Privacy Policy

1. Overview

This Privacy Policy applies to MDM Express and its associated services, including the website at mdm.express, the seller dashboard at app.mdm.express, and all related mobile and web applications ("Platform").

We act as a data controller for information collected from sellers and platform users. For end customers whose orders are processed through our system, we act as a data processor on behalf of the seller.

2. Data We Collect

2.1 Information You Provide

• Account data: Name, email address, phone number, business name, and password when you register
• Business data: Trade registration details, bank account information, and tax identification numbers for remittance purposes
• Product data: Product listings, pricing, descriptions, and images you upload
• Order data: Customer names, phone numbers, delivery addresses, and order details for orders placed through your store
• Communications: Messages, support tickets, and any correspondence with our team

2.2 Information We Collect Automatically

• Usage data: Pages visited, features used, session duration, and click patterns
• Device data: IP address, browser type, operating system, and device identifiers
• Performance data: Order volumes, confirmation rates, delivery rates, and return ratios used to calculate your platform performance score
• Cookies: See our Cookie Policy for full details

2.3 Information from Third Parties

• Store integration data from connected platforms (e.g., Shopify, WooCommerce)
• Delivery status updates from our logistics partners
• Payment confirmation data from banking and transfer partners

3. How We Use Your Data

4. Sharing Your Data

We do not sell your personal data. We share data only in the following circumstances:

• Delivery partners: Customer name, phone, and address are shared with our logistics partners to fulfil deliveries
• Suppliers: Order details are shared with sourcing partners where required to fulfil your purchase orders
• Banking partners: Account details are shared with payment processors to execute remittances
• Analytics providers: Aggregated and anonymised usage data may be shared with analytics tools
• Legal authorities: We may disclose data where required by law, court order, or regulatory authority
• Business transfers: In the event of a merger or acquisition, data may be transferred as part of the business assets, subject to equivalent privacy protections

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services. After account closure:

• Transaction and financial records are retained for 7 years to comply with legal obligations
• Account data is deleted or anonymised within 90 days of account closure
• Order data relating to end customers is retained for 2 years for dispute resolution purposes
• Call recordings made by our call centre are retained for 90 days

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request that we correct inaccurate or incomplete data
• Deletion: Request deletion of your personal data, subject to legal retention requirements
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interest
• Withdrawal of consent: Withdraw consent for marketing communications at any time

To exercise any of these rights, contact us at privacy@mdm.express. We will respond within 30 days.

7. Cookies

We use cookies and similar tracking technologies on our platform. For full details on the types of cookies we use and how to control them, please see our Cookie Policy.

8. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption of data in transit using TLS
• Encryption of sensitive data at rest
• Role-based access controls limiting internal data access
• Regular security audits and vulnerability assessments
• Secure payment processing through certified banking partners

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify you as required by law.

9. International Data Transfers

MDM Express operates across Libya, Iraq, Lebanon, UAE, and the United Kingdom. Your data may be processed and stored in countries outside your own. When transferring data internationally, we ensure appropriate safeguards are in place, including contractual protections with our service providers.

10. Children's Privacy

Our platform is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@mdm.express and we will take steps to delete such data.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or a notice on the platform. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the platform after changes take effect constitutes acceptance of the updated Policy.

12. Contact & Data Requests

For privacy-related enquiries, data access requests, or to report a concern:

• Email: privacy@mdm.express
• General support: support@mdm.express
• Address: Hay Al-Andalus, Tripoli, Libya