Privacy Policy

We, the Gheras Endowment Investment Fund (hereinafter referred to as the “Controller”), place the highest importance on your privacy and are committed to protecting your personal data when you use our website (hereinafter, you are referred to as the “Data Subject”).

This Privacy Policy for the Gheras Endowment Investment Fund website (hereinafter referred to as the “Policy”) has been prepared in accordance with the Personal Data Protection Law (hereinafter referred to as the “Law”) issued under Royal Decree No. 6/2022, and its Executive Regulations (hereinafter referred to as the “Regulations”) issued under Ministerial Decision No. 34/2024.

This Policy explains how your personal data is collected, used, and protected when you browse our website or make donations through the electronic payment portal.

By using the Website and consenting to this Privacy Policy, you acknowledge that you have read, understood, and agreed to all provisions set forth herein.

When you use the Website, we may collect the following categories of data:

• Payment details (processed securely through the electronic payment gateway).
• Information you provide when submitting inquiries or communicating with us regarding our services.
• Personal data, including but not limited to: name, email address, and phone number.

We are committed to not selling, renting, or sharing your personal data with any third party, except in the following circumstances:

• Communicating with you: We use your data to respond to your inquiries and provide updates regarding our services. We may also send you marketing or promotional communications, where permitted by applicable laws.
• Data storage: Your data may be stored within the Sultanate of Oman or outside it, in accordance with applicable laws and regulatory requirements.
• Legal compliance: We may retain, process, or disclose your data where necessary to comply with legal obligations, regulatory requirements, or to protect our rights and the rights of our users.

We implement strict technical and organizational measures to protect your personal data from unauthorized access, alteration, disclosure, or misuse, including the use of encryption technologies when processing payment information.

Data Subjects have the right to submit a free, written request to exercise any of the following rights:

1. Withdrawal of consent
   To withdraw consent to the processing of their personal data, without affecting the lawfulness of processing carried out prior to withdrawal.
2. Rectification and restriction
   To request the rectification, updating, restriction, or blocking of their personal data.
3. Access to data
   To obtain a copy of their processed personal data.
4. Data portability
   To request the transfer of their personal data to another controller, where technically feasible and legally applicable.
5. Right to erasure
   To request the erasure of their personal data—unless there is a legal requirement to retain it—in any of the following cases:
   • Where the data is no longer required after the purpose of processing has been fulfilled.
   • Where consent to processing is withdrawn, without prejudice to prior processing.
   • Where processing is not compliant with the provisions of the Law or its Executive Regulations.

A decision on any request shall be issued within no later than forty-five (45) days from the date the request is received.
The Data Subject may also request the suspension of processing of their personal data until a decision is issued.

The Controller may fully or partially refuse a request in the following cases:

• Where the request is repetitive without reasonable justification.
• Where fulfilling the request would require disproportionate or exceptional effort.

The Controller may refuse an erasure request specifically where:

1. There is a legal obligation requiring the Controller to retain the data pursuant to any law or court order.
2. There is an ongoing legal dispute between the Controller and the Data Subject requiring retention of the data for legal proceedings.

In all cases, the Controller shall provide the Data Subject with a reasoned response regarding any refusal within no later than forty-five (45) days from the date the request is received.

Additional Rights

• The Data Subject may request a copy of their personal data in a clear and readable format, whether electronically or in hard copy, provided that the copy does not include personal data identifying another individual.
• The Data Subject may request the transfer of their personal data to a new controller, and the Controller shall transfer such data where legally required to do so.
• The Data Subject may contact the Controller using the contact details provided in this Policy to submit any requests or inquiries relating to their personal data.

We will not share, sell, or rent your personal data to any third party without obtaining your prior consent, except in the following circumstances:

• With electronic payment service providers, for the purpose of processing your donations or responding to payment-related inquiries.
• For legal and regulatory compliance, where disclosure is required by competent legal or regulatory authorities.

• The Controller reserves the right to amend this Policy from time to time. Any updates or modifications will be published on the official website, and you are advised to review the Policy periodically to remain informed of any changes.
• The updated Policy shall apply to:
  • New users who access or register on the Website after the updates are published;
  • Users who continue to use the Website following the publication of the updates; and
  • Existing Data Subjects upon their acceptance of the updated Policy.

Where applicable, users will be requested to provide consent to the updated Policy.

For any inquiries or requests related to this Privacy Policy or your personal data, please contact us via:

• Email: [email protected]
• Phone: +968 2494 9043 / 014