iBassma Digital Studio, operating under the trade name Loubnan Network, registered in Lima, Peru, is the owner and operator of the Loubnan Network platform and the data controller for all personal data collected through it.

The Loubnan Network platform consists of the main website loubnan.net — a static gateway — and the city sub-sites (such as saida.loubnan.net, beirut.loubnan.net, and others), which host all interactive services. All sites operate under a single unified legal framework.

This document sets out how the Platform collects, uses, and protects the personal data of its users, in accordance with the Peruvian Personal Data Protection Law (Ley N° 29733) and its implementing regulations.

2.1 What This Policy Covers

This Policy applies to all personal data collected or processed by the Loubnan Network platform in the following contexts: registering an Account and using the Platform, using any of the services available on the Platform, submitting applications, listings, or content, and sending any communications to the Platform.

2.2 What This Policy Does Not Cover

This Policy does not apply to: third-party websites or services that the Platform may link to, the manner in which employers handle job applicant data after receiving it, or any data processing carried out outside the Platform by independent third parties.

2.3 Relationship with Our Terms

This Policy supplements — and does not replace — the General Terms and Conditions, the Entity Registration Agreement, and any service-specific policies. In the event of any conflict between this document and any other legal document regarding the processing of personal data, the provisions of this Policy shall prevail.

3.1 Account and Profile Data

Collected at registration or when editing your profile.

3.2 Moderation and Enforcement Data

Collected automatically by the Platform's moderation system. Never displayed publicly; accessible only to authorized administrators.

3.3 Job Board Profile Data

Collected when creating a CV or company profile. All data is provided voluntarily.

Jobseeker CV Data:

Employer Company Profile Data:

3.4 City Memory Contributor Data

3.5 Village Portal Entity Data

Retained for managing entity assignments and resolving competing claims. See the Entity Registration Agreement for full details.

3.6 Listing and Content Data

When you submit a listing through any service (Business Directory, Classifieds, Real Estate, Job Board, City Memory, Cultural Events), we collect all information you provide including text, images, documents, contact details, and associated metadata such as category, location, and submission date.

3.7 Subscription and Payment Data

When you purchase a subscription, we collect: subscription type, price paid, payment date, duration, activation date, expiry date, and the administrator who reviewed it. Payment card details are not stored beyond what is necessary for transaction processing.

3.8 Entity Registration Application Data

When you apply to register an Entity, we collect: your eligibility category, community connection description, supporting documents, and the review outcome. Retained for a minimum of five (5) years from the decision date.

3.9 Communications Data

If you contact us by email or through a Platform form, we retain a record of your message and our response for managing your inquiry and improving our services.

3.10 Automatically Collected Technical Data

The Company uses personal data for operational, administrative, and legal purposes related to providing and managing the Platform's services. Data is processed only for the purposes specified in this Policy or as required by law.

4.1 Account Management

Creating and managing your Account, verifying your identity at login, maintaining account security, enabling profile editing, and managing user roles and access permissions.

4.2 Service Operations

Displaying listings and user-generated content; operating the Business Directory, Classifieds, Real Estate, Job Board, City Memory, Village Portal, and Cultural Events services.

4.3 Requests and Subscriptions Processing

Processing applications, activating purchased services, managing subscription durations and expiry, processing administrative reviews, and maintaining financial and operational records.

4.4 Moderation and Enforcement

Detecting violations, enforcing Terms and Conditions, managing reports and red flags, and protecting users and the Platform from abuse.

4.5 Communications

Responding to inquiries, sending account or service notifications, notifying you of material changes to legal documents or operational policies.

4.6 Analytics and Platform Improvement

Understanding how the Platform is used, improving performance and stability, detecting and resolving technical issues, and developing current and future services.

4.7 Legal Compliance

Complying with applicable laws and regulations, responding to lawful requests from competent authorities, and preventing fraud, abuse, or unlawful activity.

As a data controller operating under Peruvian law — specifically the Personal Data Protection Law (Ley N° 29733) — we process your personal data on one or more of the following legal bases:

5.1 Performance of a Contractual Relationship

Some data is necessary to perform the contractual relationship: creating and managing your Account, delivering requested services, managing subscriptions, processing applications and listings. Where required data is not provided, delivery of the relevant service may not be possible.

5.2 Consent

In some cases processing is based on your consent: optional profile information, personalization or visibility settings, and any data you voluntarily provide beyond core service requirements. You may withdraw consent at any time where permitted by law.

5.3 Legitimate Interests

Including: operating and maintaining Platform stability, protecting system and account security, preventing fraud and abuse, developing and improving services, and managing disputes and reports. The Company seeks a reasonable balance between its legitimate interests and users' rights.

5.4 Legal Obligations

Some processing is necessary to comply with legal or regulatory obligations: retaining records for mandatory periods, responding to lawful orders, and cooperating with competent bodies where the law requires it.

The Platform is committed to data minimization. The following categories are neither collected nor processed:

6.1 No Social Media Data

No integration of any kind with social media platforms. We do not collect data from Facebook, Instagram, Twitter/X, TikTok, LinkedIn, WhatsApp, Telegram, or any other social network. No social media login (OAuth). No sharing buttons, widgets, or tracking pixels from any social platform. This is a permanent and unconditional platform policy.

6.2 No Third-Party Advertising Data

We do not use Google Ads, Facebook Ads, TikTok Ads, or any third-party advertising network. No third-party advertising cookies or tracking pixels. Advertising on the Platform is managed directly through our own subscription system.

6.3 No Third-Party Analytics

We do not use Google Analytics, Google Tag Manager, or any cloud-based third-party analytics service. All analytics are handled by our own self-hosted Matomo instance (see Section 7).

6.4 No Biometric Data

We do not collect any biometric data including fingerprints, facial recognition data, voice prints, or any other biometric identifiers.

6.5 No Sensitive Personal Data

We do not knowingly collect data relating to: racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, health data, genetic data, or sexual life or orientation.

6.6 No Precise Geolocation

We do not collect GPS-level geolocation data. Location information is limited to city or district level and is entered voluntarily by the user as free text.

6.7 No Plain-Text Passwords

Passwords are never stored in any readable form. They are processed through a one-way cryptographic hash function before storage.

7.1 Privacy-First Approach

The Platform operates on a privacy-first, data-minimization basis. We do not use any third-party analytics or tracking services that collect or share user data outside our own infrastructure.

7.2 Analytics Platform Used

The Platform uses Matomo, an open-source, self-hosted web analytics platform installed entirely on our own servers. No analytics data is transmitted to any external service. Matomo is configured to anonymize IP addresses — the last two octets of each IPv4 address are replaced with zeros.

7.3 Data Collected by Analytics

The analytics system may collect: pages visited, visit duration, navigation path, browser type and version, operating system, screen resolution, browser language preference, and approximate country or region derived from the anonymized IP address. Used for statistical and operational purposes only.

7.4 Data Not Used in Analytics

The Platform does not use analytics to: create marketing profiles, track users across multiple websites, sell or share data for advertising, or make automated decisions that legally or materially affect users.

7.5 No Third-Party Tracking Tools

The Platform does not use any of the following: Google Analytics, Google Tag Manager, Facebook Pixel, TikTok Pixel, LinkedIn Insight Tag, Hotjar, or Microsoft Clarity. The Platform also respects the Do Not Track (DNT) browser signal — if your browser sends a DNT signal, our analytics system will not record your visit.

The Platform uses a minimal set of cookies. We do not use advertising, profiling, or third-party tracking cookies.

8.1 Cookies

8.2 Browser localStorage

localStorage data is stored entirely on your device and is never transmitted to our servers.

8.3 Essential, Functional, and Analytics Cookies

Essential (wordpress_logged_in_*, wordpress_sec_*): required for the Platform to function — disabling them will prevent login. Functional (lbn_cl_layout, lbn_bd_viewed_*, lbn_re_viewed_*): serve a specific feature purpose, not required for core access. Analytics (_pk_id.*, _pk_ses.*): support self-hosted analytics — no data leaves our servers.

8.4 Managing Cookies

You may control and delete cookies through your browser's settings. Deleting essential cookies will log you out.

9.1 Where Your Data Is Stored

Your data is stored on servers operated by FlokiNET (Iceland and/or Romania). Encrypted backup copies are maintained on Hetzner Storage Box (Germany), protected with GPG encryption such that even the storage provider cannot access the contents. All data transmissions are encrypted using HTTPS/TLS.

9.2 Technical Protection Measures

• Encrypted communication protocols (HTTPS/TLS) on all connections
• One-way cryptographic hashing of all passwords
• Access control and permission systems
• XML-RPC disabled; REST API user enumeration endpoint blocked
• HTTP security headers enforced (X-Content-Type-Options, X-Frame-Options)
• Login key guard and CAPTCHA via FriendlyCaptcha (EU-hosted)
• Server monitoring systems and security logs
• Rate limiting and automated blocking of abusive access patterns
• Regular security updates to software and infrastructure

9.3 Organizational Protection Measures

Access to data is granted on a minimum-necessary basis for the performance of operational or administrative duties.

9.4 Media Files

User-uploaded images, documents, and CV files are stored in the Platform's WordPress media library on our hosting servers. Access is controlled at the server level.

9.5 User Responsibility

Users are responsible for: maintaining password confidentiality, not sharing login credentials, using trusted devices and networks where possible, and notifying the Company immediately upon suspecting unauthorized access.

9.6 No Absolute Guarantee

No internet transmission or storage system is entirely secure. In the event of a data breach that poses a significant risk to your rights, we will notify affected users and competent authorities as required by applicable law.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer period is required by law or legitimate operational necessity.

10.1 Standard Retention Periods

10.2 Account Deletion

When a user deletes their account through the "Delete My Account" option, associated data is processed in accordance with the General Terms and Conditions and the retention periods set out in this Policy.

10.3 Retention for Legal or Security Reasons

The Company may retain certain data for longer periods where necessary to comply with a legal obligation, investigate fraud or abuse, protect legal rights, or resolve disputes.

10.4 Backup Copies

Some data may continue to appear within backup copies for a limited period after deletion from primary operational systems, until those backups are replaced or their retention cycle ends.

The Company does not sell, rent, or trade your personal data. Data is shared only in the limited circumstances described below.

11.1 Public Profile and Content

Information you choose to make public through your profile, listings, Entity page, or City Memory contributions is visible to all visitors of the Platform, including unregistered users.

11.2 Job Applications

When you apply for a job, a snapshot of your CV data at the time of application is attached to your application and made visible to the employer who posted the job. By submitting an application, you consent to this disclosure.

11.3 Service Providers

• FlokiNET (Iceland / Romania) — primary hosting provider; stores all Platform data
• Hetzner Storage Box (Germany) — backup storage; GPG-encrypted copies
• Email delivery provider — used to send account notifications and inquiry responses

11.4 Legal Requirements

We may disclose your data to law enforcement, courts, or regulatory bodies when required by applicable Peruvian law, a court order, or any other lawful legal process. We will make reasonable efforts to notify you where legally permitted.

11.5 Protection of Rights

We may disclose data where we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of the Company, our users, or the public.

11.6 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify affected users before their data is transferred to an entity subject to a materially different privacy policy.

12.1 International Nature of the Platform

Because the Company is registered in Peru and its infrastructure and service providers are located across multiple countries, your data may be processed or stored outside the country in which you reside.

12.2 Countries Where Data Is Stored or Processed

Your data is stored and processed in Iceland, Romania, Germany, and Peru. All transfers are conducted with appropriate technical and contractual safeguards.

12.3 Protection Measures

We do not transfer personal data to countries or entities that do not provide an adequate level of protection, except where we have implemented appropriate safeguards or where you have given your explicit consent. By using the Platform, you acknowledge that your data may be transferred to, stored in, or processed in jurisdictions other than your country of residence.

You have the following rights under Peruvian law (Ley N° 29733), to the extent permitted by applicable law and legitimate operational, security, or legal requirements.

13.1 Right of Access

You may request confirmation of whether we are processing personal data about you, and request access to that data.

13.2 Right of Rectification

If your personal data is inaccurate or incomplete, you may request correction or update. You may also update most profile data directly through your Account dashboard at any time.

13.3 Right of Cancellation (Deletion)

You may request deletion of your personal data or Account by contacting us at welcome@loubnan.net. We will process confirmed requests within 30 days, subject to any legal obligations requiring longer retention (see Section 10). Deletion of your Account does not entitle you to a refund of any paid subscription.

13.4 Right of Opposition

You may object to processing of your personal data for specific purposes, including processing based on our legitimate interests, where your individual circumstances warrant it.

13.5 Right to Restriction of Processing

In certain cases, you may request that we temporarily limit the use of your personal data while an objection or dispute is being reviewed.

13.6 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of any processing carried out before the withdrawal.

13.7 How to Exercise Your Rights

Contact us at welcome@loubnan.net with the subject line "Data Rights Request" and specify which right you wish to exercise. We will respond within 30 days. We do not charge a fee for rights requests unless they are manifestly repetitive or excessive.

13.8 Limits on Rights

Some rights may be subject to restrictions or exceptions imposed by law, legitimate operational necessity, or platform security and integrity requirements.

14.1 Minimum Age Requirement

Users must be at least sixteen (16) years of age to register an Account and use the general services of the Platform.

14.2 Age-Restricted Services

The following require a minimum age of eighteen (18) years: purchasing subscriptions and paid services, registering and managing Entities, and any other financial transactions or obligations the Platform may offer.

14.3 No Intentional Collection from Children

The Platform does not target or intentionally collect personal data from individuals under 16. If we become aware of inadvertent collection from a child under 16, we will delete that data promptly. If you are a parent or guardian and believe your child has registered, please contact us at welcome@loubnan.net.

14.4 Discovery of Non-Eligible Accounts

If the Company has reasonable grounds to believe an account was created by a person who does not meet the minimum age requirement, it may: temporarily suspend the account, request additional information to verify age, or delete the account and all associated data.

15.1 External Links

The Platform may contain links to external websites or services operated by third parties. These links are provided for informational or convenience purposes only. The Company does not control the content, policies, or data practices of those websites.

15.2 No Liability

The Company bears no responsibility for: the privacy practices of third parties, the content of external websites, the services or products they offer, or any damages or losses arising from their use. Use of third-party websites is entirely at the user's own risk.

15.3 Review Third-Party Policies

When navigating to any external website, users are advised to review that site's privacy policy and legal terms before providing any personal data.

16.1 Right to Amend

The Company reserves the right to amend, update, or replace this Privacy Policy at any time as a result of: legal or regulatory changes, development of Platform services or addition of new services, technical or operational changes, or improvements to privacy and data protection practices.

16.2 Notification of Changes

When material changes are made, the Company will update the "Last Updated" date at the top of this document. Where reasonably practicable, it may also notify registered users by email or by a notice displayed on the Platform.

16.3 Continued Use

Your continued use of the Platform after the publication of a revised Policy constitutes your acceptance of the updated Policy. If you do not agree, you should cease using the Platform and, where applicable, request deletion of your Account.

17.1 Contact Us

For any questions, concerns, data rights requests, or other privacy-related communications:

We aim to respond to all privacy-related inquiries within 30 days.

17.2 Privacy Complaints

If you believe the Company has not handled your personal data in accordance with this Policy, you may contact us first. If you are unsatisfied with our response, you have the right to lodge a complaint with the competent authority in Peru:

We encourage you to contact us before approaching the regulatory authority.

17.3 Identity Verification

To protect user privacy and security, the Company may request reasonable additional information to verify the identity of any person submitting a data rights request or privacy complaint before taking any action.