Privacy Policy

Introduction

At Tamallak Leasing Company, we are fully committed to protecting the privacy and security of your personal data in accordance with the provisions of the Jordanian Personal Data Protection Law No. (24) of 2023. This Privacy Policy explains how we collect, use, disclose, and generally process your personal data, as well as the measures we take to protect it when providing our services directly to you or through any other electronic interaction with the Company.

Scope of Application

This Privacy Policy applies to all users of the Company’s website, including website visitors, individuals who complete contact forms, submit inquiries, or apply for employment opportunities through the website, whether they are existing or prospective customers. It also applies to the processing of personal data generated through electronic interactions with the Company.

Purpose of the Privacy Policy

This Privacy Policy aims to protect the personal data of the Company’s customers and all individuals dealing with the Company, ensure the confidentiality of information, and process it securely in accordance with applicable laws and regulations. It also seeks to promote transparency in the collection and use of personal data, enable individuals to exercise their legal rights, define the lawful purposes for processing personal data to ensure efficient service delivery, comply with regulatory requirements, and strengthen trust and credibility between the Company and its customers by implementing the highest standards of security and technical safeguards to protect personal information.

1. Information We Collect

We collect different types of information to provide and improve our services, manage our relationship with you, and comply with legal and regulatory requirements. Such information may include:

1.1 Personal Data You Provide Directly

The information you provide when applying for a product or service, registering for online services, or contacting Customer Service may include, without limitation:

Identity Information

• Full name
• Date of birth
• National ID number
• Passport number
• Nationality
• Gender

Contact Information

• Residential address
• Email address
• Telephone number

Financial Information

• Account numbers
• Income details
• Credit history

Other Information

• Information received from third parties, such as governmental or regulatory authorities or credit verification agencies.

1.2 Data Collected Indirectly

We may obtain your personal data indirectly from various sources.

Automatically Collected Information

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyze website traffic, and personalize content and advertisements. You may manage your cookie preferences through your browser settings or by using the cookie consent tool available on our website.

This may include:

Device Information

• Internet Protocol (IP) address
• Device type
• Operating system
• Browser type

Usage Data

• Pages visited
• Time spent on pages
• Links clicked
• Referring URLs
• User interaction patterns

Location Data

• General geographic location based on your IP address.

1.3 Information Obtained from Third Parties

We may receive information about you from third parties, including credit inquiry agencies and identity verification service providers relating to individuals associated with you, such as your legal representative, attorney-in-fact, authorized signatory, or employer.

1.4 Publicly Available Sources

We may obtain personal information from publicly available sources, including public databases and the Companies Control Department, in accordance with applicable laws.

2. How We Use Your Information (Purposes and Legal Basis)

We process your personal data for the following purposes:

• Providing our services and processing transactions (Contractual Necessity).
• Verifying your identity and ensuring account security (Contractual Necessity).
• Communicating with you regarding your accounts and our services (Contractual Necessity / Legitimate Interest).
• Improving our products and services and enhancing your customer experience (Legitimate Interest).
• Complying with applicable legal and regulatory requirements (Legal Obligation).
• Conducting data analysis, research, and internal administrative purposes (Legitimate Interest).
• Collecting any amounts owed to the Company (Contractual Necessity).
• Assessing any application you submit (Legitimate Interest).
• Monitoring, recording, and analyzing communications between you and the Company (Legal Obligation).
• Sharing your data with governmental authorities, credit reference agencies, fraud prevention agencies, operational and regulatory authorities, external authorities, and external auditors where required (Legal Obligation / Contractual Necessity).
• Processing personal data of job applicants (Legitimate Interest / Contractual Necessity).
• Litigation purposes, obtaining legal advice, issuing legal notices, or documenting transactions (Legal Obligation / Contractual Necessity).

3. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyze website traffic, and personalize content and advertisements. You may manage your cookie preferences through your browser settings or by using the cookie consent tool available on our website.

4. How We Share Your Information

We may share your personal data with third parties only where necessary, for the purposes described in this Privacy Policy, and in compliance with applicable legal requirements. Such parties may include:

Service Providers

Entities involved in processing financial transactions, including licensed or authorized banks, payment service providers, and electronic money transfer companies. Personal data will be shared only to the extent necessary to facilitate such transactions and comply with applicable legal and regulatory requirements.

Regulatory and Legal Authorities

Government authorities, regulatory bodies (including the Central Bank of Jordan and the Anti-Money Laundering Unit), courts, and competent authorities where disclosure is required by law or pursuant to a lawful request.

Credit Reporting Agencies

For credit assessment and credit reporting purposes, as permitted by applicable law.

Professional Advisors

Auditors, lawyers, and other professional advisors for auditing, compliance, and legal representation purposes.

Parent Company

Bank of Cairo Amman, for the purposes of complying with laws and regulatory requirements governing subsidiaries.

Authorized Agents

Agents acting on behalf of Tamallak Leasing Company.

5. International Data Transfers

Your personal data may be transferred outside the Hashemite Kingdom of Jordan under the following conditions:

• There is a lawful basis for the transfer, such as where it is necessary for the performance of a contract with you (for example, fund transfers), where you have provided prior consent, or where the transfer is required to comply with legal obligations.
• The transfer is justified by the nature of the Company’s business, such as where the Company has affiliates or business partners outside Jordan, or where the transfer is necessary to perform a particular transaction or service.
• Appropriate safeguards are implemented to protect your privacy rights in accordance with the Jordanian Personal Data Protection Law of 2023.

6. Data Security

At Tamallak Leasing Company, we are committed to safeguarding the privacy of your personal data. Our policies incorporate comprehensive technical, physical, and organizational measures designed to preserve the confidentiality, integrity, and security of your information.

These safeguards protect your personal data against loss, misuse, unauthorized access, data breaches, alteration, or disclosure during storage, processing, and transmission.

We regularly review and update our security measures to ensure continuous protection. Access to your personal data is restricted to authorized personnel who require such access in order to provide Tamallak Leasing Company’s products and services.

7. Data Retention

Tamallak Leasing Company retains your personal data only for as long as necessary to fulfill the purposes for which it was collected. As a general rule, personal data will be retained for a period of five (5) years, or for such longer period as may be required to comply with applicable legal, regulatory, or statutory obligations, including the instructions of the Central Bank of Jordan, where the business relationship remains ongoing or where retention is otherwise mandated by law.

Once your personal data is no longer required, it will be securely disposed of using appropriate methods.

8. Your Rights (Data Subject Rights)

Pursuant to the Jordanian Personal Data Protection Law, the Company may process personal data without obtaining the data subject’s consent or prior notification in accordance with Article (6/A/5) where such processing is necessary for the Company to carry out its licensed activities.

In all other cases, you have the following rights regarding your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request the correction of inaccurate or incomplete personal data.
• Right to Erasure (Right to be Forgotten): To request the deletion of your personal data, subject to applicable laws, the instructions of the Central Bank of Jordan, and where the processing is not required for the Company’s legitimate business purposes.
• Right to Restrict Processing: To request that we restrict or suspend the processing of your personal data for a specified period, where such processing is not necessary for the Company’s legitimate business purposes.
• Right to Object: To object to the processing of your personal data under certain circumstances, including for direct marketing purposes.
• Right to Data Portability: To request that your personal data be provided to you in a structured, commonly used, and machine-readable format, or transferred to another controller where technically feasible.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time, provided that such withdrawal does not affect processing carried out for the Company’s legitimate business purposes or to comply with applicable laws.

Notwithstanding the above, the Company may decline requests where compliance would conflict with applicable laws, regulatory requirements, or supervisory obligations, or where fulfilling such requests would conceal, alter, or intentionally modify information necessary to verify the identity of the customer or beneficial owner, affect the accuracy of credit reporting, compromise customer due diligence requirements, or jeopardize the security and integrity of the Company’s operations.

Processing means any operation or set of operations performed on personal data by any means, including collecting, recording, copying, storing, organizing, structuring, adapting, modifying, retrieving, consulting, using, transmitting, disseminating, making available, linking, combining, anonymizing, encoding, restricting, erasing, destroying, or otherwise processing personal data.

9. Requests and Complaints

To exercise any of your rights or submit a complaint, please contact our Data Protection Officer (DPO) using the contact details provided below.

The Company will handle requests and complaints as follows:

• Personal Data Requests: Requests will be fulfilled within 15 days from the day following receipt of the request. The Company may extend this period once for an additional 15 days, where permitted by law.
• Complaints: Complaints will be responded to within 10 days from the day following receipt.

Please note that we may be unable to comply with certain requests where doing so would conflict with applicable laws, regulatory obligations, or compromise the security of our operations.

10. Personal Data Breach Notification

In the event of a personal data breach that is likely to result in a significant risk to the rights and freedoms of the data subject, the Company will notify the affected individual within 24 hours of becoming aware of the breach, in accordance with applicable legal requirements.

11. Children’s Data

The Company’s website is not intended for individuals under the age of 18 years, and we do not knowingly collect or process personal data relating to minors.

If we become aware that personal data relating to a minor has been collected without the consent of a parent or legal guardian where required, we will take appropriate measures to delete such data without undue delay.

12. Direct Marketing

The Company may use customers’ personal data for the purpose of marketing its products and services directly, to the extent related to the products and services already provided to the customer under the existing relationship. This also includes similar or related products and services offered by companies wholly owned by the Company.

Customers have the right to opt out of receiving direct marketing communications at the first marketing contact or at any time thereafter.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, services, or legal and regulatory requirements.

Any material changes will be published on our website together with the updated effective date. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

14. Contact Us

If you have any questions regarding this Privacy Policy, our data processing practices, or if you wish to exercise any of your rights, please contact our Data Protection Officer (DPO):

Tamallak Leasing Company

Data Protection Officer: Mohammad Asim Karzoun

Email: DPO@Tamallak.jo

Telephone: +962 6 5006658