Privacy Policy

1. Purpose

Coraltec is committed to respecting the privacy and protecting the personal data of its customers, employees, prospective employees, suppliers, business partners, website visitors, and other individuals who interact with the company.

This policy establishes the principles and requirements governing the collection, use, processing, storage, sharing, retention, and protection of personal data within Coraltec's business operations.

The purpose of this policy is to

• Protect personal information against unauthorized access, disclosure, alteration, or loss.
• Ensure personal data is collected and processed for legitimate business purposes.
• Establish clear responsibilities for employees and management.
• Maintain transparency with customers, employees, and other stakeholders.
• Support compliance with applicable data protection and privacy legislation, particularly Jordan's Personal Data Protection Law No. 24 of 2023 and its applicable regulations and instructions.

2. Scope

This policy applies to all Coraltec departments, employees, management, temporary workers, consultants, contractors, and authorized third parties who access or process personal data on behalf of the company.

It covers personal data processed through:

• Company websites and digital platforms.
• Customer inquiries and communication channels.
• Sales, marketing, and customer relationship activities.
• Printer sales, installation, maintenance, and technical support services.
• Supplier and business partner relationships.
• Recruitment and human resources activities.
• Employee administration and internal business operations.
• Company IT systems, databases, emails, and physical records.

This policy applies to both electronic and paper-based personal information.

3. Types of Personal Data Collected

Depending on the business relationship and the services provided, Coraltec may collect the following categories of personal information.

Customers and Business Contacts

• Full name.
• Business email address.
• Telephone and mobile numbers.
• Company name and business address.
• Job title and department.
• Business inquiries and correspondence.
• Service requests and technical support records.
• Contractual and transaction-related information.
• Relevant billing and payment information.

Website Visitors

• Contact information submitted through website forms.
• IP address and technical information, where collected.
• Browser and device information.
• Website usage information.
• Cookies and similar tracking information, where applicable.

Employees

Coraltec may collect and maintain employee information necessary for employment and business administration, including:

• Personal identification and contact information.
• Employment history and qualifications.
• CVs, applications, and recruitment records.
• Employment contracts and job descriptions.
• Attendance, working hours, and leave records.
• Salary, payroll, and relevant financial information.
• Performance evaluation and training records.
• Work-related communications.
• Company equipment and IT access records.
• Disciplinary or investigation records, where applicable and lawful.

Suppliers and Business Partners

• Contact names and business details.
• Company registration and contractual information.
• Business correspondence.
• Authorized representatives' information.
• Relevant financial and transaction records.

Coraltec will seek to collect only the personal information reasonably necessary for the relevant business purpose.

4. Purpose of Collecting and Processing Personal Data

Coraltec processes personal data for legitimate and specified business purposes, including:

• Responding to customer inquiries and requests.
• Providing quotations, proposals, and commercial offers.
• Managing customer relationships and contracts.
• Delivering printing equipment, installation, and maintenance services.
• Providing technical support and after-sales services.
• Managing suppliers and business partnerships.
• Processing recruitment and employment activities.
• Managing payroll, attendance, leave, and employee administration.
• Maintaining company security and IT operations.
• Meeting applicable legal, regulatory, and contractual obligations.
• Improving the quality of company services and operations.
• Communicating relevant company updates, products, and services where permitted.

Personal data shall not be processed for purposes incompatible with the purposes for which it was originally collected, unless an appropriate legal basis exists.

5. Legal Basis for Processing

Coraltec will process personal data in accordance with applicable laws and regulations.

Depending on the circumstances, processing may be based on:

• Prior consent of the individual, where required.
• The performance of a contract or steps requested before entering into a contract.
• Compliance with legal obligations.
• Legitimate and lawful business interests, where permitted by applicable legislation.
• Other legal grounds recognized under applicable data protection legislation.

Where consent is relied upon, individuals will be informed of the relevant purpose and their applicable rights, including the right to withdraw consent where legally applicable.

6. Sharing and Disclosure of Personal Data

Coraltec does not make personal information publicly available or share it indiscriminately.

Personal data may be disclosed to authorized parties when necessary for legitimate business operations, including:

• Authorized employees and relevant departments.
• IT service providers and technical support providers.
• Hosting and cloud service providers.
• Payroll and accounting service providers.
• Professional advisers, auditors, and legal representatives.
• Delivery, logistics, and maintenance service providers.
• Relevant government or regulatory authorities when legally required.
• Other authorized service providers acting on behalf of Coraltec.
• Third parties receiving personal data must be subject to appropriate confidentiality, security, and data protection obligations.

Coraltec will not sell personal data to third parties.

7. Data Storage and Retention

Personal data shall be retained only for as long as reasonably necessary to fulfil the purposes for which it was collected, meet contractual requirements, and comply with applicable legal obligations.

Retention periods may vary depending on the type of information and the nature of the business relationship.

Examples include

• Customer and business records: retained according to contractual, operational, and applicable legal requirements.
• Employee records: retained according to employment, labour, and other applicable legal requirements.
• Recruitment records: retained for an appropriate period based on recruitment needs and applicable requirements.
• Financial and accounting records: retained in accordance with applicable financial and legal requirements.
• Technical support records: retained for the period necessary to manage services, warranties, and support obligations.

When personal data is no longer required, it shall be securely deleted, destroyed, or anonymized, subject to applicable legal retention requirements.

8. Information Security and Confidentiality

Coraltec is committed to implementing appropriate technical and organizational measures to protect personal information.

These measures may include

• Restricting access to personal data based on job responsibilities.
• Using passwords and appropriate authentication controls.
• Maintaining appropriate network and system security.
• Protecting electronic and physical records.
• Maintaining confidentiality obligations for employees and authorized third parties.
• Providing relevant employee awareness and training.
• Reviewing access rights periodically
• Maintaining appropriate backup and recovery procedures.
• Responding to suspected data breaches and security incidents.

All employees must handle personal information responsibly and report suspected unauthorized access, disclosure, loss, or misuse immediately to their designated manager or the responsible company department.

9. Employee Privacy and Responsibilities

Employees are required to protect all personal and confidential information they access during their employment.

Employees must

• Access personal information only when required for authorized work purposes.
• Maintain the confidentiality of customer, employee, and supplier information.
• Never share passwords or unauthorized system access.
• Avoid transferring company or personal data to unauthorized devices or platforms.
• Avoid disclosing personal information to unauthorized individuals.
• Secure documents and electronic records against unauthorized access.
• Report suspected privacy violations or data security incidents.
• Follow company IT, information security, and data handling procedures.

Employees must not use personal data for personal purposes or disclose it without appropriate authorization.

These responsibilities continue after the termination of employment, to the extent permitted by applicable law and contractual obligations.

10. Employee Personal Information

Coraltec may process employee personal data for purposes related to:

• Recruitment and selection.
• Employment administration.
• Salary and payroll management.
• Attendance and leave administration.
• Performance management.
• Training and professional development.
• Workplace safety and security.
• IT system administration.
• Legal and regulatory compliance.

Employee personal information shall be accessible only to authorized personnel who require such information to perform their responsibilities.

Where employee monitoring or access to workplace communications is necessary, it must be conducted transparently, proportionately, and in accordance with applicable law and company procedures.

11. Customer and Website Privacy

Individuals visiting Coraltec's website or contacting the company through its digital channels may voluntarily provide personal information.

This information may be used to

• Respond to inquiries and requests.
• Provide product and service information.
• Prepare quotations and proposals.
• Arrange consultations and technical assistance.
• Follow up on customer requests.
• Maintain business communication records.
• Coraltec shall take reasonable measures to protect information submitted through its website and other communication channels.

Cookies and similar technologies, if used, should be explained in an appropriate cookie notice, including their purposes and available user controls.

12. International Data Transfers

Where personal data is transferred, accessed, or stored outside Jordan, Coraltec shall ensure that the transfer complies with applicable Jordanian data protection legislation and any relevant regulatory requirements.

Appropriate safeguards and contractual arrangements shall be implemented where required.

13. Personal Data Subject Rights

Subject to applicable legislation, individuals may have rights regarding their personal data, including:

• The right to be informed about the processing of their personal data.
• The right to access their personal data.
• The right to request correction or updating of inaccurate information.
• The right to request deletion or anonymization where legally applicable.
• The right to withdraw consent where processing is based on consent.
• The right to object to certain processing activities.
• The right to request restriction of processing where applicable.
• The right to request data portability where legally applicable.
• The right to submit complaints through the appropriate channels.

Requests should be submitted through Coraltec's designated privacy contact.

Coraltec will review and respond to requests in accordance with applicable legal requirements and timelines

14. Data Protection Responsibilities

The responsibility for implementing this policy is shared across the organization.

Management

• Approves and supports the implementation of this policy.
• Ensures appropriate resources are allocated for privacy and data protection.

Human Resources

• Maintains employee and recruitment records securely.
• Ensures employee information is accessed only by authorized personnel.

IT Department / IT Service Provider

• Implements appropriate technical security controls.
• Maintains system access and security measures.
• Supports incident detection and response.

Sales and Customer Service

• Handles customer information responsibly.
• Uses customer information only for authorized business purposes.

All Employees

• Follow this policy and related company procedures.
• Protect confidential and personal information.
• Report suspected privacy incidents.

15. Data Breach and Incident Management

Any suspected or confirmed incident involving unauthorized access, disclosure, alteration, loss, or destruction of personal data must be reported immediately to the designated responsible person or department.

Coraltec shall

• Assess the nature and scope of the incident.
• Take reasonable steps to contain and mitigate its impact.
• Investigate the cause of the incident.
• Maintain appropriate incident records.
• Notify affected individuals and relevant authorities when required by applicable law.
• Implement corrective and preventive measures.

16. Third-Party Service Providers

External service providers who process personal data on behalf of Coraltec must comply with applicable contractual and data protection requirements.

Coraltec shall take reasonable steps to ensure that service providers implement appropriate confidentiality and security measures.

17. Policy Compliance and Violations

All employees, departments, and authorized third parties are expected to comply with this policy.

Failure to comply may result in corrective action, disciplinary measures, contractual consequences, or other appropriate action in accordance with company procedures and applicable legislation.

18. Policy Review and Updates

This policy shall be reviewed periodically and whenever significant changes occur in:

• Applicable legislation and regulations.
• Company business activities.
• Data processing operations.
• Technology and information systems.
• Organizational responsibilities.

Any revisions must be approved by authorized company management and communicated to relevant employees and stakeholders.

19. Approval and Acknowledgment

This policy becomes effective upon approval by authorized Coraltec management.

All employees and relevant departments are responsible for understanding and complying with the requirements outlined in this policy.