This English text is a translation. In case of any difference, the Arabic text prevails.
Article 1 — Who we are
1.1 This Policy is issued by Khaima Platform (منصة خيمة), a platform officially registered with the competent government authorities, with its address at Al-Jalaa Street, Gaza City, Palestine (hereinafter "the Platform", "we" or "us").
1.2 The Platform is the controller of the personal data described in this Policy. It operates the mobile application, the website, and the systems used by its staff, camp managers and partners.
1.3 The Platform works with governmental and official bodies and with local and international humanitarian organizations to coordinate humanitarian aid.
Article 2 — Scope of this Policy
2.1 This Policy applies to organizations that use the Platform's partner portal, including local associations and charities, international organizations and United Nations agencies, governmental bodies, unions, and companies (each an "Organization"), and to the persons who use the portal on their behalf (the "Organization Users").
2.2 It also sets out the rules that govern the Organization's access to the data of families registered on the Platform. The protection of families' data is further governed by the Privacy Policy for Families and Beneficiaries.
2.3 This Policy is complemented by the written data agreement concluded between the Platform and each Organization. In case of conflict, the data agreement prevails in matters of the Organization's obligations.
Article 3 — Definitions
For the purposes of this Policy:
- Personal data: any information relating to an identified or identifiable natural person.
- Sensitive data: personal data concerning health, disability, injury, or the circumstances of death of a family member, national identity numbers, and financial account details.
- Processing: any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer and erasure.
- Partner organization: a humanitarian, charitable, governmental or international body that works with the Platform under a written data agreement.
- Official partner: a governmental or international body that has concluded a written data agreement with the Platform.
- Registration assistant: a person authorized by the Platform solely to register families on their behalf.
Article 4 — Our principles
4.1 We process personal data in accordance with the humanitarian principles of humanity, impartiality, neutrality and independence, and the principle of do no harm.
4.2 We collect only the data necessary for defined humanitarian purposes, use it only for those purposes, keep it accurate, and keep it no longer than necessary.
4.3 Decisions about a family are always taken or reviewed by a human being.
Article 5 — Data we collect about the Organization and its Users
5.1 Organization data: name, code, registration number, type, address, logo, contact person, telephone number and e-mail address, status, and documents filed in the Organization's archive on the Platform.
5.2 Organization User data: full name, national identity number (mandatory), telephone number, e-mail address, role and permissions within the Organization.
5.3 Activity data: login dates, IP address and device information, and a record of the actions each User performs on the Platform.
5.4 Operational data: aid distributions, lists of beneficiaries, imports, endorsements and reports created by the Organization.
Article 6 — Purposes and legal bases of processing
6.1 We process the data described in Article 5 in order to:
(a) create and manage the Organization's account and its Users' access;
(b) verify the identity and accountability of Organization Users;
(c) enable the coordination of aid and prevent its duplication;
(d) ensure the security of the Platform and investigate misuse; and
(e) keep the records required for audit.
6.2 This processing is based on the performance of the data agreement concluded with the Organization, on the Platform's legitimate interest in the security and integrity of aid coordination, and, where applicable, on legal obligations.
Article 7 — Data agreement and access permissions
7.1 An Organization may access families' data only after concluding a written data agreement with the Platform.
7.2 Extended permissions — such as access to families in all governorates or to unmasked identity numbers and telephone numbers — are granted only by the Platform's senior management, only after the data agreement has been signed, and are reviewed periodically.
7.3 The Platform may restrict, suspend or withdraw any permission at any time where required to protect families or the Platform.
Article 8 — The shared family registry
8.1 All Organizations work on a single, shared registry of families, in order to prevent duplication of aid and to enable coordination. An Organization may therefore see families registered or assisted by others, within the geographic scope assigned to it.
8.2 Unless specifically authorized, identity numbers and telephone numbers of families are displayed masked.
8.3 Organizations receive the basic data of families and their household size. Health and disability data are made available only to verified Organizations specialized in the relevant cases, and only to the extent necessary to assist them.
8.4 Organizations do not see the data of families that have objected to sharing with partner organizations, except as needed to deliver aid that the family has accepted.
Article 9 — Uploading lists
9.1 An Organization may upload lists of national identity numbers to the Platform. Such lists are only matched against families already registered: matching families are linked to the Organization, and unmatched numbers are kept in the Organization's roster marked "not registered". No new family record is created from an uploaded list.
9.2 Organizations may not register new families on the Platform.
9.3 The Organization is solely responsible for having collected the data in the lists it uploads lawfully, and for informing the persons concerned that their data is shared with the Platform.
Article 10 — Obligations of the Organization
The Organization and its Users undertake to:
(a) use families' data only for the humanitarian purposes stated in the data agreement;
(b) not disclose families' data to any third party beyond what the data agreement permits;
(c) keep families' data confidential and protect access credentials, and not share accounts between persons;
(d) respect the decisions of families, including their objection to sharing;
(e) notify the Platform without delay of any actual or suspected breach involving families' data; and
(f) inform the Platform without delay when a User leaves the Organization, so that the User's access is removed.
Article 11 — Exports
11.1 An Organization may export only data relating to its own lists and distributions.
11.2 Identity data in exports is masked unless the Organization holds the corresponding permission.
11.3 Every export is recorded, including the User, the date and time, the criteria used and the number of records.
Article 12 — Audit and monitoring
12.1 The Platform records the actions performed by Organization Users, together with the IP address, for security, accountability and the investigation of misuse.
12.2 The Platform may review these records, and may suspend access where misuse is suspected.
Article 13 — Retention and end of partnership
13.1 Where an Organization is suspended or its partnership ends, all of its Users lose access immediately.
13.2 Aid and distribution records are retained for seven (7) years for audit purposes, then anonymized.
13.3 The Organization's roster of numbers marked "not registered" is deleted within ninety (90) days of the end of the partnership.
13.4 Login records (IP address and device) are retained for three (3) years, then deleted.
13.5 The identity of the User who performed an action is retained for as long as the record of that action is retained.
Article 14 — Rights of Organization Users
14.1 Organization Users have the right to know what data we hold about them, to obtain a copy of it, to correct it, and to request its deletion, subject to the retention of the records required under Article 13.
14.2 Requests are submitted in accordance with Article 21.
Article 15 — Service providers
15.1 We use service providers to operate the Platform, including providers of hosting, cloud storage, communications (text messages and e-mail), payment processing, analytics and crash reporting, and technical tools used by authorized staff under their direct supervision.
15.2 Service providers process data only on our instructions and for the purposes of providing their services.
Article 16 — Disclosure to official bodies
16.1 We may disclose personal data to official partners that have concluded a written data agreement with the Platform, for humanitarian or administrative purposes related to the coordination of aid.
16.2 We may also disclose personal data where required by applicable law or by a binding judicial order.
16.3 We never disclose personal data to any military, security or foreign authority that is a party to the conflict.
Article 17 — International transfers
17.1 The Platform's servers are located in the European Union (France). Documents may be stored with a cloud storage provider in the European Union and/or other countries.
17.2 Some partner organizations operate outside Palestine. Data is shared with them only under written agreements that require appropriate protection.
Article 18 — Security
18.1 We protect personal data through measures that include encryption of connections, role-based access limited to what each user needs, and logging of actions on the Platform.
18.2 We are implementing encryption at rest of the most sensitive data, including identity numbers, health data and bank details.
18.3 Persons with access to families' data are bound by confidentiality obligations.
18.4 Backup copies are kept on a rolling basis for ninety (90) days; deleted data disappears from backups within that period.
Article 19 — Data breaches
19.1 If a breach of personal data occurs, we will take immediate measures to contain it.
19.2 We will notify affected partner organizations and, where the breach presents a high risk, the affected persons within seventy-two (72) hours of discovering it.
Article 20 — No sale, no advertising
We never sell or rent personal data, and we never use it for advertising or marketing.
Article 21 — How to exercise your rights
21.1 You may submit a request through the partner portal, by telephone or WhatsApp on +972 59-728-3833, or by e-mail to info@khaima-gaza.com.
21.2 We may verify your identity before acting on a request.
21.3 We respond within thirty (30) days. This period may be extended once by a further thirty (30) days, with notice to you.
Article 22 — Complaints
22.1 If you are not satisfied with our response, you may request a review by the Platform's management.
22.2 You may also refer the matter to the competent Palestinian authorities.
Article 23 — Persons in the European Union and the United Kingdom
Persons located in the European Union or the United Kingdom also have the rights provided under the applicable data-protection legislation, including the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with the competent supervisory authority.
Article 24 — Changes to this Policy
24.1 Amendments to this Policy are approved by the Platform's management.
24.2 We will announce material changes through the application, by text message or on the website at least thirty (30) days before they take effect, and we may ask you to acknowledge the updated Policy.
24.3 Previous versions of this Policy are kept and published.
Article 25 — Governing law and language
25.1 This Policy is governed by the applicable Palestinian legislation. The competent courts of Gaza City have jurisdiction over any dispute arising from it.
25.2 In addition, the Platform applies international humanitarian data-protection standards as a minimum baseline.
25.3 This Policy is issued in Arabic and English. In case of any difference, the Arabic text prevails.
Article 26 — Contact
Khaima Platform · Al-Jalaa Street, Gaza City, Palestine
Telephone / WhatsApp: +972 59-728-3833 · E-mail: info@khaima-gaza.com
Questions or requests about your data