Privacy Policy

Last updated: 28 October 2026

This policy explains how HEVA Fashion (“HEVA”, “we”, “us”) collects, uses, shares and protects personal data when you use the HEVA Fashion mobile apps and website (the “Service”). HEVA Fashion is an online fashion marketplace in the Kurdistan Region of Iraq where customers buy products from independent sellers, and orders are delivered by delivery drivers.

1. Data we collect

Customers

• Account details: full name, phone number, email address (optional), city, preferred language, and your password (stored only in hashed form, never in plain text).
• Delivery addresses: street, area, building and landmark details, and — if you place a pin on the map — the precise location (latitude/longitude) of your delivery point. We only collect location when you choose a pin; we do not track your location in the background.
• Purchase history: orders, items, prices, payment method and status, delivery status, returns, refunds, reward points and coupons.
• Content you submit: product reviews and ratings, return requests (reason and photos), and messages to support.
• Device and security data: push-notification token, device platform, IP address and app/browser information recorded at sign-in, used to secure your account and detect misuse.

Sellers — in addition to the above: shop name, logo and images, shop address and optional map location, product listings, sales and settlement records, and identity documents (and an optional business licence) provided to verify the shop owner.

Delivery drivers — name, phone number, vehicle details (type, make, model, colour, plate), availability status, and delivery records.

HEVA Driver collects the driver's location only while the app is open and in use:

• While online: when the driver is online with the app open, the app sends an approximate location to our servers about every 5 minutes, to keep the driver's online status active.
• During active deliveries: the app sends the driver's precise (GPS) location, so customers and sellers can track the delivery.

Location is never collected in the background (when the app is closed or not in use). A push notification token is also used to send notifications.

We do not collect contacts, photos (other than images you choose to upload), microphone data, or background location. We do not sell personal data.

2. Why we use it

• To create and secure your account and verify your phone number or email with one-time codes.
• To process orders, arrange delivery, collect cash-on-delivery payments, and handle returns and refunds.
• To send you order updates and account messages by push notification, WhatsApp or email. Marketing messages are sent only if you opt in, and you can turn them off in the app.
• To run reward points and coupons.
• To verify sellers and pay them their earnings.
• To prevent fraud and abuse, provide customer support, and keep accounting and tax records.

3. Who we share it with

During an active delivery, a driver's live GPS location is visible to the customer and the seller for that order, so they can track the delivery. It is not shared with any other third party.

لە کاتی گەیاندنی چالاکدا، شوێنی زیندووی GPS ـی شۆفێر بۆ ئەو کڕیار و فرۆشیارەی پەیوەست بە داواکارییەکە دیارە، تاکو گەیاندنەکە بەدواداچوون بکەن. لەگەڵ هیچ لایەنێکی سێیەمی تر هاوبەش ناکرێت.

The approximate location HEVA Driver sends while a driver is online is used only inside HEVA, to keep the driver's online status and to match delivery offers in their city. It is never shown to customers or sellers.

ئەو شوێنە نزیکەییەی ئەپی HEVA Driver لە کاتی ئۆنلاین بوونی شۆفێردا دەینێرێت، تەنها لەناو HEVA بەکاردێت، بۆ ئەوەی دۆخی ئۆنلاینی شۆفێر چالاک بمێنێتەوە و داواکارییەکانی گەیاندن لە شارەکەی خۆیدا بۆی بگونجێنرێن. هەرگیز بە کڕیار یان فرۆشیار پیشان نادرێت.

Reviews you post are public in the app, together with your name.

4. How we store and protect data

• Data is stored on our servers and is reachable only over encrypted connections (HTTPS/TLS).
• Passwords are hashed. Sign-in sessions use short-lived tokens. Accounts are locked temporarily after repeated failed sign-in attempts.
• Access inside HEVA is limited to staff who need it to run the Service.
• Backups are kept on a rolling basis and older backups are deleted automatically.

No system is perfectly secure, but we work to protect your data and will notify affected users of a serious breach where required.

5. How long we keep it

• Account and profile data: while your account is active. When you delete your account, it is removed immediately (see section 6).
• Order and payment records: kept for 5 years for accounting, tax and dispute purposes. After account deletion they no longer contain your name or contact details.
• Sign-in history: deleted when you delete your account.
• Backups: deleted data disappears from our backups within about 30 days, as old backups expire.

6. Deleting your account and data

You can delete your account at any time:

• In the app: Profile → Delete account.
• Without the app: follow the steps at heva-fashion.com/delete-account.

When your account is deleted, we remove your name, phone number, email, password, saved addresses and map pins, notifications, devices and sign-in history. Your street, house and pin are also removed from past orders; only the city and area remain. Past orders, payments and refunds stay in our accounting records without your name or contact details. Reviews you wrote stay visible as “Deleted user”. Unused reward points and coupons are forfeited. Deletion cannot be undone.

For a seller or driver account, contact us to delete it. We may need to keep shop settlement and tax records as the law requires.

7. Your rights

You can view and update most of your data in the app. You can also ask us for a copy of your data, to correct it, to delete it, or to stop marketing messages. Contact info@heva-fashion.com. We reply within 30 days.

8. Children

The Service is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has given us data, contact us and we will delete it.

9. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above, and we will notify you in the app if the changes are significant.