Who we are
Noul is a wholesale marketplace that connects suppliers and makers in Lebanon with buyers across the MENA region and Africa. We operate the Noul website, the buyer and vendor portals and the tools our operations team uses to review, verify and support the marketplace (together, the “Platform”).
In this policy, “Noul”, “we”, “us” and “our” mean the operator of the Noul marketplace, based in Lebanon. “You” means anyone who visits or uses the Platform, including buyers, vendors and vendor staff.
We are the controller of the personal information described in this policy. Our platform and support team can be reached at Contact@Noul.com.
What this policy covers
This policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the rights you can exercise over it.
It covers the website, the buyer and vendor dashboards, the internal admin console used by our staff, and the messaging, notification and support features connected to them.
What this policy does not cover
- Websites, shops or systems operated by vendors. Each vendor runs its own business and is responsible for its own privacy practices.
- Payment pages hosted by our payment partner. Card details are entered there, under that partner’s own privacy notice.
- Delivery, logistics or verification partners you deal with directly through their own channels.
- The privacy practices of a vendor when it handles your order as an independent business — ask the vendor for its notice if you need it.
Information we collect
We collect information in three ways: what you give us, what is created when you use the Platform, and what we receive from partners who help us run it.
Account and identity details
- Your name, business name and role (buyer, vendor, vendor staff or administrator).
- Email address and mobile number, and the credential or one-time code used to sign in.
- Preferred language, display currency and the country or region you buy from.
- Profile photo, business logo and any content you add to your profile.
Verification and compliance documents (vendors)
Verification is a condition of selling on Noul, so we collect more from vendors than from buyers.
- Business registration and trade licence details, tax and VAT identifiers, and proof of business address.
- Identity documents of the person completing verification, plus ownership or beneficial-ownership information where the law requires it.
- Bank account or payout details used to settle your earnings.
- A record of which documents you submitted, when they were reviewed, the decision reached and, where applicable, an expiry date.
Listings, orders and transactions
- Product listings, descriptions, images, prices, stock levels and categories.
- Cart contents, orders, quantities, delivery addresses, delivery notes and order status history.
- Invoices, credit notes, refunds, payout statements and correspondence about them.
- Reviews, ratings and reports you submit about products, vendors or other users.
Messages and support
- Messages exchanged with vendors, our support team or our assistant, including any files you attach.
- The contact details and content of any complaint, dispute or data request you raise with us.
Payment information
- The payment method chosen (card or cash on delivery), the amount, currency and status of the transaction, and the reference identifiers returned by our payment partner.
- We never receive or store full card numbers. Card details are entered directly with our PCI-certified payment partner; we only ever see a token and the last four digits.
Device, usage and security data
- IP address, device and browser type, operating system, language settings and the approximate location derived from your IP address.
- Pages viewed, searches run, features used, session identifiers, timestamps and referring links.
- Security events such as failed sign-in attempts, permission changes and administrative actions.
We do not ask for and do not want sensitive information such as health data or religious or political beliefs. Please do not put that kind of information into listings, reviews, messages or delivery notes.
How we use your information
To run the marketplace
- Create and secure your account and keep you signed in.
- Publish vendor storefronts, listings, prices, stock and reviews.
- Process carts, orders, payments, refunds and payouts.
- Send transactional messages such as order confirmations, delivery updates and payout statements.
To verify vendors and meet our obligations
- Review trade, tax, identity and ownership documents submitted for verification.
- Screen vendors against sanctions and anti-money-laundering lists through our verification partners.
- Keep the audit records that regulators, auditors and payment partners expect to see.
To keep the Platform safe and trustworthy
- Detect fraud, abuse, fake accounts, review manipulation and fee circumvention.
- Investigate reports about products, vendors or users and take moderation action.
- Apply rate limits, block malicious traffic and protect the Platform against attack.
To improve Noul
- Understand which features, categories and search results are actually used.
- Measure and improve catalogue quality, translation and discovery.
- Test changes before they reach everyone.
To communicate with you
- Service messages about your account, security, policy changes and the availability of the Platform.
- Optional marketing messages, such as new categories or vendor programmes, which you can turn off at any time.
To comply with the law
- Keep invoices, payout records and ledger entries for the periods the law requires.
- Respond to lawful requests from courts, regulators and law-enforcement bodies.
- Enforce our Terms of Service and defend our legal rights.
Our legal bases for processing
Where GDPR-style rules apply to you, we rely on the following legal bases. Where local law takes a different approach, we process information under the equivalent local ground.
Performance of a contract
- Creating your account and providing the marketplace services you ask for.
- Processing orders, refunds, payouts and the messages needed to complete them.
Legal obligation
- Verifying vendor identity and business details before they sell.
- Keeping accounting, tax and payout records.
- Screening for sanctions and responding to lawful information requests.
Legitimate interests
- Securing the Platform, preventing fraud and abuse and enforcing our Terms.
- Measuring and improving the catalogue, search and features.
- Supporting buyers and vendors and answering their questions.
- We weigh those interests against your rights and offer an easy way to object.
Consent
- Optional marketing messages.
- Non-essential cookies and similar technologies.
- Any feature that explicitly asks for your permission before it collects something new.
Where we rely on consent, refusing or withdrawing it never blocks the core marketplace service. Use your account settings, the cookie controls described below or write to us to withdraw it.
Where we store and transfer information
The Platform and its databases run on cloud infrastructure. Information may be stored and processed in countries other than the one you live in, including countries whose data-protection rules differ from yours.
Safeguards we use
- Contractual data-protection terms with every processor, including standard contractual clauses where they are the recognised transfer mechanism.
- Encryption in transit for everything that leaves our infrastructure.
- Access controls that restrict who, inside and outside Noul, can reach personal information.
- Partitioning of sensitive verification storage where residency requirements call for it.
Because buyers are spread across the MENA region and Africa while most vendors are in Lebanon, hosting is currently concentrated in a single primary region. We review that choice as residency requirements, partner needs and volume change, and we document it before a material customer depends on it.
How we protect your information
- Encryption in transit (TLS 1.2 or better) and encryption at rest for our databases and object storage.
- Role-based access control with deny-by-default permissions, so staff reach only the records their role requires.
- Verification documents are held in a segregated private store, reachable only through short-lived signed links, and every access is logged by document, actor and time.
- Uploaded documents are virus-scanned before review, and administrator downloads of sensitive documents require multi-factor authentication and are rate-limited.
- Card data never reaches our servers — payments are completed with a PCI-certified partner using hosted fields.
- Continuous logging and alerting, dependency scanning in our build pipeline and periodic security review.
No online service can promise absolute security. If we become aware of a breach that affects your personal information, we will notify you and the relevant authorities as and when the law requires, and we will tell you what to do to protect yourself.
Keep your own account secure: use a strong, unique password, never share your sign-in credentials, and tell us immediately at Contact@Noul.com if you suspect your account has been accessed by someone else.
How long we keep information
We keep personal information only for as long as we need it for the purpose we collected it, or for as long as the law requires us to keep it. The periods below are our defaults.
- Account and profile — kept while your account is active, then anonymised or deleted after a verified deletion request.
- Listings — kept while published, then soft-deleted with a tombstone so past orders still resolve correctly.
- Carts — short-lived, and cleared on checkout or after a period of inactivity.
- Orders, invoices, ledger entries and payout records — kept for the accounting, tax and financial period required by law.
- Verification documents — kept for the regulatory minimum for verification records, then purged automatically unless a legal hold applies.
- Audit and security logs — kept long enough to investigate incidents and satisfy compliance obligations.
- Security audit records for sensitive documents — kept with the audit log, by document, actor and timestamp.
- Server logs containing personal data — kept for a short period, typically days.
- Backups — kept for a limited rotation window before they age out.
Where we must keep a record for legal or accounting reasons, we anonymise the identity fields so the record no longer identifies you, and we restrict who can reach it.
Your privacy rights
Depending on where you live, you may have some or all of the following rights. We honour GDPR-style requests for every user, wherever they are, as a matter of policy.
- Access — ask for a copy of the personal information we hold about you.
- Correction — have inaccurate or incomplete information fixed.
- Deletion — ask us to delete your account and the personal information tied to it.
- Portability — receive your information in a structured, commonly used, machine-readable format.
- Objection — object to processing based on legitimate interests, including profiling.
- Restriction — ask us to pause processing while a dispute is being resolved.
- Withdrawal of consent — for anything based on consent, including marketing messages.
You can exercise access, correction, export and deletion yourself from your account settings, or by writing to Contact@Noul.com. We verify requests before acting, and we respond within the period the applicable law requires, which is one month for GDPR-style requests.
How deletion works
Deletion is supervised, because some records have to survive for legal and financial reasons.
- Removed — profile fields, preferences, saved carts, wishlists and communication preferences.
- Retained with redaction — invoices, ledger entries, payout records and audit logs are kept, but the link to your identity is replaced with an anonymous reference.
- Verification documents — purged on the schedule above unless they are under legal hold.
- Public content — reviews and listings are removed, or shown against a “deleted user” placeholder where the order record must stay complete.
- Before deletion completes, any open order, refund or payout hold must be settled.
You can ask us to export your information at any time from account settings. If you are unhappy with how we have handled a request, you can complain to your local data-protection authority.
Children
Noul is a business-to-business marketplace and is not intended for children. We do not knowingly collect personal information from anyone under 18, and we do not permit under-18s to open an account or place an order.
If you believe a child has given us personal information, write to Contact@Noul.com and we will delete it.
Changes to this policy
We update this policy when our practices, our partners or the law change. The date at the top of the page always reflects the current version.
If a change is significant — for example a new category of data, a new purpose, or a new kind of sharing — we will post a clear notice on the Platform or send you a message before it takes effect, and we will give you a reasonable chance to object.
Continuing to use the Platform after a change takes effect means you accept the updated policy.
Contact us
Questions about this policy, a data request or a security concern? Write to our platform and support team and we will reply within the period the applicable law requires.
Contact our teamContact@Noul.comNoul — Beirut, Lebanon