§1 — Who We Are
The website sindbadexpo.com is operated by SINDBAD for Exhibitions & Conferences, which acts as the controller for the processing of personal data (the party that determines the purpose and means of the processing).
Controller: SINDBAD for Exhibitions & Conferences — Sultanate of Oman
§2 — Contact Details and Data Protection Officer
To contact us about this policy or about the processing of your personal data:
- Data Protection Officer (Privacy Contact): Nasser Saif Al Hinai
- Email: info@sindbadexpo.com
The Data Protection Officer responds to your requests and enquiries about your privacy within the time limits set out in the applicable law and regulations.
§3 — What Data We Collect
We collect only the data that you provide directly, or that is generated automatically when you visit the website:
| Type of data | Source | Example |
|---|---|---|
| Data you provide voluntarily | Contact form | Name, email address, message content |
| Data you provide voluntarily | Email correspondence (info@) | Name, email address, content of the correspondence |
| Data generated automatically | Google Analytics 4 | IP address (used at the point of collection to determine geographic location, then deleted and not stored in Analytics logs), browser, device type, browsing behaviour |
| Data generated automatically | Cookies | Consent preferences, consent status |
| Data generated automatically | Server logs | Visit sessions, HTTP requests |
We do not collect sensitive data (Art. 9 GDPR), such as health or biometric data. The website is not aimed at children as a user group, and we do not knowingly request personal data from children through the website’s services.
§4 — How and Why We Process Your Data
We process your data only for the purposes set out below. We do not use your data for commercial or advertising purposes, and we do not sell it to third parties.
| Purpose | Data used | Legal basis |
|---|---|---|
| Responding to your enquiries and requests | Form and email data | Legitimate interest |
| Improving website performance and the user experience | Google Analytics data | Consent |
| Managing cookie preferences | Consent status | Consent + legal obligation |
| Operating the website and ensuring its security | Server logs and backups | Legitimate interest |
Details of each processing activity are set out in §6 to §10.
§5 — Legal Basis
Where data protection legislation applies, we rely on the following bases to process your data:
- Consent: when Google Analytics and non-essential cookies are used.
- Legitimate interest: when we respond to your enquiries through the contact form and by email, and when we operate the website and ensure its security. (This basis is recognised under the European GDPR for processing of a cross-border nature; it is not an independent legal basis expressly provided for in the Omani personal data protection framework.)
- Legal obligation: when consent data is recorded in order to comply with data protection requirements.
Where processing is based on consent, you may withdraw your consent at any time (see §16).
§6 — Contact Form and Email
The website allows you to submit messages through the contact form (WPForms). When you submit the form, we collect:
- Your name
- Your email address
- The content of your message
This data is sent to info@sindbadexpo.com so that we can reply to you. Form entries are not stored in the WordPress database; the message is received directly by email through Hostinger’s servers.
Direct email correspondence: when you contact us directly at info@sindbadexpo.com, we receive your name, your email address and the content of your message. We process this data solely in order to reply to you.
Legal basis: legitimate interest — responding to your enquiries and requests is necessary for operating our business.
Retention period: 12 months from the date the message is received. Exception: if an ongoing commercial or contractual relationship arises, we retain the data for as long as that relationship continues.
§7 — Traffic Analysis (Google Analytics 4)
We use Google Analytics 4 (GA4) to analyse website traffic and improve website performance. GA4 collects data from your device, including your IP address, browser identifier, the pages you visited, the duration of your visit and activity data on the website.
Privacy settings enabled:
- Google Signals data is not sent to Google
- Email addresses are redacted (if present in the update)
Legal basis: consent — you can choose to accept or refuse traffic analysis through the cookie consent banner when you enter the website.
Retention period: event data: 2 months; user data: 14 months (standard GA4 setting adopted).
Processor and recipient: Google LLC, in accordance with Google’s Privacy Policy and the GA4 data processing terms (the contract is concluded with Google). Traffic analysis involves the transfer of data to Google servers outside the Sultanate of Oman — see §12 for details of international transfers.
For more information on how Google processes your data, see the Google Analytics Privacy Policy.
§8 — Cookies
What are cookies? Small text files stored on your device when you visit the website. We use cookies for the following purposes:
| Type | Description |
|---|---|
| Necessary cookies | Necessary for the website to function properly (do not require your consent). (This classification is based on the technical function of these cookies; their precise legal classification depends on the applicable regulatory frameworks.) |
| Performance / analytics cookies | Analysis of visits to the website through GA4 (require your consent) |
| Consent cookies | Storage of your choices in the cookie consent banner (SureCookie) |
How consent works: when you enter the website for the first time, a banner allows you to accept or refuse the activation of non-essential cookies. You can change your choice at any time.
Consent record retention period: 365 days from the date consent is given (SureCookie).
How can you control cookies? You can set your browser to block or delete cookies, but this may affect some website functions.
§9 — Third-Party Services
Google Fonts
The fonts used on the website (DM Sans, Lexend, Playfair Display) are hosted directly on the website’s own servers. No connection is made to Google’s servers, and no visitor data is sent to Google, in connection with loading these fonts.
Google Maps
The website contains a map of our location in Al Ghubra, Muscat, Oman, provided through the Google Maps service. To protect your privacy, the map does not load automatically when you open the page; you must click the “Load Map” button to activate it. Only once the map is activated may your IP address be sent to Google’s servers to process the map request.
Processor: Google LLC, in accordance with the Google Privacy Policy.
The Google Maps service involves the transfer of data to Google servers outside the Sultanate of Oman — see §12 for details of international transfers.
§10 — Hosting and Infrastructure
The website is hosted on Hostinger servers (hostinger.com). This means that your data stored on the website — such as contact forms and server logs — resides on Hostinger’s servers under a data processing agreement concluded with Hostinger.
Backups: Hostinger makes automatic backups of the data stored on the server. This processing relies on the same legal basis as the original data and does not constitute an independent legal basis.
Server logs: Hostinger keeps server access logs (IP address, HTTP timestamps, browser data) for security and operational purposes. The retention period and deletion criteria are subject to Hostinger’s policies; the exact storage periods have not yet been confirmed.
For more information, see the Hostinger Privacy Policy.
§11 — Recipients and Processors
We do not sell, rent or exchange your personal data with third parties, except for the processors needed to operate the website:
| Processor | Service |
|---|---|
| Google LLC | Google Analytics 4, Google Maps |
| Hostinger International Ltd. | Website hosting, backups |
These parties contract with us as data processors and are bound by the agreed processing terms and by their own privacy policies. The nature of the relationship and the level of control vary according to the nature of the service provided by each processor.
§12 — International Transfers
Operating the website involves the transfer of data to servers belonging to Google LLC and Hostinger outside the Sultanate of Oman.
| Party | Nature of the data flow | Note |
|---|---|---|
| Google LLC | GA4 data, Google Maps | Google is subject to international data protection mechanisms |
| Hostinger | Hosting and backup data | Hosting server in Frankfurt, Germany; safeguards and transfer requirements are assessed in accordance with PDPL Art. 23 and the Executive Regulations. |
We assess the applicable safeguards and the level of protection for each data flow in accordance with the requirements of PDPL Art. 23 and the Executive Regulations (an adequate level of protection, and no prejudice to national security). Each data flow will be assessed individually in later steps of the compliance programme.
§13 — Data Retention
We do not retain your data for longer than the purposes for which it was collected require:
| Data source | Retention period |
|---|---|
| Contact forms (WPForms) | 12 months — except: for the duration of a commercial/contractual relationship |
| Traffic analysis (GA4) | Event data: 2 months; user data: 14 months |
| Cookie consent record (SureCookie) | 365 days from the date of consent |
| Email correspondence (info@) | Varies according to the type and purpose of the message |
| Server logs (Hostinger) | In accordance with Hostinger’s policy |
We delete data or render it anonymous (anonymisation) as soon as the purpose for which it was collected has ended, unless legal or operational considerations require us to retain it for a further period.
§14 — Data Security
We take appropriate technical and operational measures to protect your data:
- HTTPS: encryption of the connection between your browser and the website (TLS)
- Email security: we apply authentication controls to the sindbadexpo.com domain to prevent impersonation and to ensure the integrity of outgoing messages
- Limited access: your data is accessible only to staff who need it for their work
No method of protection on the internet is 100% guaranteed, but we continue to improve our security measures on a regular basis.
§15 — Your Rights over Your Data
The applicable legal framework grants you a number of rights over your data:
| Right | Description |
|---|---|
| Access | Request a copy of the data we hold about you |
| Rectification | Request the correction of inaccurate data |
| Erasure | Request the deletion of your data (subject to the legal conditions) |
| Restriction of processing | Request that the processing of your data be stopped in certain circumstances |
| Objection | Object to processing based on legitimate interest |
| Portability | Request the transfer of your data (where technically feasible) |
| Withdrawal of consent | Withdraw your consent at any time — see §16 |
To make a request, see §17.
§16 — Withdrawing Consent
Where the processing of your data is based on your consent — such as traffic analysis through GA4 — you may withdraw your consent at any time, without this affecting your right to browse the website.
How to withdraw consent: through the cookie consent banner that appears when you visit the website, or by writing to us at info@sindbadexpo.com.
Effect of withdrawal: withdrawing your consent does not affect the lawfulness of processing carried out while your consent was in effect.
§17 — How to Make a Request
To make any request relating to your data, contact us at:
- Email: info@sindbadexpo.com
- Responsible officer: Nasser Saif Al Hinai — Data Privacy Officer
We respond to your request within the time limits set out in the applicable law and regulations. We may need to verify your identity before processing your request.
§18 — Data Incidents
If a security incident occurs that may affect your personal data, we commit to the following:
- Internal notification: assessing and documenting the incident as soon as it is discovered
- Notifying the competent authority: reporting breaches that are likely to result in a risk to the rights of data subjects to the Ministry within 72 hours of becoming aware of the breach (in accordance with the applicable provisions of the Personal Data Protection Law and its Executive Regulations). Not every security incident requires this notification.
- Notifying you: if the incident poses a high risk to your rights or interests, we will inform you as soon as possible
To report any security concerns: info@sindbadexpo.com
§19 — Changes to This Policy
We may update this policy from time to time, or when the way we process data changes. When we make material changes, we will inform you through a visible notice on the website or through info@sindbadexpo.com before the change takes effect.
§20 — Date and Version
- Publication date: 29 September 2026
- Version number: 1.0
This policy is subject to the provisions of Royal Decree No. 6/2022 promulgating the Personal Data Protection Law (PDPL), as amended by Royal Decree No. 68/2026, and, in its application to websites directed at users in the European Union, to the European regulation (GDPR).