Privacy Policy
1. Data Controller
The person responsible for the processing of personal data through Hirfa is:
Alaa Aishouna
Kafr Batna, Rif Dimashq, Beside Al-Fatih Hospital, Syrian Arab Republic
Email: info@hirfa.net
Websites:
https://www.hirfa.sy
https://www.hirfa.net
For questions concerning privacy or the processing of personal data, you may contact us using the email address above.
2. About Hirfa and This Privacy Policy
Hirfa is an online platform designed to connect clients with independent service providers and craftsmen.
This Privacy Policy applies to Hirfa through https://www.hirfa.sy and https://www.hirfa.net and, where applicable, the Hirfa Android application.
This Privacy Policy explains what personal data we process when you:
visit Hirfa;
create or use an account;
create or edit a profile;
publish a job or service request;
submit an offer;
communicate with another user;
publish a rating or review;
upload photographs; or
use the Hirfa Android application.
Personal data is processed in accordance with applicable Syrian law, including Syrian Personal Data Protection Law No. 12 of 2024 and, where applicable, Electronic Transactions Law No. 3 of 2014.
3. Personal Data We Process
Depending on how you use Hirfa, we may process:
name;
email address;
phone number;
user ID;
account type or user role;
profile information;
password in securely hashed form;
profile photograph;
other photographs uploaded to the platform;
information contained in job or service requests;
offers submitted in response to requests;
ratings and reviews;
messages exchanged between users;
dates and timestamps relating to platform activity;
selected language;
IP address;
browser and device information;
technical request information;
security and server-log information; and
identity documents voluntarily submitted for identity verification.
Passwords are not stored in plain text.
Certain information may be required to create an account or use a particular Hirfa function. If required information is not provided, the relevant function may not be available.
4. Purposes and Basis of Processing
We process personal data for specified purposes connected with the operation and use of Hirfa. These purposes include:
creating and managing user accounts;
authenticating users;
providing client and service-provider profiles;
publishing jobs and service requests;
enabling service providers to submit offers;
enabling communication between users;
displaying ratings and reviews;
storing and displaying uploaded photographs;
providing functions requested by users;
protecting the security and stability of Hirfa;
detecting abuse or unauthorized access;
resolving technical problems;
responding to users;
complying with applicable legal obligations; and
carrying out identity verification and displaying the resulting verification status.
Depending on the processing activity, processing may be based on:
the user's explicit consent;
processing necessary to provide a service requested by the user or perform a contractual relationship;
compliance with an applicable legal obligation or binding decision; or
another basis permitted under applicable Syrian law.
Where consent is legally required, Hirfa will obtain the necessary consent.
Withdrawal of consent does not affect processing lawfully carried out before withdrawal.
5. Public Profiles and User-Generated Content
Certain information provided through Hirfa is intended to be visible to other users or may be publicly accessible. Depending on the platform function, this may include:
service-provider profiles;
profile photographs;
professional information and descriptions;
job or service requests;
ratings;
reviews; and
other information intentionally published by a user.
Please do not publish information or photographs that you do not want other users or members of the public to see.
If you upload information or photographs relating to another person, you are responsible for ensuring that you are permitted to provide and publish that information.
Private messages are not intended to be publicly accessible.
6. Jobs, Offers, Reviews and Messages
When users publish jobs, submit offers, write reviews or communicate through Hirfa, we store information necessary to provide those functions.
This may include:
submitted content;
user IDs;
users involved;
sender and recipient information;
message content;
timestamps;
job and offer references;
rating and review information; and
related technical metadata.
7. Cookies and Similar Technologies
Hirfa currently uses technologies necessary to operate and provide the platform. These include:
authentication and session cookies used to keep users logged in; and
a language-preference cookie used to remember the user's selected language.
Hirfa currently does not intentionally use advertising, behavioural-tracking or advertising-analytics cookies.
If additional analytics, advertising or tracking technologies are introduced, this Privacy Policy and any legally required consent mechanism will be updated.
8. Hosting, Database and File Storage
Hirfa uses external technology providers.
Vercel
Hirfa uses Vercel for hosting and deployment.
Technical information processed during access may include: IP address; request information; date and time; browser or device information; server logs; and error logs.
Neon PostgreSQL
Hirfa uses a PostgreSQL database provided through Neon.
The database infrastructure currently used by Hirfa is located in AWS eu-central-1 in Frankfurt, Germany.
The database may contain information relating to: user accounts; profiles; jobs and service requests; offers; messages; ratings and reviews; and other platform functions.
Cloudflare R2
Hirfa uses Cloudflare R2 to store photographs and files uploaded by users.
Photographs forming part of public profiles or public content may be accessible through public URLs.
9. Processing and Transfer Outside Syria
Some technical infrastructure and service providers used by Hirfa are located outside the Syrian Arab Republic.
Personal data may therefore be stored, transmitted or processed outside Syria.
This may include services provided by:
Vercel;
Neon;
Amazon Web Services (AWS); and
Cloudflare.
International transfers of personal data are subject to applicable Syrian data-protection requirements.
Where applicable law requires consent, authorization, approval, licensing or other safeguards, the relevant requirements apply.
10. Android Application
Hirfa can also be accessed through an Android application.
The current Android application uses WebView technology to provide access to the Hirfa web application.
According to the current technical implementation, the application does not intentionally use additional native advertising or tracking technologies and is not intended to collect additional categories of personal data through native functionality.
The processing described in this Privacy Policy therefore also applies when Hirfa is accessed through the Android application.
11. Data Retention
Personal data is retained only for as long as necessary for the purpose for which it was collected or processed, unless continued retention is permitted or required by law.
Account and platform data is generally retained while the user's account remains active and as long as necessary to provide requested Hirfa functions.
Certain technical information may remain temporarily in logs, backups or infrastructure operated by external providers until the relevant retention or backup cycle expires.
Information may also be retained where required by law or where necessary to establish, exercise or defend legal claims.
12. Account Deletion
Hirfa provides users with functionality to permanently delete their account.
According to the current technical implementation, deleting an account removes associated account data from the active application database and deletes the associated profile photograph.
Depending on the technical relationships implemented in the system, related records such as:
jobs;
offers;
messages;
ratings and reviews; and
other account-related records
may also be removed.
Information temporarily contained in technical logs or backups may remain until the relevant retention or backup cycle expires.
13. Access to and Export of Your Data
Hirfa provides registered users with functionality allowing them to obtain a copy of information associated with their account.
Sensitive authentication information, such as password hashes, is not included in the user-facing export.
You may also contact info@hirfa.net to request information concerning personal data processed about you.
Requests relating to the disclosure or availability of personal data will be handled in accordance with applicable Syrian law.
Where the statutory five-working-day decision period applies, Hirfa will handle the relevant request within that period.
14. Your Rights
Subject to applicable Syrian law, you may have the right to:
know what personal data concerning you is processed;
know the purposes and methods of processing;
access and obtain your personal data;
know the applicable retention period or criteria;
request correction, modification, updating or completion;
request deletion;
request restriction of processing to a specified purpose or scope;
withdraw previously given consent where applicable;
object to unlawful processing;
be informed of a personal-data breach where legally required; and
submit a complaint to the competent Syrian authority responsible for personal-data protection.
To exercise your rights, contact: info@hirfa.net
15. Data Security
Hirfa uses technical and organizational measures intended to protect personal data against:
unauthorized access;
unauthorized disclosure;
unlawful processing;
accidental loss;
unauthorized alteration; and
destruction.
Access to personal data is restricted according to technical and operational requirements.
No internet-based service or electronic storage system can guarantee absolute security.
16. Personal Data Breaches
If Hirfa becomes aware of a personal-data breach, appropriate measures will be taken to investigate, contain and mitigate the incident.
Hirfa will comply with applicable Syrian requirements concerning notification of competent authorities and affected persons where legally required.
17. Changes to This Privacy Policy
We may update this Privacy Policy if:
new functions are introduced;
categories of personal data change;
technical infrastructure changes;
service providers change; or
applicable legal requirements change.
The current version will always be available through https://www.hirfa.sy and https://www.hirfa.net.
The date shown at the beginning indicates when this Privacy Policy was last updated.
18. Identity Verification and Identity Documents
Service providers may choose to verify their identity. Identity verification is optional, and Hirfa can be used without completing it. However, profiles that have not completed verification will not display a verified badge.
To request identity verification, the provider uploads a photo or scan of an official identity document, such as a passport or national ID. The document is submitted voluntarily and is processed solely for the purpose of carrying out the requested identity verification.
Identity documents contain personal data that requires a high level of protection. Hirfa therefore applies additional safeguards when handling these documents:
the document is stored in private, non-public storage and cannot be accessed through a public URL;
the document may only be accessed by authorised members of the Hirfa team who require access to perform the identity verification, using temporary, time-limited access links created solely for the review;
the document is used solely for identity verification and is not used for any other purpose.
Once the verification review has been completed — whether the identity is verified or verification is unsuccessful — the uploaded identity document is automatically deleted from storage.
After the review, Hirfa retains only the verification result and the date on which the review was completed. The identity document itself is not retained.
If a provider uploads a new identity document, any previously uploaded identity document is deleted.
Last updated: August 2026