Privacy Policy

1. Introduction

This Privacy Policy explains how [Company Legal Name] trading as "Farra" ("Farra," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use our website, mobile application, booking tools, customer support, and related services (together, the "Services").

Farra is an accommodation marketplace and intermediary. We help users discover, compare, and book accommodation offered by independent hotels, hosts, property managers, and other accommodation providers ("Accommodation Providers"). Unless we expressly say otherwise, Farra does not own, operate, or directly provide the accommodation listed on the Services. Accommodation Providers may process information under their own privacy notices as well as this Policy.

This Policy applies to users who browse the Services, create an account, make or manage a booking, contact us, or otherwise interact with Farra. It is intended to be clear and practical.

Please replace the bracketed fields before publication: [Company Legal Name], [Address], [Email], [Effective Date], and [Last Updated]. We have structured this notice around transparency practices that generally require an organisation to explain its identity, purposes, legal grounds, recipients, retention approach, transfers, and available rights. See the ICO guidance on privacy information and, where relevant, Articles 13–14 of the GDPR.

2. Information We Collect

Depending on how you use the Services, we may collect the following categories of information:

Account and contact information: your name, email address, telephone number, password credentials, profile details, preferred language, and communication preferences.
Booking information: destination, dates, number of guests, accommodation selected, booking reference, check-in and check-out details, special requests, cancellation or change history, and information needed to coordinate your stay.
Payment and transaction information: payment status, billing details, currency, transaction reference, refund information, and limited payment-card information handled by our payment providers. Farra should not receive or store full card numbers unless expressly stated and legally permitted.
Identity and compliance information: information reasonably required to verify an account, prevent fraud, comply with law, or satisfy an Accommodation Provider's check-in requirements. We will explain when additional information is mandatory.
Communications and user content: messages to Farra or an Accommodation Provider, support requests, reviews, ratings, survey responses, and other information you choose to submit.
Technical and usage information: IP address, device and browser type, operating system, app version, approximate location inferred from technical data, pages or features used, referral information, timestamps, crash reports, and similar log data.
Cookie and marketing information: identifiers collected through cookies, SDKs, pixels, and similar technologies, subject to your choices and applicable law.

3. How We Use Your Information

We may receive information from Accommodation Providers, payment and identity-verification partners, fraud-prevention services, sign-in providers, or other people who make a booking on your behalf. When we obtain information from another source, we will provide the information required by applicable law, including the relevant categories and source where required.

We use personal information for the following purposes:

To create and manage accounts, process searches and bookings, issue confirmations, collect or facilitate payments, process refunds, and provide booking-related messages.
To share necessary booking details with the relevant Accommodation Provider so it can accept, prepare for, and deliver the booked stay.
To provide customer support, respond to enquiries, resolve disputes, and communicate important service, safety, security, or policy updates.
To operate, maintain, troubleshoot, secure, and improve the Services, including understanding how users interact with features and identifying technical problems.
To personalise search results, recommendations, content, and communications where permitted.
To detect, investigate, and prevent fraud, abuse, unlawful activity, unauthorised access, and violations of our terms.
To send promotional communications where permitted and in accordance with your marketing choices.
To comply with legal obligations, respond to lawful requests, protect rights and safety, and establish, exercise, or defend legal claims.
To create aggregated or de-identified information that does not reasonably identify you, for analytics, service improvement, and business planning.

We do not use booking information to make a decision with legal or similarly significant effects based solely on automated processing unless we provide the notices and safeguards required by applicable law. If our practices change materially, we will update this Policy before or when the new processing begins where required.

4. Legal Bases / Grounds for Processing

Where a law such as the GDPR applies, we process personal information on one or more of the following grounds:

Performance of a contract: to provide the Services you request, including creating an account, completing a booking, facilitating payment, and supporting your stay.
Legal obligations: to keep required records, respond to lawful requests, meet tax or accounting requirements, prevent financial crime, or comply with other applicable law.
Legitimate interests: to operate and improve Farra, secure the Services, prevent fraud, communicate with users about existing transactions, and protect our legal rights, provided those interests are not overridden by your rights and interests.
Consent: where we ask for your consent, such as for certain optional cookies, promotional communications, or other processing that requires consent. You may withdraw consent at any time; withdrawal does not affect processing already carried out lawfully.

The ground depends on the particular purpose and the applicable law. If information is required to enter into or perform a contract, or to comply with a legal obligation, failure to provide it may prevent us from completing a booking or providing a requested feature.

5. How We Share Your Information

We share personal information only as reasonably necessary for the purposes described in this Policy and, where required, with an appropriate legal basis or notice.

Accommodation Providers: We share the information needed to confirm, administer, and fulfil a booking, communicate about arrival or changes, respond to requests, and address stay-related issues. The Accommodation Provider may use the information under its own privacy practices and may request additional information required for check-in or local compliance.
Service providers: We use vendors that support hosting, cloud storage, customer support, communications, analytics, fraud prevention, identity verification, payment processing, refunds, security, and technical operations. They may process information only on our instructions or as otherwise permitted by law and must apply appropriate protections.
Payment and financial partners: Transaction information may be shared with payment processors, banks, card networks, and fraud-screening providers to authorise payments, prevent misuse, and handle refunds or chargebacks.
Professional advisers and authorities: We may disclose information to insurers, auditors, lawyers, regulators, courts, law-enforcement bodies, or government authorities when required or reasonably necessary to comply with law, protect people, investigate suspected wrongdoing, or defend legal claims.
Business transactions: If Farra is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be transferred subject to appropriate confidentiality and legal protections.
With your direction: We may share information when you ask us to, such as when you choose to share a booking or communicate with another user or provider.

We do not sell your personal information for money. We do not disclose it to unrelated parties for their own direct marketing unless permitted by law and clearly explained to you.

6. Cookies and Similar Technologies

Farra and selected service providers may use cookies, software development kits, pixels, local storage, and similar technologies. These technologies help the Services remember your settings, keep you signed in, protect accounts, measure performance, understand usage, and, where permitted, provide relevant communications or advertising.

Some technologies are strictly necessary for security, authentication, bookings, payment flows, and core functionality. Other technologies, such as analytics or marketing tools, may be optional depending on your location and applicable law.

Where required, we will ask for consent before placing optional technologies and will explain how to change your choices. You can also manage cookies through your browser or device settings. Blocking necessary cookies may affect search, account, payment, or booking functionality.

Our cookie banner or a separate Cookie Notice may provide more detailed information about individual technologies, providers, purposes, and retention periods.

7. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain business and transaction records, resolve disputes, enforce agreements, prevent fraud, and comply with legal, tax, accounting, or regulatory obligations.

Retention periods vary by the type of information, the sensitivity of the information, whether your account remains active, whether a booking or dispute is ongoing, and whether a legal or regulatory obligation requires continued retention. Where a precise period cannot yet be stated, we use these criteria to determine it.

When information is no longer required, we delete it, anonymise it, or securely isolate it where deletion is not immediately possible.

8. Data Security

We use reasonable technical, organisational, and administrative safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, and unauthorised access. These measures may include access controls, encryption in transit where supported, vendor due diligence, monitoring, backups, staff confidentiality obligations, and incident-response procedures.

No website, application, transmission, or storage system can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential and should contact us promptly at [Email] if you believe your account or information has been compromised. Where required by law, we will notify affected individuals or authorities of a personal-data incident.

9. Your Rights and Choices

Depending on your location and applicable law, you may have the right to:

You can usually update account details in the Services and unsubscribe from promotional emails by using the link in the message. Transactional and service messages, such as booking confirmations, payment notices, security alerts, and material changes to the Services, may still be sent when necessary.

To exercise a right, contact us at [Email] or [Address] and describe your request clearly. We may need to verify your identity before responding. We will respond within the period required by applicable law and may explain any lawful reason why a request cannot be fully completed.

The [Company Legal Name] contact or data-protection representative, if applicable, is: [Data Protection Contact / Representative].

Request access to the personal information we hold about you.
Ask us to correct inaccurate or incomplete information.
Request deletion of information, subject to legal and operational exceptions.
Ask us to restrict or pause certain processing.
Object to processing based on legitimate interests, including direct marketing.
Receive certain information in a structured, commonly used, machine-readable format or ask us to transfer it where portability applies.
Withdraw consent at any time when processing is based on consent.
Complain to the competent data-protection or privacy authority in your country or region.

10. Children's Privacy

The Services are intended for adults and are not directed to children below the minimum age required to use them under applicable law. Children should not create an account, make a booking, or submit personal information without the involvement and supervision of a parent or legal guardian where required.

If we learn that we have collected personal information from a child in circumstances where collection was not permitted, we will take reasonable steps to delete it.

A parent or guardian who believes a child has provided information to us may contact [Email].

11. International Data Transfers

Farra is based in Iraq and may use service providers, payment partners, cloud infrastructure, or other recipients located in countries outside Iraq or outside the country where you live. As a result, personal information may be transferred to and processed in another jurisdiction whose privacy laws may differ from those in your location.

Where applicable law requires safeguards for an international transfer, we will use an approved transfer mechanism or other lawful safeguard, such as an adequacy decision, standard contractual protections, an approved certification or code, or a legally recognised exception.

Where required, you may request information about the relevant safeguard by contacting [Email].

12. Third-Party Links and Services

The Services may contain links to websites, applications, payment pages, maps, social-media features, or other services operated by third parties. We do not control those services and are not responsible for their content, security, or privacy practices. A link or integration does not mean that Farra endorses the third party.

Before providing information through a third-party service, review its privacy notice and terms.

Accommodation Providers may also collect information directly from you during or after a booking. Their practices are governed by their own notices, subject to any responsibilities Farra has under applicable law.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, our processing practices, technology, or applicable law. When we make a material change, we will provide an appropriate notice, such as posting the updated Policy, revising the "Last Updated" date, displaying an in-service notice, or contacting you where required.

Your continued use of the Services after the updated Policy takes effect means that you have read the updated notice. The current version will be available on this page.

Effective Date: [Effective Date]. Last Updated: [Last Updated].

14. Contact Us

If you have questions about this Privacy Policy, want to exercise a privacy right, or wish to raise a concern about how Farra handles personal information, contact us:

[Company Legal Name] (trading as Farra) Address: [Address] Email: [Email] Privacy or Data Protection Contact: [Data Protection Contact / Representative]

We encourage you to contact us first so that we can try to resolve your concern. You may also contact the relevant privacy or data-protection authority available under the law that applies to you.