Privacy Policy

1. Data Controller

QurbanOps, operated by Smart Hub LLC, a New Mexico limited liability company (“we”, “our”, or the “Platform”), is the data controller for personal data processed through the QurbanOps platform. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws.

For all data protection inquiries, you may contact us at privacy@qurbanops.com.

2. Data We Collect

We collect and process the following categories of personal data:

• Identity data: Name, surname, phone number, and email address of donors and operators.
• Audio-visual data: Video recordings of the qurban (sacrifice) process.
• Communication data: Records of notifications sent via WhatsApp and SMS.
• Device and usage data: Browser type, IP address, and platform usage statistics.
• Location data: Operator field location (only when explicit consent is given).

3. Purposes of Processing

We process your personal data for the following purposes and legal bases:

• Service delivery (contractual necessity): Delivering qurban videos to donors via WhatsApp and SMS notifications.
• Platform operations (legitimate interest): Monitoring platform performance, error tracking, and service improvement.
• Legal compliance (legal obligation): Meeting regulatory and legal requirements.
• Support (legitimate interest): Providing technical support and resolving issues.

4. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• All data is hosted on EU-based servers through Supabase (EU region), ensuring data residency within the European Union.
• Data in transit is protected with TLS/SSL encryption. Data at rest is encrypted using AES-256.
• Video files are stored on Cloudflare R2 with signed URLs, preventing unauthorized access.
• Row Level Security (RLS) policies ensure strict access control at the database level.
• Error monitoring and security events are tracked via Sentry with PII scrubbing enabled.
• Regular security audits are conducted to identify and address vulnerabilities.

5. Third-Party Data Sharing

We share personal data with the following third-party service providers solely for the purposes described above:

• Supabase (EU): Database hosting, authentication, and real-time subscriptions. Data resides in EU data centers.
• Cloudflare R2: Video file storage with global CDN delivery and signed URL access.
• WhatsApp Business API: Sending video notification messages to donors.
• SMS providers: Sending SMS notifications as a fallback delivery channel.
• Sentry: Error tracking and performance monitoring (with PII scrubbing).

We do not sell, rent, or trade your personal data to third parties for marketing purposes. All sub-processors are bound by data processing agreements in compliance with GDPR Article 28.

6. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure:Request deletion of your personal data (“right to be forgotten”).
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at privacy@qurbanops.com. We will respond within 30 days as required by GDPR.

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Video recordings and associated donor data are retained for a maximum of 12 months after the qurban season, after which they are automatically deleted unless a longer retention period is required by law.

8. Cookies

The Platform uses only essential cookies required for authentication and session management. We do not use advertising or tracking cookies. No third-party analytics cookies are placed without your consent.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via the Platform or email. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

10. Contact

For any questions about this Privacy Policy, or to exercise your data protection rights, please contact:

You also have the right to lodge a complaint with your local data protection supervisory authority.