Privacy Policy
1. Data Controller
The person responsible for the processing of personal data through Hirfa is:
Alaa Aishouna
Kafr Batna, Rif Dimashq, Beside Al-Fatih Hospital, Syrian Arab Republic
Email: info@hirfa.net
Websites:
https://www.hirfa.sy
https://www.hirfa.net
If you have any questions regarding privacy or the processing of your personal data, you may contact us using the email address above.
2. About Hirfa and This Privacy Policy
Hirfa is an online platform designed to connect clients with independent service providers and craftsmen.
This Privacy Policy applies to the use of Hirfa through https://www.hirfa.sy and https://www.hirfa.net. It also applies, where relevant, to the Hirfa Android application.
This Privacy Policy explains the categories of personal data we process when you: visit Hirfa; create or use an account; create or edit a profile; publish a job or service request; submit an offer; communicate with another user; publish a rating or review; upload photographs; or use the Hirfa Android application.
Personal data is processed in accordance with applicable Syrian law, in particular Syrian Personal Data Protection Law No. 12 of 2024 and Electronic Transactions Law No. 3 of 2014, where applicable.
3. Personal Data We Process
Depending on how you use Hirfa, we may process the following categories of personal data:
name;
email address;
phone number;
user ID;
account type or user role;
profile information;
password in hashed form;
profile photograph;
other photographs uploaded to the platform;
information contained in job or service requests;
offers submitted in response to requests;
ratings and reviews;
messages exchanged between users;
dates, timestamps and information relating to activity on the platform;
selected language;
IP address;
browser and device information;
technical request information; and
security and server-log information.
Passwords are not stored in plain text. They are stored only in hashed form.
Certain information may be required to create an account or use a particular Hirfa function. If required information is not provided, the relevant function may not be available.
4. Purposes and Legal Basis of Processing
Personal data is processed only for specified purposes related to the operation and use of Hirfa. These purposes include:
creating and managing user accounts;
authenticating users and enabling login;
providing client and service-provider profiles;
enabling users to publish job and service requests;
enabling service providers to submit offers;
enabling communication between users;
displaying ratings and reviews;
storing and displaying uploaded photographs;
providing functions requested by users;
protecting the security and stability of Hirfa;
detecting misuse or unauthorized access;
resolving technical problems and errors;
responding to user requests; and
complying with applicable legal obligations.
Depending on the processing activity, personal data may be processed on the basis of:
the user's explicit consent;
processing necessary to provide a service requested by the user or to perform a contractual relationship;
processing necessary to comply with an applicable legal obligation or binding decision; or
another legal basis permitted under applicable Syrian law.
Where user consent is legally required, Hirfa will obtain the necessary consent for the relevant purpose.
Withdrawal of consent does not affect processing that was lawfully carried out before the consent was withdrawn.
5. Public Profiles and User-Generated Content
Certain information provided through Hirfa is intended to be visible to other users or may be publicly accessible. Depending on how the platform is used, this may include:
service-provider profiles;
profile photographs;
professional information and descriptions;
job and service requests;
ratings;
reviews; and
other information that a user chooses to publish through the platform.
Please do not publish information or upload photographs that you do not want other users or members of the public to see.
If you upload photographs or information relating to another person, you are responsible for ensuring that you have the necessary right or permission to provide and publish that information.
Private messages between users are not intended to be publicly accessible.
6. Jobs, Offers, Reviews and Messages
When you publish a job or service request, submit an offer, write a rating or review, or communicate with another user, Hirfa stores the information necessary to provide these functions. This information may include:
content submitted by the user;
user ID;
other users involved;
sender and recipient information;
message content;
date and time;
references relating to a job or offer;
rating and review information; and
related technical metadata.
This information is processed in order to provide the platform's functions and enable communication between users.
7. Cookies and Similar Technologies
Hirfa currently uses technologies necessary to operate the platform and provide its functions. These technologies include:
authentication and session cookies used to keep users logged in; and
a language-preference cookie used to remember the language selected by the user.
Hirfa currently does not intentionally use advertising, behavioural-tracking or advertising-analytics cookies.
If additional analytics, advertising or tracking technologies are introduced in the future, this Privacy Policy will be updated and any legally required consent mechanism will be implemented where necessary.
8. Hosting, Database and File Storage
Hirfa uses external technology providers to operate the platform.
Vercel
Hirfa uses Vercel for hosting and deployment of the web application.
When you access Hirfa, technical information may be processed as part of hosting and server operations. This may include: IP address; request information; date and time; browser or device information; technical server logs; and error logs.
Neon PostgreSQL
Hirfa uses a PostgreSQL database provided through Neon to store account information and data required to operate the platform.
The database infrastructure currently used by Hirfa is located in AWS eu-central-1 in Frankfurt, Germany.
The database may contain information relating to: user accounts; profiles; job and service requests; offers; messages; ratings and reviews; and other platform functions.
Cloudflare R2
Hirfa uses Cloudflare R2 to store photographs and files uploaded by users.
Photographs used in publicly accessible profiles or other public content may be accessible through public URLs.
9. Processing and Transfer of Data Outside the Syrian Arab Republic
Some of the technical infrastructure and service providers used by Hirfa are located outside the Syrian Arab Republic.
As a result, some personal data may be stored, transferred or processed outside Syria. Depending on the technical infrastructure used, this may include services provided by: Vercel; Neon; Amazon Web Services (AWS); and Cloudflare.
Transfers of personal data outside the Syrian Arab Republic are subject to the requirements of applicable Syrian law.
Where Syrian law requires consent, authorization, approval, licensing or other safeguards for an international transfer of personal data, the applicable legal requirements will apply.
Users are informed through this Privacy Policy that the technical operation of Hirfa may involve the processing of personal data outside the Syrian Arab Republic.
10. Android Application
Hirfa can also be accessed through an Android application.
The current Android application uses WebView technology to provide access to the Hirfa web application.
According to the current technical implementation, the application does not intentionally use additional native advertising or tracking technologies and is not intended to collect additional categories of personal data through native application functionality.
The data processing described in this Privacy Policy therefore also applies when Hirfa is accessed through the Android application.
11. Data Retention
Personal data is retained only for as long as necessary to fulfil the purpose for which it was collected or processed, unless continued retention is permitted or required by law.
Account and platform data is generally retained while the user's Hirfa account remains active and for as long as necessary to provide the requested Hirfa functions.
When the purpose of processing personal data no longer applies, the data will be deleted or otherwise handled in accordance with applicable legal requirements.
Certain technical information may temporarily remain in system logs, backups or infrastructure operated by external service providers until the relevant retention or backup cycle expires.
Certain information may also be retained where required to comply with legal obligations or where necessary to establish, exercise or defend legal claims.
12. Account Deletion
Hirfa provides users with functionality to permanently delete their accounts.
According to the current technical implementation, deleting an account removes the associated account data from the active database and deletes the associated profile photograph.
Data associated with the account may also be deleted, including: job or service requests; offers; messages; ratings and reviews; and other records associated with the account, depending on the technical relationships implemented in the system.
Information temporarily contained in technical logs or backups may remain until the relevant retention or backup cycle has expired.
13. Access to and Export of Your Data
Hirfa provides registered users with functionality that allows them to obtain a copy of information associated with their account.
The copy provided to the user does not include sensitive authentication information, such as the password hash.
You may also contact us at info@hirfa.net to request information about the personal data processed in relation to you.
14. Your Rights Regarding Personal Data
Subject to applicable Syrian law, you may have the right to:
know what personal data concerning you is being processed;
know the purposes and methods of processing;
access and obtain your personal data;
know how long your data will be retained or the criteria used to determine that period;
request correction, modification, updating or completion of your personal data;
request deletion of your personal data;
request that processing be restricted to a particular purpose or scope;
withdraw previously given consent where applicable;
object to processing that unlawfully affects your rights or fundamental freedoms;
be informed of a personal-data breach where required by law; and
submit a complaint to the competent Syrian authority responsible for personal-data protection.
To exercise your privacy rights, contact: info@hirfa.net
15. Data Security
Hirfa uses technical and organizational measures intended to protect personal data against:
unauthorized access;
unauthorized disclosure;
unlawful processing;
accidental loss;
unauthorized alteration; and
destruction.
Access to personal data is restricted according to the technical and operational requirements of the platform.
However, no internet-based service or electronic storage system can guarantee absolute security.
16. Personal Data Breaches
If Hirfa becomes aware of a personal-data breach, appropriate measures will be taken to investigate, contain and mitigate the incident.
Hirfa will comply with applicable Syrian legal requirements concerning notification of competent authorities and affected data subjects where legally required.
17. Changes to This Privacy Policy
We may update this Privacy Policy if:
new functions are added to Hirfa;
the categories of personal data processed change;
the technical infrastructure changes;
service providers change; or
applicable legal requirements change.
The current version of this Privacy Policy will always be made available through Hirfa at https://www.hirfa.sy and https://www.hirfa.net.
The date shown at the top of this Privacy Policy indicates when it was last updated.
Last updated: August 2026