Privacy Policy

Privacy at a Glance

1. Who We Are

Karaar Corporation operates Karaar Digital Address ("KDA") and related services, including KaraarConnect, KaraarFlow, websites, mobile applications, APIs, address-verification systems, and field-registration services.

Karaar Corporation is the Data Controller for the KDA and related processing activities described in this Privacy Policy.

Data Controller: Karaar Corporation

Privacy/Data Protection Contact: Mohamed Adow, Data Protection Officer (DPO)

Data Protection Officer: Mohamed Adow

Privacy Email: mohamed.abdulkadir@karaarcorp.com

Business Address: Degmada Waaberi

Website: https://karaarcorp.com/
Karaar processes personal information in accordance with Somalia's Data Protection Act No. 005 of 2023 and applicable regulations and guidance issued by the Somalia Data Protection Authority.

2. Scope of This Policy

This Privacy Policy applies when information is processed through KDA and associated Karaar services, including address creation and verification, KaraarConnect business discovery, KaraarFlow operational systems, KDA websites and applications, authorized APIs and integrations, field operations, customer support, and related digital services.

Separate or contextual privacy notices may be provided when a particular service requires additional information or different processing.

Our goal is simple: no hidden public exposure. If information is intended to be public, such as approved business information on KaraarConnect, the purpose is made clear. Residential information remains private by default.

3. Our Privacy Model

Karaar distinguishes between residential information, public business and institution information, and protected information.

4. Residential Address Privacy

Your home address is private

Karaar does not publicly display residential KDA addresses. Residential addresses are not made publicly searchable through KaraarConnect, public KDA directories, public APIs, or other public-facing Karaar services.

The existence of a verified KDA residential address does not make the residence public.

Precise residential location

KDA may collect precise geographic coordinates and entrance-location information to create and verify an address. Precise residential GPS coordinates and entrance locations are protected information and are not publicly disclosed merely because a KDA address exists.

Associated residential information

A resident's name, private telephone number, personal email, identification records, verification records, verification photographs, ownership or occupancy records, account information, and other protected information are not publicly displayed.

5. Resident-Controlled Sharing

Privacy does not prevent a resident from using their address. A resident may choose to provide or securely share their KDA address with a family member, delivery company, healthcare provider, emergency service, business, trusted service provider, or another recipient.

Sharing an address with a particular recipient does not make that address publicly searchable.

6. Business and Institution Information

KDA serves as the authoritative verified address record. KaraarConnect serves as the public discovery layer for approved information relating to businesses and institutions.

A verified business or institution may therefore appear publicly on KaraarConnect.

Public information may include:

• business or institution name
• verified KDA address
• public map location
• category and subcategory
• business or institution description
• public business telephone number
• public business email
• operating hours
• website and approved social-media links
• approved logo and photographs
• products or services offered
• applicable verification indicators

7. Business Information That Remains Private

Public business discovery does not make confidential business information or personal information public.

Karaar protects information such as:

• private owner or authorized-representative contact information
• national identification, passport, or other identity information
• ownership documents and claim-verification documents
• internal verification evidence and internal verification photographs
• employee records
• financial, invoice, and private payment information
• security credentials and registered-device information
• internal QA records and internal notes
• administrative records, audit logs, and security information

A business owner's personal phone number or personal email is not automatically considered public merely because it was collected during registration. Where KaraarConnect displays contact information, it should be contact information designated for public business use.

8. Business Verification and Claiming

A business may have a verified physical KDA address before its owner or authorized representative has claimed the KaraarConnect profile.

Where appropriate, Karaar may display: KDA Address Verified - Unclaimed.

This means the physical address has been verified by KDA, but business ownership of the KaraarConnect profile has not yet been verified.

Following successful ownership verification, Karaar may display: Business Ownership Verified.

Address verification and ownership verification are separate processes. Claiming a KaraarConnect profile does not allow an owner to bypass KDA procedures for changing a verified physical address.

9. Public and Private Business Contact Information

Karaar distinguishes between private owner or representative contact information and public customer-facing business contact information.

A business owner's personal mobile number, email address, or messaging account is not automatically published simply because Karaar collected it during business registration.

Public business telephone numbers, WhatsApp numbers, email addresses, websites, or other contact channels are displayed only when designated or otherwise authorized for public business use.

10. Address and Geospatial Infrastructure

KDA may use nationwide geospatial reference systems, including addressable grid cells, to support addressing, routing, and location services.

A grid reference or geospatial cell is infrastructure data. When it is linked to an identifiable resident, household, or other personal record, Karaar treats the linked information in accordance with this Privacy Policy.

Residential privacy protections apply regardless of the underlying geospatial or grid technology used to generate or locate an address.

11. Information We Collect

Depending on the service, Karaar may process information in the following categories:

Address and location information

• KDA address
• region, district, sub-district, waax, or other approved geography
• precise geographic coordinates
• entrance, property, business, or institution location
• routing and geospatial reference information

Identity and contact information

• name
• telephone number
• email address
• authorized representative details

Verification information

• address-verification records
• ownership or authorization records
• photographs
• supporting documents where required

Business and institution information

• business or institution name
• category and subcategory
• operating hours
• public contacts
• description and services
• website and approved social links
• logo and approved images

Technical and security information

• IP address
• device and browser information
• authentication records
• security logs
• API logs
• cookies or similar technologies where used

Transaction and support information

• payment references
• invoice status
• support requests
• communications
• correction or update requests

Karaar applies data minimization and seeks to collect only information reasonably necessary for defined purposes.

12. How We Obtain Information

Information may be provided directly by an individual, resident, business, institution, authorized representative, or other user.

Information may also be collected through authorized Karaar field operations, applications, websites, location services, system activity, approved integrations, service providers, or other lawful sources.

Where personal information is obtained indirectly, Karaar applies the transparency requirements required by applicable law.

13. Why We Process Information

Karaar may process information to:

• create, verify, maintain, and protect digital addresses
• operate KDA and related services
• provide navigation and routing capabilities where authorized
• enable business and institution discovery through KaraarConnect
• verify business ownership claims
• maintain accurate geographic and address information
• communicate with users and provide support
• process authorized transactions and maintain relevant records
• prevent fraud, misuse, and unauthorized access
• secure Karaar systems and maintain service quality
• administer authorized APIs and integrations
• comply with legal obligations
• establish, exercise, or defend legal rights where appropriate

Karaar does not use personal information for purposes incompatible with the reason for which it was collected unless another lawful basis permits that processing.

14. Lawful Basis for Processing

Depending on the processing activity, Karaar may rely on consent, contract, legal obligation, public interest, legitimate interest, or another lawful basis permitted by applicable law.

Where Karaar relies on consent, the individual may withdraw that consent subject to applicable legal limitations.

15. We Do Not Sell Personal Information

Karaar does not sell personal information to advertisers, data brokers, marketers, or lead-generation businesses.

In particular, Karaar does not sell residential KDA addresses, precise residential GPS coordinates, private telephone numbers, identification records, or residential verification information.

Public business information appearing on KaraarConnect remains public information for the purposes described in this Policy and does not make protected information public.

16. When We Share Information

Karaar may provide limited personal information to authorized service providers and partners where necessary to operate, secure, or provide Karaar services. These may include technology, cloud infrastructure, communications, payment, professional-services, and authorized integration providers.

Access is limited to the information reasonably necessary for the authorized purpose and is subject to appropriate privacy, security, and contractual safeguards.

Karaar may also disclose personal information to regulators, courts, or other competent authorities where required by applicable law, necessary to protect legal rights, or in response to a valid lawful request. Any disclosure of protected residential information is limited to what is lawfully required or authorized.

17. KDA APIs and Integrations

KDA may provide authorized API access to selected partners and services. API access does not create unrestricted access to KDA records.

Access may be controlled through authentication, authorization, permissions, purpose limitation, data minimization, logging, contractual restrictions, monitoring, and other safeguards.

Public-facing APIs may return approved public business or institution information.

They do not expose protected residential records, identity documents, ownership-verification evidence, payment records, private contacts, employee information, internal QA records, security credentials, or other protected KDA information.

18. Security

Karaar uses technical, administrative, and organizational measures designed to protect personal information against unauthorized access, misuse, loss, alteration, disclosure, or destruction.

Karaar applies appropriate safeguards based on the sensitivity and risk of the information, including access controls, authentication, encryption, audit logging, backups and recovery, security monitoring, incident response, and privacy oversight.

For security reasons, Karaar does not publicly disclose technical information that could weaken the security of its systems.

19. Retention

Karaar does not retain personal information longer than necessary for the purpose for which it was collected, subject to legitimate operational, security, dispute-resolution, financial, regulatory, and legal requirements.

Different types of information may have different retention periods under Karaar's approved retention schedule.

When information is no longer required, Karaar may securely delete, anonymize, archive, or otherwise dispose of it in accordance with applicable requirements.

20. Your Data Protection Rights

Karaar uses automated processing in operating its digital-address services. Where applicable law provides rights relating to automated decision-making or other automated processing, those rights apply. Subject to applicable law, individuals may also exercise rights relating to:

• access to personal information
• correction of inaccurate information
• erasure where applicable
• restriction of processing
• data portability where applicable
• objection to processing
• protection relating to certain automated decisions

Karaar may verify the identity and authority of the person making a request before releasing or changing protected information.

Karaar will respond to valid requests within the period required by applicable law and regulation.

21. Correcting a KDA Address

Accuracy is fundamental to a verified address system.

A user may request correction of inaccurate personal information.

Changes affecting the physical location, entrance, classification, or other verified elements of a KDA address may require additional verification before Karaar updates the authoritative address record.

A business owner claiming a profile cannot independently alter verified KDA address data without the appropriate verification process.

22. Children and Minors

Where Karaar processes personal information relating to children or minors, additional protections will apply in accordance with applicable law.

Karaar does not make a child's residential address or associated residential personal information publicly discoverable.

Where parental, guardian, or other lawful authorization is required, Karaar will obtain it through the appropriate process.

23. Cookies and Online Technologies

Karaar websites and applications may use cookies, authentication tokens, system logs, analytics technologies, device identifiers, or similar technologies where needed for functionality, security, authentication, preferences, performance, diagnostics, and authorized analytics.

Karaar provides appropriate notice and consent controls where required.

24. International Processing and Transfers

Some approved technology providers or processing activities may involve the storage or processing of personal information outside Somalia.

Where personal information is transferred internationally, Karaar will use the safeguards and transfer mechanisms required by applicable law and Karaar's data-protection framework.

Cross-border processing does not change Karaar's obligations to protect personal information under this Policy.

25. Personal Data Breaches

Karaar maintains procedures for detecting, containing, investigating, documenting, remediating, and reporting personal-data incidents.

Where applicable law requires regulatory or individual notification, Karaar will notify the Somalia Data Protection Authority and affected individuals within the legally required timeframe.

26. Privacy Requests and Complaints

Individuals may contact Karaar to ask how their information is processed, request access, request correction or other applicable action, raise a privacy concern, exercise an applicable data-protection right, or report suspected misuse.

Karaar will investigate valid privacy complaints and provide a response or remedy in accordance with applicable requirements.

Individuals who believe their information has been processed unlawfully may also have the right to make a complaint to the Somalia Data Protection Authority.

Karaar Privacy & Data Protection

Data Protection Officer: Mohamed Adow

Email: mohamed.abdulkadir@karaarcorp.com

Telephone: +252 61 8111192
Address: Degmada Waaberi
Website: https://karaarcorp.com/

27. Changes to This Policy

Karaar may update this Privacy Policy when its services, technology, processing activities, legal obligations, or regulatory requirements change.

Where a change materially affects how personal information is processed, Karaar will provide appropriate notice.

The current version number and effective date will appear at the beginning of this Policy.

28. Our Privacy Commitment

Regulatory Framework

This Policy is intended to align with the Somalia Data Protection Act No. 005 of 2023, applicable implementing regulations, and relevant guidance issued by the Somalia Data Protection Authority. Karaar maintains internal privacy, security, retention, incident-response, governance, and data-protection controls to support the commitments in this Policy.