Privacy Policy

Read how einfrasouq.com collects, uses, stores, shares and protects personal data for buyers, sellers and visitors to its B2B marketplace in Oman.

einfrasouq.com

Global Infrastructure Solutions SPC

Sultanate of Oman

Version 1.1

Effective Date: 20 September 2026

Last Updated: 20 September 2026

This Privacy Policy should be read together with the Terms & Conditions, Cookie Policy and other applicable Platform policies.

Welcome to einfrasouq.com (the “Platform”), a business-to-business marketplace for construction, building materials, infrastructure, engineering and industrial procurement in Oman, owned and operated by Global Infrastructure Solutions SPC (“Company”, “we”, “our” or “us”).

We are committed to handling personal data transparently, securely and in accordance with applicable laws of the Sultanate of Oman. This Privacy Policy explains what personal data we collect, why and how we process it, when it may be shared, how long we retain it, the safeguards we apply, and the rights available to data subjects.

By accessing the Platform, you acknowledge that you have read and understood this Privacy Policy. Where consent is required by applicable law, consent will be requested through an appropriate written, electronic or other documented mechanism before the relevant processing takes place.

PART I – INTRODUCTION

1. Purpose

This Privacy Policy is intended to provide clear information about:

the categories and sources of personal data we collect;
the purposes and procedures of processing;
the circumstances in which data may be disclosed or transferred;
the use of cookies and similar technologies;
data retention and security practices;
how data subjects may exercise their rights;
how to contact us about privacy or data protection matters.

2. Scope

This Privacy Policy applies to personal data processed through the Platform in connection with visitors, Buyers, Sellers, company administrators, authorised representatives, employees using company accounts, prospective customers, marketing enquiries, customer-support users and other persons who interact with einfrasouq.com.

It applies to the website and related Platform services, dashboards, forms, communications and functionalities unless a separate privacy notice is expressly provided for a specific service.

3. Data Controller

For personal data processed for the operation of einfrasouq.com, the data controller is:

Global Infrastructure Solutions SPC

CR No. 1627889

PO Box 202, PC 130, Azaibah, Muscat, Sultanate of Oman

Website: www.einfrasouq.com

Privacy / Data Protection Contact: support@einfrasouq.com

4. Applicable Data Protection Framework

This Privacy Policy is intended to operate in accordance with the Personal Data Protection Law issued by Royal Decree No. 6/2022, its Executive Regulations issued under Ministerial Decision No. 34/2024, and other applicable laws and regulatory requirements of the Sultanate of Oman, as amended from time to time.

5. Definitions

Personal Data

Information that identifies, or can directly or indirectly identify, a natural person, including electronic identifiers and other information linked to an identifiable individual.

Data Subject

The natural person to whom personal data relates.

Controller

The person or entity that determines the purposes and means of processing personal data. For the processing described in this Policy, Global Infrastructure Solutions SPC is generally the Controller.

Processor

A third party that processes personal data on behalf of the Controller under an appropriate contractual arrangement.

Sensitive Personal Data

Personal data requiring enhanced protection under applicable law, including the categories identified under Article 5 of the Oman Personal Data Protection Law, such as genetic, biometric and health data and certain data relating to racial origin, sexual life, political or religious opinions or beliefs, criminal convictions or security measures.

Processing

Any operation performed on personal data, including collection, recording, organisation, storage, modification, retrieval, review, use, disclosure, transfer, blocking, erasure or deletion.

6. Transparency and Consent

Before processing personal data, we will provide the data subject with the information reasonably required by applicable law regarding the Controller, the purpose and procedures of processing, the relevant disclosure level, the data subject’s rights and the applicable privacy contact.

Where explicit consent is required, we will seek consent in a clear and understandable form. Consent may be captured electronically or in another documented form permitted by law. A data subject may withdraw consent in accordance with Part VIII of this Policy, without affecting processing lawfully carried out before withdrawal.

PART II – INFORMATION WE COLLECT

7. Information You Provide

The information collected depends on how you interact with the Platform and the role in which you use it.

Individual and Contact Information

full name;
job title and role;
company email address;
telephone or mobile number;
authorised representative details;
other contact details supplied by the User.

Company and Verification Information

company name and business activities;
Commercial Registration and VAT registration details;
company address, country and website;
business licences and supporting company documents;
company authorisation letters;
identity documents of authorised representatives where required for verification;
company logo, profile and certifications.

Seller Information

product catalogues, images, videos and descriptions;
product specifications, certifications, brands and country of origin;
pricing, minimum order quantities, stock or availability information;
delivery, warranty and other commercial information;
subscription, promotion and advertising requests.

Buyer and Procurement Information

RFQs, enquiries and project requirements;
Purchase Orders and order-related commercial selections;
delivery and billing details;
payment-term preferences;
order status, disputes, ratings and reviews;
communications with Sellers in connection with procurement activities.

8. Electronic Purchase Order and Account Activity Records

To support the authenticated Purchase Order process and the authorisation framework described in the Platform Terms & Conditions, we may record and retain information relating to the creation, submission, transmission, acceptance, rejection, modification or cancellation of Purchase Orders and other commercial communications.

Such information may include the registered company, authorised User name and email address, account or user identifier, Purchase Order number, order details, date and time stamps, login history, session or security records, communications and relevant audit logs. These records may be used to attribute electronic activity to the registered account, protect Buyers and Sellers, investigate disputes or suspected misuse, and maintain legal, audit and security records.

9. EInfra Rewards Information

Where a Buyer participates in EInfra Rewards, we may process information necessary to administer the program, including eligible order values, points earned, points adjusted or cancelled, promotional multipliers, available reward value, redemption requests, redemption status and related account history.

Reward information may be linked to the Buyer account and relevant order records to verify eligibility, prevent duplicate or fraudulent credits and administer redemption requests.

10. Platform Fee and Payment Information

The Platform may use third-party payment providers to process registration fees, Seller subscriptions, promotions, advertising services or other Platform charges. We may receive transaction references, payment status, amount, date, invoice information and limited billing details necessary for reconciliation, accounting, support and fraud prevention.

Unless expressly stated otherwise, einfrasouq.com does not process or hold payments for the underlying purchase of products between Buyers and Sellers. Buyer-Seller product payments are arranged directly between the contracting parties.

11. Communications and Support Information

We may process information submitted through contact forms, customer-support systems, live chat, emails, feedback forms, reviews, dispute requests, uploaded files and other communications with the Platform.

12. Information Collected Automatically

When the Platform is accessed, we may automatically collect technical and usage information such as:

IP address and approximate location derived from IP, where applicable;
browser type and version;
operating system and device information;
screen or display information;
referring page or website;
session duration, pages visited and click activity;
search queries and marketplace interactions;
login history and authentication events;
date, time, language and time-zone preferences;
cookie and similar technology identifiers.

13. Cookies and Similar Technologies

The Platform may use strictly necessary, functional, analytics and, where applicable, marketing cookies or similar technologies to authenticate Users, remember preferences, improve security, understand website usage and improve the user experience.

Where applicable law requires consent for non-essential cookies, such cookies will be used only after the relevant consent has been obtained. Users may manage available preferences through the cookie controls provided by the Platform or through browser settings. Disabling some cookies may affect functionality.

Further information should be read together with the Platform Cookie Policy.

14. Information from Third Parties

We may receive personal data from third parties where permitted by law and reasonably necessary for Platform operations, including payment providers, public business registries, identity or business verification providers, email and SMS providers, customer-support providers, mapping providers, cybersecurity services, fraud-prevention services, analytics providers and other service providers used in connection with the Platform.

15. Sensitive Personal Data

einfrasouq.com does not ordinarily require Users to provide Sensitive Personal Data for normal marketplace registration or transactions. Users should not submit Sensitive Personal Data unless specifically requested and legally necessary.

Where processing of Sensitive Personal Data becomes necessary, the Company will implement the additional controls required by applicable law, including obtaining explicit consent and any permit or regulatory approval required before processing, storage, disclosure or cross-border transfer.

PART III – HOW AND WHY WE USE PERSONAL DATA

16. General Processing Purposes

Subject to applicable law and, where required, the data subject’s consent, we may process personal data to:

create, verify and administer Buyer and Seller accounts;
operate company profiles and product listings;
administer Seller subscriptions and Platform charges;
facilitate RFQs, quotations, Purchase Orders and order management;
administer EInfra Rewards;
process promotion and advertising requests;
provide customer support and dispute-assistance communications;
send service notices and account communications;
maintain audit, security and transaction records;
detect and prevent fraud, misuse and security incidents;
improve search, navigation, user experience and Platform performance;
develop and test new Platform features;
comply with legal, tax, audit and regulatory obligations;
establish, exercise or defend legal rights.

17. Buyer and Seller Interactions

Personal data may be used to facilitate legitimate B2B interaction between Buyers and Sellers. The information made visible or transmitted to another User will depend on the relevant Platform feature, account permissions, transaction stage and commercial workflow.

We seek to limit disclosure to information reasonably necessary for the relevant marketplace interaction. Users receiving personal data through the Platform must use it only for legitimate business purposes connected with the relevant enquiry, RFQ, order or commercial relationship and must comply with applicable data protection obligations.

18. Purchase Order Attribution, Security and Audit

The Company may use account identity, authentication, Purchase Order, timestamp, session, audit and communication records to evidence the origin and integrity of electronic instructions submitted through registered accounts, to investigate unauthorised access or disputed activity, and to support the operation of the electronic Purchase Order authorisation provisions contained in the Terms & Conditions.

19. EInfra Rewards Administration

Reward-related information may be processed to calculate points, verify eligible orders, apply promotional earning rates, process redemption requests, enforce monthly limits and redemption periods, adjust points where an order becomes ineligible, and investigate misuse of the rewards programme.

20. Customer Support and Disputes

We may process account, transaction, communication and supporting-document information to answer enquiries, resolve technical issues, assist the exchange of information between Buyers and Sellers, investigate suspected policy violations and provide administrative dispute assistance. The Platform does not thereby become a party to the underlying Buyer-Seller dispute.

21. Analytics and Platform Improvement

We may analyse website and marketplace usage, generally using aggregated or appropriately limited information, to understand navigation patterns, search behaviour, product interest, technical performance and marketplace activity and to improve the Platform.

22. Security and Fraud Prevention

We may process personal data to protect accounts and the Platform, including for authentication, access control, suspicious-activity monitoring, fraud prevention, malware and spam detection, incident response, audit logging and enforcement of Platform policies.

23. Marketing Communications

Advertising, marketing or commercial communications will be sent in accordance with applicable legal requirements. Where written or explicit consent is required, we will obtain and retain evidence of such consent and identify the channel through which communications may be sent.

Users may opt out of marketing communications at any time using the unsubscribe or preference mechanism provided or by contacting us. We will stop the relevant marketing communications upon receipt of a valid opt-out request, free of charge, as required by applicable law. Service, security and transactional communications that are necessary for an account or transaction may continue where permitted.

24. Legal and Regulatory Compliance

We may process and disclose information where necessary or permitted to comply with applicable law, respond to lawful requests, meet tax or accounting obligations, enforce Platform Terms and policies, investigate misconduct, protect rights or safety, or establish, exercise or defend legal claims.

PART IV – DISCLOSURE AND SHARING OF PERSONAL DATA

25. No Sale of Personal Data

The Company does not sell Users’ personal data to third parties.

26. Information Shared Between Buyers and Sellers

Where reasonably necessary for B2B marketplace activity, information may be shared between Buyers and Sellers, including company name, authorised contact details, delivery or billing information, product information, RFQs, quotations, Purchase Orders, order communications, reviews or dispute-related information. The level of disclosure may vary by account type, feature and stage of the transaction.

27. Service Providers and Processors

We may engage service providers and processors that support cloud hosting, data storage, payment processing for Platform fees, email and SMS delivery, customer support, mapping, analytics, security, fraud prevention, document storage and other technical or operational services.

Such providers should receive only the personal data reasonably necessary for their role and are expected to process it subject to contractual, confidentiality, security and legal requirements appropriate to the service.

28. Legal, Regulatory and Protective Disclosures

We may disclose personal data where required or permitted by law, including in response to court orders, lawful government or regulatory requests, investigations, fraud prevention, enforcement of legal rights or measures reasonably necessary to protect Users, the Company or public safety.

29. Corporate Transactions

If the Company undergoes a merger, acquisition, restructuring, investment, sale of assets or similar corporate transaction, personal data may be disclosed or transferred as part of that transaction subject to applicable legal requirements and appropriate confidentiality safeguards.

PART V – INTERNATIONAL DATA TRANSFERS

30. Cross-Border Processing and Storage

Some service providers used to operate the Platform may process or store personal data outside the Sultanate of Oman, including in connection with cloud hosting, communications, cybersecurity, disaster recovery, support, software services or analytics.

Before transferring personal data outside Oman, the Company will comply with applicable cross-border transfer requirements. As a general rule, this includes obtaining the data subject’s explicit consent where required, ensuring that the transfer does not prejudice national security or the higher interests of the State, assessing the level of protection and risks associated with the receiving entity or country, and ensuring an adequate level of protection no less than that required under applicable Oman data-protection law.

Where Sensitive Personal Data is to be processed or stored outside Oman, the Company will obtain any approval required from the competent authority, including the Cyber Defence Centre where applicable, before the transfer takes place.

Consent may not be required in limited circumstances expressly permitted by applicable law, including certain treaty obligations or transfers carried out in a manner that prevents identification of the data subject.

PART VI – DATA RETENTION

31. Retention Principles

We retain personal data only for as long as necessary for the purpose for which it was collected or for a period reasonably required to comply with legal, regulatory, tax, accounting, audit, security, fraud-prevention, dispute or contractual requirements.

The Company maintains or may maintain internal retention schedules taking into account the nature of the data, the purpose of processing, the relationship with the User, applicable limitation periods and legal or regulatory requirements.

32. Typical Retention Categories

account and verification records: for the duration of the account and thereafter for the period reasonably required for legal, audit, security and regulatory purposes;
RFQs, Purchase Orders, order records and related communications: for the period necessary to support commercial records, disputes, audit and applicable legal obligations;
subscription, Platform-fee and invoice records: for applicable accounting, tax and legal retention periods;
EInfra Rewards records: for administration of the programme and thereafter as reasonably necessary for audit, fraud prevention and dispute purposes;
support and dispute records: for as long as reasonably necessary to resolve the matter and preserve appropriate business records;
marketing consent records: for as long as necessary to demonstrate consent or withdrawal and to maintain suppression preferences;
security and technical logs: for a period proportionate to security, investigation and operational requirements.

33. Account Closure and Deletion

Account closure does not necessarily result in immediate deletion of all records. Certain data may continue to be retained where necessary or permitted for legal compliance, accounting, taxation, fraud prevention, security, dispute resolution, enforcement of contractual rights or preservation of legitimate commercial records.

34. Record of Processing Activities

The Company will maintain records of personal-data processing activities and related compliance documentation as required by applicable law, including records relating to consent, processing purposes, processors, transfers, security incidents and other prescribed matters.

PART VII – SECURITY AND PERSONAL DATA BREACHES

35. Security Measures

The Company implements commercially reasonable administrative, organisational and technical safeguards designed to protect personal data from unauthorised access, disclosure, alteration, leakage, misuse, loss or destruction.

Depending on the relevant system and risk, measures may include encrypted communications, access controls, password and authentication controls, firewalls, security monitoring, audit logging, backup and recovery procedures, software updates, vendor controls and periodic testing of technical measures.

36. User Responsibilities

Users are responsible for protecting their account credentials and should use strong passwords, avoid sharing credentials, remove access for personnel who are no longer authorised, report suspected unauthorised access promptly and log out of shared devices.

37. Personal Data Breach Response

The Company will maintain internal procedures for identifying, documenting, investigating, containing and responding to personal data breaches.

Where a personal data breach is likely to result in a risk to the rights of affected data subjects, the Company will notify the competent Ministry within the period required by applicable law, including within 72 hours of becoming aware of the breach where the applicable threshold is met. Where a breach causes serious harm or presents a high risk to a data subject, the affected data subject will also be notified within the applicable period, including within 72 hours where required.

Notifications may include, as applicable, a description of the breach, likely consequences, contact details for further information and the corrective or mitigation measures taken or proposed.

PART VIII – DATA SUBJECT RIGHTS

38. Your Rights

Subject to applicable law and any permitted limitations, a data subject may have the right to:

withdraw consent to processing, without affecting processing carried out before withdrawal;
request correction, updating or blocking of personal data;
obtain access to, or a copy of, personal data being processed;
request transfer of personal data to another controller in accordance with applicable requirements;
request erasure of personal data where the applicable conditions are met;
be notified of qualifying personal data breaches and the measures taken;
opt out of advertising, marketing or commercial communications;
submit a complaint regarding unlawful processing to the competent authority.

39. How to Exercise Your Rights

Requests may be submitted in writing to support@einfrasouq.com with sufficient information to identify the data subject, the relevant company account and the right being exercised. We may request reasonable verification before acting on a request to protect the data subject and the associated business account from unauthorised disclosure or change.

We will process valid requests in accordance with the procedures and periods required by applicable law. Where a request cannot be fulfilled, we may explain the reason where required or appropriate.

40. Complaints

A data subject or other interested person may submit a complaint to the competent authority where they believe their personal data has been processed in violation of applicable law. Under the current Oman framework, complaints to the Ministry are subject to the procedures and time limits prescribed by the Personal Data Protection Law and its Executive Regulations.

PART IX – MARKETING, COOKIES AND COMMUNICATION PREFERENCES

41. Marketing Consent and Opt-Out

Where consent is required for advertising, marketing or commercial communications, the Company will obtain the required written or documented consent and provide a clear method to withdraw that consent or opt out. Opt-out requests will be honoured in accordance with applicable law.

42. Cookie Preferences

Where the Platform provides a cookie-consent or preference tool, Users should use that mechanism to manage available non-essential cookie choices. Browser-level controls may also be available. Essential cookies required for account authentication, security or core Platform functionality may not be capable of being disabled through the Platform.

PART X – CHILDREN AND PERSONS WITHOUT LEGAL CAPACITY

43. Business-Only Platform

einfrasouq.com is intended for business-to-business use by legally capable adults acting on behalf of organisations. The Platform is not directed to children and we do not knowingly seek to collect children’s personal data through ordinary registration or marketplace activity.

If personal data of a child or a person without legal capacity is ever required for a lawful and specific purpose, the Company will apply the additional safeguards required by law, including obtaining explicit consent from the guardian or other authorised person where required.

PART XI – THIRD-PARTY WEBSITES AND SERVICES

44. External Links

The Platform may contain links to third-party websites or services. Their privacy practices, content, security and availability are controlled by the relevant third party. Users should review the applicable third-party privacy notice before providing personal data directly to such services.

PART XII – POLICY UPDATES

45. Changes to this Privacy Policy

We may update this Privacy Policy to reflect legal or regulatory developments, operational changes, new Platform features, technology changes or changes in our processing activities. The updated version and date will be published on the Platform. Where required by law, additional notice or renewed consent will be obtained before material changes affecting consent-based processing take effect.

PART XIII – DATA PROTECTION CONTACT

46. Privacy and Data Protection Enquiries

Questions, rights requests, complaints or notifications concerning this Privacy Policy or personal data processed through einfrasouq.com may be directed to:

Global Infrastructure Solutions SPC

Data Protection Officer / Privacy Contact

CR No. 1627889

PO Box 202, PC 130, Azaibah, Muscat, Sultanate of Oman

Website: www.einfrasouq.com

Email: support@einfrasouq.com

PART XIV – GOVERNING LAW

47. Applicable Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Sultanate of Oman, including the Personal Data Protection Law and its Executive Regulations, without prejudice to any mandatory rights or remedies available to data subjects under applicable law.

PART XV – FINAL PROVISIONS

48. Relationship with Other Platform Policies

This Privacy Policy forms an integral part of the Terms & Conditions governing the use of einfrasouq.com and should be read together with the Cookie Policy and other applicable Platform policies. Where there is an inconsistency between this Privacy Policy and the Terms & Conditions specifically concerning the processing of personal data, this Privacy Policy shall prevail to the extent of that inconsistency, subject always to applicable law.

49. Language

This Privacy Policy is published in English. Where a translation is made available for convenience, the English version shall prevail in the event of inconsistency unless applicable law requires otherwise.

WEB PUBLISHING & SEO IMPLEMENTATION NOTES

For the website/development team. This section is implementation guidance and should not be displayed as part of the legal Privacy Policy body unless desired.

SEO Element

Recommended Implementation

Recommended URL

https://einfrasouq.com/pages/privacy-policy

SEO Page Title

Meta Description

Read how einfrasouq.com collects, uses, stores, shares and protects personal data for buyers, sellers and visitors to its B2B marketplace in Oman.

Indexing

index, follow

Canonical

Self-referencing canonical to https://einfrasouq.com/pages/privacy-policy

Breadcrumb

Home > Privacy Policy

SEO / technical requirements:

Keep the full Privacy Policy text server-rendered or otherwise available in the initial crawlable HTML so search engines can read it reliably, and ensure privacy, cookie and consent links are crawlable HTML links.
Include the canonical Privacy Policy URL in the XML sitemap and link to it from the website footer, registration pages, login/checkout-related flows where relevant, Cookie Policy and Terms & Conditions.
Use a self-referencing rel="canonical" tag and ensure staging or duplicate URLs do not become indexable canonicals.
Use one visible H1 only, with logical H2/H3 headings for the policy sections.
Add BreadcrumbList structured data for Home > Privacy Policy if breadcrumb schema is used elsewhere on the site.
Do not use FAQPage schema on this page unless an actual FAQ section is added and the markup accurately matches the visible content.
Avoid keyword stuffing. The privacy page should primarily target branded trust/navigation searches such as “einfrasouq privacy policy” while clearly describing the B2B marketplace context in Oman.
Keep the “Last Updated” date visibly displayed and update it whenever the policy materially changes.