulations. Exercising these rights is free of charge, unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. We may use automated tools to detect fraud, personalize content, or recommend merchants, but these are not solely automated decisions in the sense of the PDPL, and human review is available where required.
In the event of a personal data breach likely to cause serious harm to data subjects, the PDPL requires us to:
We have internal procedures in place to detect, investigate, and report data breaches in accordance with these obligations.
If you believe your rights under the PDPL have been infringed, you have the right to lodge a complaint with the:
We would appreciate the opportunity to address your concerns directly before you escalate to the regulator. Please reach out to us first at [email protected].
We may update this Notice from time to time as the PDPL, its implementing regulations, and guidance from the Council and the Unit evolve. Material changes will be communicated through the app, by email, or by a notice on our website, along with a revised effective date.
For any questions about this Notice, your personal data, or our compliance with the PDPL, please contact us at:
