What we hold, and who can see it

About you as a person: your name, job title, work email address, phone number and, if you give it, your WhatsApp number. We record when you accepted these terms and this policy, and which edition you accepted.

About your company: trading and registered names, commercial registration number, address, website, what it trades and which markets it serves.

Verification documents: commercial registration, import/export or distribution licences, tax certificates, and — only if you choose to send one — an identity document for the person applying.

Pictures: your company’s logo and the photographs you add to its profile and your listings. We remove the location and camera details stored inside a photograph before keeping it.

What happens on the marketplace: which listings and company profiles are viewed, when someone asks for a company’s contact details (a message, or a press on its phone, WhatsApp, email or website), what members save, and what they search for. Each of these is recorded against the company that did it, so it is counted once. A company sees, for its own listings and profile, how many times they were viewed, saved and contacted, and which countries and kinds of business that came from — never which companies looked.

Messages: enquiries, messages sent from a company’s profile and the replies to them, with the date each was written and read. Only the two companies in a conversation can read it — an administrator reads one only when somebody in it reports it, and every such reading is recorded. The sender’s company name and contact details travel with every message, and each one is also emailed to the company it was written to.

Reports: when a member reports a company or listing, we keep what they wrote and who wrote it. Only administrators see a report, and the company reported is never told who made it.

Messages to us: what you write on the contact page or on Help, with your name, email address, company if you give it and the IP address it was sent from, together with our replies.

Sign-in records: each time you sign in we record the date, the IP address you signed in from, and your browser and operating system. We also remember each device you use as its browser, its system and the first half of its IP address, so that we can show you where your account is signed in and email you when it is used from a device it has not seen before. We do not look up your location from your address.

Failed sign-ins: when a sign-in fails we keep a keyed one-way hash of the network address it came from — never the address itself — so that one network cannot keep guessing passwords for many accounts.

Technical records: ordinary server logs. We use no advertising or analytics trackers; the few cookies we do set are listed in the cookie policy.

Catalogues, certificates and videos: files a company publishes to its profile are visible to every member, as are the YouTube or Vimeo links on listings. They are not the verification documents, which stay with administrators.

To confirm that a company is real and is what it says it is, which is the entire basis on which other members decide to trade with it. To let members contact one another. To issue invoices and keep the accounting records the law requires.

We do not sell personal data, and we do not share member contact details with anyone outside the platform.

Other members see your company profile, your listings, and the contact details you chose to publish. They never see your verification documents.

Administrators see everything, including documents, and only while reviewing or supporting an account. Documents are stored separately from anything members can reach, under randomly generated names that cannot be guessed from your company.

Nobody outside — the marketplace is closed to search engines and to the public.

While you are a member, and for a period afterwards so that a decision can be explained if it is ever questioned, and so that a rejected applicant cannot simply reapply under a new address.

When a company record is deleted, its verification documents are deleted with it, both from the database and from storage.

Some records are deleted automatically: sign-in records (devices and past sign-ins) twelve months after they were last used, and the hashed network addresses of failed sign-ins after one day. Verification documents are kept while your company is a member, and afterwards for as long as the law requires.

Passwords are stored only as a slow one-way hash and cannot be read by anyone, including us. Login sessions are stored as hashes too, so a stolen database does not yield a usable session.

Suspending a company ends every session it has open, immediately. Verification documents live in separate storage from member-visible images, reachable only through an administrator’s own authenticated request.

You can ask us for a copy of what we hold about you, ask for a correction, or ask for your account to be deleted. When you are signed in, use Your data in Account settings; otherwise write to us from the contact page. An administrator answers each request. Deletion ends membership, and we may keep what the law requires us to keep — invoices, chiefly.

If you are not satisfied with our answer, you can complain to the data-protection authority in your country.

We use outside suppliers to run the platform, of three kinds: a hosting provider (the servers and the database), a file storage provider (photographs, documents and other files) and an email delivery provider (the emails we send you). They process data on our instructions only.

These suppliers, and so your data, may be located outside the country you are in.

Caravela is operated by Pragma Group S.A.R.L, Galaxy Complex, Block B, Floor 3, Galerie Semaan, Beirut, Lebanon, which is responsible for the personal data described on this page.

Write to us from the contact page.