BitsOasis GbR, Luebecker Str. 13 F, 22087 Hamburg, Germany is the controller responsible for personal data processed through Syrian Express. Contact: bitsoasis@web.de.
1. Data we process
- Account and profile: email address, authentication identifier, preferred language, name in German and Arabic, father's name, phone number, address, account status, and sign-in-provider information.
- Shipment and recipient information: sender and recipient details, stations, parcel and envelope details, declared contents, quantities, weights, shipment references, tracking events, inspection results, specialist requests, offers, cancellation requests, and delivery or collection information.
- Payments and records: quotes, prices, payment references, transaction and provider identifiers, bank-transfer reports, PayPal status, invoices, refunds, credits, and legally required accounting records. We do not receive full PayPal or bank-card credentials.
- Support and safety: chat messages, selected photos, support requests, claims, moderation or access decisions, and audit records needed to handle a case.
- Device and technical data: push-notification token, platform, app/build version, security and network logs generated by providers, and diagnostic information you provide.
- Local app data: preferences, draft shipment data, saved recipients, cached configuration, and promotion-display state may be stored on your device.
2. Purposes and legal bases
- To create accounts, provide quotes, process bookings and payments, coordinate transport, show tracking, deliver support, and process deletion requests: performance of a contract or steps requested before a contract.
- To send operational email and push updates about an account, payment, shipment, or support conversation: performance of the service and our legitimate interest in reliable customer communication.
- To inspect shipments, prevent fraud, secure the service, enforce policies, maintain audit evidence, and establish or defend claims: legitimate interests and, where applicable, legal obligations.
- To meet accounting, tax, customs, sanctions, transport, consumer, and authority requirements: legal obligations.
- Where we specifically ask for optional consent, you may withdraw it at any time without affecting earlier lawful processing.
3. Who receives data
Information is available to authorized Syrian Express staff and, as necessary, origin-centre staff, carriers, customs or transport intermediaries, Syrian collection partners, the named recipient, and professional advisers. Access is limited according to role and operational need.
We use providers including Google Firebase for authentication, database, server functions, storage, hosting, and push notifications; Apple and Google for app distribution and device services; Google for optional Google sign-in; PayPal for PayPal payments; banks for transfers and refunds; and email-delivery providers for transactional messages. Those providers process data under their own terms and applicable data-protection commitments.
We may disclose information to public authorities, customs, law enforcement, courts, insurers, or advisers where legally required or reasonably necessary to address safety, fraud, prohibited cargo, or legal claims.
4. International transfers
A shipment to Syria necessarily requires operational shipment and recipient information to be available to relevant partners outside the European Economic Area. Technology and payment providers may also process data outside Germany or the EEA. Where required, transfers rely on an adequacy decision, contractual safeguards, a statutory exception necessary to perform the requested contract, or another lawful mechanism. Contact us for information about applicable safeguards.
5. Retention
We keep account and service data while your account is active and while needed to perform a shipment or support request. Drafts and caches may remain on your device until removed by you or the app. Operational records are reviewed and removed or anonymized when no longer needed.
After account deletion, we remove or anonymize data that is no longer required. Shipment, payment, invoice, tax, customs, fraud, safety, audit, and claims records may remain for applicable statutory or limitation periods. Data connected to an active shipment may remain until fulfillment and related obligations are complete. Providers may retain their own transaction or security records under their policies.
6. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, or portability; object to processing based on legitimate interests; withdraw consent; and complain to a competent data-protection supervisory authority. We may need to verify your identity and may retain data where a legal exception applies.
You can update profile information in the app and delete your account under Settings. You can also follow the account-deletion instructions or email bitsoasis@web.de.
7. Notifications and permissions
With device permission, the app registers a push token and sends shipment and support updates in your selected language. You can change notification permission in device settings. Photos are accessed only when you choose images for a support conversation or another clearly identified feature.
8. Security
We use authentication, email verification, role-based access, database and storage rules, server-side validation, App Check, bounded support access, and audit records. No system is completely secure. Protect your account credentials and tell us promptly if you suspect unauthorized access.
9. Children
The service is not directed to children. A minor should not create an account or place a booking without the involvement and legal authority of a parent or guardian. Contact us if you believe a child supplied personal data without appropriate authorization.
10. Changes and contact
We may update this Policy and will provide notice where required. Privacy questions or rights requests: BitsOasis GbR, Luebecker Str. 13 F, 22087 Hamburg, Germany, bitsoasis@web.de.