Privacy Policy
Last updated: 25 July 2026
1. Who we are
This application (“Cazahub”, formerly “Operations Hub”, the “App”) is operated by Cazasouq Trading W.L.L, a company registered in the Kingdom of Bahrain (“we”, “us”, “our”). We are the data controller responsible for the personal data processed through the App.
The App is an internal workforce and business-operations platform provided to our employees and authorised personnel. It is not intended for use by the general public.
2. Legal framework
We process personal data in accordance with the Personal Data Protection Law of the Kingdom of Bahrain (Law No. 30 of 2018) (the “PDPL”) and its implementing regulations, together with any other applicable laws.
3. Personal data we collect
Depending on your role, we may process the following categories of personal data:
- Account & contact data — name, work email address, phone number, job title, department and branch.
- Authentication data — login credentials and session information used to secure your account.
- Identifiers — your user/employee ID and a device push-notification token.
- Employment & HR data — attendance, leave, payroll, requests, appraisals and related records, where applicable to your role.
- Content you provide — photos, documents, attachments, notes and information you enter into forms.
- Technical & diagnostic data — app version, device type and error/diagnostic logs used to keep the App reliable.
- Social media data — where one of our own business accounts is connected, the data described in section 7.
4. How we use your data
We use personal data to:
- authenticate you and secure access to the App;
- operate workforce, HR, finance and operational functions;
- send you relevant notifications (including push notifications);
- read and respond to comments left on our own social media posts;
- maintain records required for our legitimate business and legal obligations;
- detect, prevent and troubleshoot technical and security issues.
We do not use your personal data for advertising, and we do not sell it or share it with data brokers. Your data is not used to track you across other apps or websites.
5. Legal basis for processing
We rely on one or more of the following bases under the PDPL:
- the performance of, and management of, your employment relationship with us;
- compliance with our legal and regulatory obligations;
- our legitimate interests in operating and securing our business; and
- your consent, where required.
6. Service providers & disclosure
We use trusted service providers who process personal data on our behalf and under our instructions:
- Supabase — secure database, authentication and file storage hosting.
- Google Firebase Cloud Messaging — delivery of push notifications only.
We may also disclose personal data where required by law, regulation, court order, or a competent authority in the Kingdom of Bahrain.
7. Connected social media accounts
Cazahub includes a tool that lets our team read and reply to comments left on our own business accounts on Instagram, YouTube and TikTok, in one place instead of in each platform’s own app.
How an account is connected
An account is connected only by its owner signing in through the platform’s own login screen and granting permission there. We never ask for, receive or store social media passwords. Permission can be withdrawn at any time from the platform’s own “Apps and websites” settings, or by contacting us; access stops immediately.
What we receive and store
- The connected account — its identifier on the platform, username or display name, account type, and profile picture.
- Posts published on that account — identifier, caption, media type, image or video, thumbnail, permalink and publication time.
- Comments left on those posts — the comment text, the time it was left, the public username of the person who left it, and its like count.
- Replies our team sends — the reply text and when it was sent.
Why we hold it
Solely so our team can see comments on our own posts in one place, reply to them, and measure how quickly we respond. Replies are published back to the platform under the connected account. Draft replies may be suggested automatically, but a member of our team reviews and approves every reply before it is sent.
What we do not do
We do not use social media data for advertising, profiling or automated decision-making. We do not sell it or share it with third parties. We do not collect private messages, follower lists, email addresses or contact details. We do not build profiles of the people who comment, and we do not combine social media data with our employee records.
Disconnection and deletion
When access is revoked — whether from the platform’s own settings or by asking us — we immediately delete the stored access credentials and stop retrieving anything further. Comments already received are kept as ordinary business records of customer correspondence, in the same way an email from a customer would be, and are deleted on request.
To request deletion, visit cazahub.com/data-deletion or email info@cazasouq.com. We confirm once the request has been carried out, and in any event within 30 days.
8. International transfers
Some of our service providers process data on servers located outside the Kingdom of Bahrain. Where personal data is transferred abroad, we take steps to ensure it is protected in accordance with the PDPL, including appropriate safeguards and, where required, the necessary approvals or your consent.
9. Data retention
We retain personal data for as long as necessary to fulfil the purposes described in this policy and to meet our legal, accounting and record-keeping obligations. When data is no longer required, it is securely deleted or anonymised.
10. Security
We apply appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS/TLS), access controls, role-based permissions and, on supported devices, optional biometric app locking. Access credentials for connected social media accounts are held server-side only and are not readable by App users. No system is completely secure, but we work to safeguard your data.
11. Your rights
Subject to the PDPL, you have the right to:
- be informed about how your personal data is processed;
- access the personal data we hold about you;
- request correction of inaccurate or incomplete data;
- request deletion or blocking of your data in certain circumstances;
- object to or request restriction of certain processing; and
- withdraw consent where processing is based on consent.
To exercise these rights, contact us using the details below. You also have the right to lodge a complaint with the competent data protection authority in the Kingdom of Bahrain.
12. Children
The App is intended for our employees and authorised personnel and is not directed to children. We do not knowingly collect personal data from children.
13. Changes to this policy
We may update this policy from time to time. Material changes will be communicated through the App or by other appropriate means, and the “Last updated” date above will be revised.
14. Contact us
For any questions or to exercise your rights, please contact:
Cazasouq Trading W.L.L
Kingdom of Bahrain
Email: info@cazasouq.com