English
Dutch
Japanese
Korean
Chinese
Last updated on: [Publication Date] Start date of the event: [Event Date] Version number: 1.0
1. Introduction and Scope of Application
تُوضّح هذه السياسة كيف تقوم شركة هلا شام السياحية (“هلا شام”، “الشركة”، “نحن”) — وهي شركة مسجّلة رسمياً في الجمهورية العربية السورية — بجمع بياناتك الشخصية ومعالجتها وتخزينها وحمايتها ومشاركتها، وذلك عند استخدامك:
- Website halacham.com Any affiliated branches thereof;
- Booking forms, inquiries, and price quote requests;
- Our pages and accounts on social media platforms within the limits we control;
- Our communications via email, phone, or messaging applications;
- أي خدمة أو نشرة بريدية أو فعالية أو استبيان نقدّمه (يُشار إليها مجتمعةً بـ”الخدمات”).
Geographical scope. Since our services target visitors from within Syria, Turkey, and EU member states and the European economic area, this policy has been formulated to meet the requirements of three legal frameworks at once:
| The framework | Reference |
|---|---|
| Syria | Law No. 12 of 2024 regarding the protection of personal electronic data on the network, and the executive instructions issued by the decision of the Council of Ministers No. 29 M. |
| Turkey | Law No. 6698 on the Protection of Personal Data (KVKK), as amended by Law No. 7499 (Official Gazette March 12, 2024, Issue 32487, and the amendments effective on July 1, 2024), and the regulation on the transfer of data abroad (July 10, 2024, Issue 32598) |
| European Union | Regulation (EU) 2016/679 (GDPR), and Directive 2002/58/EC (ePrivacy) regarding marketing communications and related files |
In case of conflicting standards, we apply Highest Standard of Protection For the data owner, without prejudice to any legal obligations under Syrian law as the main company law.
Important Note: Your use of the services means you are aware of this policy. Since the processing relies on your consent, we request this consent in a clear and explicit manner and prior to any withdrawal at any time.
2. Definitions
- Personal Data: Any information related to a specific natural person or identifiable, either directly or indirectly.
- Processing: Any operation performed on personal data, such as collection, registration, organization, structuring, alteration, retrieval, use, disclosure, transfer, erasure, or destruction.
- Data Controller: The entity that determines the purposes and means of processing — here it is Hala Cham.
- Data Processor: The entity that processes data on behalf of the controller and according to its instructions (such as hosting provider or email platform).
- Data Subject: The natural person to whom the data relates — that is you.
- Sensitive Data / Special Categories: Data related to health, religious or philosophical beliefs, racial or ethnic origin, political opinions, trade union membership, sexual orientation, biometric and genetic data, or criminal record.
- Breach: Any unlawful access to personal data or its copies, or its transmission, transfer, alteration, or deletion in an unlawful manner.
3. Identity of the Controller and Contact Details
| Item | Details |
|---|---|
| Data Controller | Hala Cham Trading Company |
| Commercial Registration | — Syrian Arab Republic |
| Registered Address | Damascus, Kafrsousa |
| Website | https://halacham.com |
| Email designated for legal matters and privacy requests | legal@halacham.com |
| Data Protection Officer | Administration — legal@halacham.com |
| Representative in the European Union (Article 27 of GDPR) | شركة سكاي أثينا – بودابست هنغاريا |
| Representative in Turkey and VERBIS | Karala Limited |
All requests for exercising rights and complaints should be sent to legal@halacham.comand should preferably include the request: full name, email address used to contact us, description of the request, and any identity verification when necessary.
4. Personal data we collect
4.1 Data you provide directly
| Category | Examples |
|---|---|
| Identity data | First name and last name, title, gender, date of birth if required |
| Contact data | Email address, phone number/WhatsApp, country of residence, address |
| Booking and travel data | Dates of stay, city and destination, number of travelers and their ages, room type, reserved activities, meal preferences, special requests |
| Travel documents and certificates | Passport number and its validity date — only when required by the hotel or the destination or the law |
| Payment Information | Payment method, last four digits, cardholder name, billing address. We do not store full card numbers or CVV codes. — Processing is done directly through the payment gateway. |
| Messages | Your messages and contact templates and support logs |
| User-generated content | Reviews, comments, images you upload |
| Marketing data | Your subscription preferences, consents, and withdrawals |
4.2 Data collected automatically
IP address (may be partially anonymized), browser type and device, operating system, device language, pages visited and duration of visit, referral source, identifiers for linking files, server logs and errors, and approximate location data inferred from IP address (at the city/country level, not the exact location).
4.3 Data from other sources
- From Service providers (Hotels, tour organizers) when confirming or modifying your booking;
- From Payment gateways Regarding the operational status;
- From Communication and advertising platforms Within the limits allowed by your settings;
- From A third party books on your behalf — In this case, that person confirms that they have obtained your consent and informed you of this policy.
4.4 Sensitive data
We do not request sensitive data such as general health information. Except that you may disclose information of a health or dietary nature (such as dietary restrictions or the need for accessible rooms). In this case, we will handle it. Building on your explicit consent only, and for the purpose of fulfilling your request exclusively, we will share it with the service provider only to the extent necessary, and we will delete it once the purpose is fulfilled.
Please refrain from sending any unnecessary sensitive data via email or website forms.
5. Treatment purposes and legal bases
| # | Purpose | Data categories | Legal basis — GDPR | Legal basis — KVKK (Turkey) | Legal basis — Syrian Law 12/2024 |
|---|---|---|---|---|---|
| 1 | Execution of the reservation and its management and communication regarding it | Identity, communication, reservation, payment | M.6(1)(b) Execution of the contract | M.5(2)(c) Necessity related to the contract | Necessity to execute the specific stated purpose |
| 2 | Response to your inquiries and requests for proposals | Identity, communication, correspondence | M.6(1)(b) and (w) | M.5(2)(c) and (w) | Consent / execution of the order |
| 3 | Issuance of invoices and accounting and tax obligations | Identity, payment, reservation | M.6(1)(c) Legal obligation | M.5(2)(a) Explicit legal text | Legal obligation |
| 4 | Site improvement and usage analysis | Preliminary data, cookies analysis | M.6(1)(a) Consent (for non-essential cookies) | M.5(1) Explicit consent | Consent |
| 5 | Direct marketing and email newsletter | Communication, marketing preferences | M.6(1)(a) Consent | Explicit consent + Law 6563 and IYS Regulation | Consent + Electronic marketing license |
| 6 | Data security and fraud prevention | Preliminary data, records | M.6(1)(w) Projected consent | M.5(2)(w) Projected consent | Data safety protection |
| 7 | Management of evaluations and published content | Generated content, designated name | M.6(1)(a) and (w) | Consent / Projected consent | Consent |
| 8 | Defense of rights before the judiciary and compliance with official requests | As per the situation | M.6(1)(j) and (w) | M.5(2)(h) and (w) | The circumstances specified by our law |
Regarding the projected consent: Where we relied on this basis, we may have conducted a balance between our interests and your fundamental rights and freedoms, and you have the right to request a summary of this balance through legal@halacham.com.
6. Files defining cookies and similar technologies
| Type | Position | Basic | Sample Size |
|---|---|---|---|
| Technical Requirement | Site functionality, security, save your choice in the cookie banner | Technical Requirement — No consent required | Session up to 12 months |
| Preferences | Save Language and Currency | Agreement | Up to 12 months |
| Analytical | Visitor Measurement and Tracking Behavior | Prior Approval | Up to 24 months |
| Marketing/Advertising | Ad Allocation and Impact Measurement | Prior Approval | Up to 13 months |
Consent mechanism. Do not enable any non-essential cookies before obtaining your consent via the Consent Banner, and it must be Reject all In the same ease Accept AllYou can change your selection at any time from [Cookie Settings Link]and you can also delete cookies from your browser settings.
7. With whom we share your data
We do not sell your personal data or rent it out. We only share it within the necessary limits:
- Service Providers (hotels, vacation rentals, tour operators, transportation companies) — to the extent necessary to fulfill your booking. Please note that they operate as independent controllers with your data after it has been provided to them, and their processing is subject to their own privacy policies.
- Payment gateways and service providers — for processing financial transactions and preventing fraud.
- Technical infrastructure providers — hosting, backup, network security, content management.
- Communication and marketing tool providers — email platforms, messaging services, and customer management systems.
- Analytics providers — after obtaining your consent.
- Qualified consultants — accountants, auditors, and legal advisors, under strict confidentiality obligations.
- Official and judicial authorities — when there is a legal obligation or a legitimate request, and after verifying the validity of the request and its scope.
- In the event of a merger, acquisition, or sale of assets — with your prior notice and ensuring the same level of protection remains in place.
We cooperate with each processor Data Processing Agreement (DPA) The commitments include strict security and privacy measures and a promise not to process for other purposes.
List of updated secondary processors available upon request via legal@halacham.com.
8. International transport for the statements
By the nature of our work (a company in Syria, and services and products may be in Turkey or the European Union or elsewhere), your data may be transferred across borders. We adhere to the following:
Under GDPR (Articles 44–49): No data from the European Union/the European Economic Area may be transferred to a third country unless: a decision of adequacy from the European Commission; or the Standard Contractual Clauses (SCCs) issued by Regulation (EU) 2021/914 concerningthe Transfer Impact Assessment (TIA) Additional processing may be required upon request (such as clarification and data minimization); or one of the narrow exceptions in Article 49 (such as your explicit consent, or the necessity of executing a contract for your benefit).
In accordance with KVKK (Article 9 amended): Data is transferred abroad through three successive layers: Sufficiency decision Issued by the Turkish Personal Data Protection Board; or appropriate safeguards most notably the Standard Contractual Clauses issued by the Council and which must be notified to the authority within five working days from its signingThe mandatory rules for partnerships, or a written commitment approved by the council; or the specified exceptions. The explicit approval will no longer be a general means of transport after 1 August/September 2024.
According to Syrian Law 12/2024: Do not transfer your data to others without informing you, and commit to obtaining the necessary license or permit from the relevant authority to handle personal data, and apply the established technical and organizational standards, and appoint a representative within Syria for any controller located outside it.
To request a copy of the established transport guarantees, contact us at legal@halacham.com.
9. Preservation period
We retain data only for the necessary duration to achieve the purpose, after which we either delete it or anonymize it in a way that does not allow for identifying its owner.
| Type of Data | Retention Period |
|---|---|
| Processed Booking Data | [x] Years from the service end date, in accordance with the legal retention period |
| Accounting records and invoices | The period mandated by Syrian tax and commercial law — [x] years |
| Inquiries not converted to bookings | 12 months from last contact |
| Subscription data for the newsletter | Until the consent is withdrawn, only the withdrawal record will be retained for proof of consent |
| Employee and security records | 6–12 months |
| Cookie data | As per the schedule in item 6 |
| Legal communications and disputes | Until the legal retention period for the claim expires or a final judgment is issued |
Mandatory principle under Syrian law: Data must be deleted immediately after the specific purpose has been fulfilled; if retention continues for a legitimate reason, it must not remain in a form that allows identification of the data subject.
10. Data Security
We implement appropriate technical and organizational measures to protect against risks, including:
- Encryption of data transmission via HTTPS/TLS, and encryption of sensitive data during storage;
- Setting permissions based on the principle the minimum necessary for identification; and the principle of need-to-know;
- Dual authorization on administrative accounts;
- Periodic backup and recovery selection;
- Training of employees and their commitment to confidentiality obligations;
- Incident response policy and internal log for breaches;
- Regular review for practitioners and their compliance.
However, we cannot guarantee the absolute security of any transmission over the internet, and we commit to informing you of any incident that affects your rights as outlined in Section 13.
11. Your Rights
11.1 If you are in the European Union/European Economic Area (GDPR)
الوصول (م.15) • التصحيح (م.16) • المحو/”الحق في النسيان” (م.17) • تقييد المعالجة (م.18) • قابلية النقل (م.20) • الاعتراض على المعالجة القائمة على المصلحة المشروعة وعلى التسويق المباشر (م.21) • عدم الخضوع لقرار آلي بحت له أثر قانوني (م.22) • سحب الموافقة في أي وقت دون أثر رجعي • تقديم شكوى إلى سلطة الرقابة في بلد إقامتك أو عملك.
Response time: One month, subject to extension for an additional two months for confirmed requests with your consent. The service is free. The request cannot be repeated or excessively clear.
11.2 If you are in Turkey (KVKK — Article 11)
Identify whether your data is being processed • Request information about the processing • Identify the purpose and ensure its use is compliant • Identify the third parties to whom it has been transferred within and outside Turkey • Request correction and deletion or objection • Request information from third parties regarding correction/deletion • Object to the result of automated analysis that harms you • Request compensation for damages resulting from unlawful processing.
the following: You can submit the request to us in writing or through the channels specified by the council, and we will respond within 30 days at the latest.If the request is rejected or not responded to, you may file a complaint with the Personal Data Protection Board (KVKK) Within 30 days from the date of knowledge of the order, and in all cases within 60 days from the date of order submission.
Electronic commercial messages Subject to Law No. 6563 and regulations IYS, and you can cancel your subscription for free at any time.
11.3 If you are in Syria (Law 12/2024)
The law grants you the right to access, correct, delete your data, withdraw consent, object, and file a complaint. Each controller or processor must respond to the request withinseven (7) business days from the date you submit it.You may also file a complaint with the authority responsible for personal data protection. In cases of violation of your rights or the prevention of your access to our services, you can appeal the decision of the person responsible for data protection.
11.4 How to exercise your rights
Send your request to legal@halacham.com Note: The required right, your identification details, and the time frame if available. We may request reasonable proof of identity to protect your account from fraudulent requests. If you submitted the request through an agent, please authorize the agent's actions.
12. Direct Marketing
- We will not send marketing messages without prior explicit consent, or under the narrow exemption for existing customers regarding similar services where local law permits.
- Each message contains a link Unsubscribe Effective and free of charge.
- Regarding the participants in Turkey, approvals and cancellations are managed through Message Management System (İYS) In accordance with Law 6563.
- Regarding the treatment within Syria, it is subject to electronic marketing the licensing system stipulated in Law 12/2024.
- Withdrawing your consent does not affect the validity of previous processing activities, nor does it prevent us from sending service messages necessary (such as booking confirmation or changes to the schedule).
13. Data breach notifications
in the event of a breach affecting your personal data:
- Under GDPR: We will notify the relevant supervisory authority within 72 hours From our informed perspective, what has not been clearly indicated may pose a risk to your rights; we advise you accordingly. Without unjustified delay. If the breach involves a significant risk.
- In accordance with KVKK: We advise the Turkish Personal Data Protection Board. In the nearest time and within 72 hours, we will notify the data owner at the earliest possible opportunity.
- According to Syrian Law 12/2024: We commit to informing the authority of any breach of our personal data.
The notification includes — to the extent possible — the nature of the breach and the affected data categories, the approximate number, potential impacts, and the measures taken and contact point.
14. Children's Privacy
Our services are directed towards adults. We do not collect information from children under 16 years old (or the lower age limit defined by the member state in the European Union, which may be up to 13 years old) without consent from a parent or guardian. We only collect children's information that is necessary for processing the booking, limited to the name and age required. If you provide us with a child's information without the necessary legal basis, we will delete it promptly. 16 years old (or the lower age limit defined by the member state in the European Union, which may be up to 13 years old) without parental consent. We only collect children's information that is necessary for processing the booking, limited to the name and age required. If you provide us with a child's information without the necessary legal basis, we will delete it promptly. legal@halacham.com We will delete it.
15. General terms and conditions
Decisions are not made based on purely automated processing. Legal effects may arise for you or similarly affect you. We may use simple classifications to tailor content or offers (such as similar offers to what you viewed) based on your consent, and you have the right to object at any time.
16. External Links and Services
The site contains links to hotel websites, travel agencies, payment platforms, and communication tools. These entities are independent of us, and we do not assume responsibility for their policies or practices. We recommend reviewing the privacy policy of each before providing your information.
17. Amendments to this Policy
قد نُحدّث هذه السياسة لتعكس تغييرات في خدماتنا أو في القوانين المطبقة. ننشر النسخة المحدّثة على هذه الصفحة مع تعديل “تاريخ آخر تحديث” ورقم الإصدار. وفي حال التعديلات الجوهرية، نُخطرك عبر البريد الإلكتروني أو بإشعار بارز على الموقع قبل بدء سريانها بمدة معقولة، ونطلب موافقة جديدة حيث يقتضي القانون ذلك. ويُحتفظ بأرشيف الإصدارات السابقة ويُتاح عند الطلب.
18. Applicable Law and Jurisdiction
This policy is subject to the laws of the Syrian Arab Republic and is exclusively governed by the courts. City of Damascus In the event of any dispute, Do not touch that Rights of data subjects residing in the European Union or Turkey to refer to the supervisory authority or the competent court in their country of residence in accordance with applicable regulations.
19. Communication and complaint submission
The first method (preferred): We have sent to legal@halacham.com — We will respond to the refund request within the specified timeframe in section 11.
Secondary Route — Regulatory Authorities:
| Province | Direction |
|---|---|
| Syria | The authority responsible for personal data protection (according to Law 12/2024) |
| Turkey | Personal Data Protection Council — Kişisel Verileri Koruma Kurumu (KVKK) |
| European Union | Data protection authority in your country of residence or workplace or location of the violation |
