This English text is a translation. In case of any difference, the Arabic text prevails.
Article 1 — Who we are
1.1 This Policy is issued by Khaima Platform (منصة خيمة), a platform officially registered with the competent government authorities, with its address at Al-Jalaa Street, Gaza City, Palestine (hereinafter "the Platform", "we" or "us").
1.2 The Platform is the controller of the personal data described in this Policy. It operates the mobile application, the website, and the systems used by its staff, camp managers and partners.
1.3 The Platform works with governmental and official bodies and with local and international humanitarian organizations to coordinate humanitarian aid.
Article 2 — Scope of this Policy
2.1 This Policy applies to camp managers and camp supervisors, and to area and governorate managers, whether they are government officials, Platform staff or community volunteers (each a "Manager"), and to the records of camps kept on the Platform.
2.2 Where a Manager is also the head or a member of a registered family, the data of that family is governed by the Privacy Policy for Families and Beneficiaries.
Article 3 — Definitions
For the purposes of this Policy:
- Personal data: any information relating to an identified or identifiable natural person.
- Sensitive data: personal data concerning health, disability, injury, or the circumstances of death of a family member, national identity numbers, and financial account details.
- Processing: any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer and erasure.
- Partner organization: a humanitarian, charitable, governmental or international body that works with the Platform under a written data agreement.
- Official partner: a governmental or international body that has concluded a written data agreement with the Platform.
- Registration assistant: a person authorized by the Platform solely to register families on their behalf.
Article 4 — Our principles
4.1 We process personal data in accordance with the humanitarian principles of humanity, impartiality, neutrality and independence, and the principle of do no harm.
4.2 We collect only the data necessary for defined humanitarian purposes, use it only for those purposes, keep it accurate, and keep it no longer than necessary.
4.3 Decisions about a family are always taken or reviewed by a human being.
Article 5 — Appointment and activation
5.1 Camp managers and supervisors are appointed by the area or governorate manager responsible for the camp's area.
5.2 Where camp directories are imported into the Platform, the area manager is responsible for informing the persons listed as Managers before the import. Accounts created in this way remain inactive until they are activated.
5.3 A Manager's access is activated only after the Manager accepts the confidentiality undertaking provided for in Article 10.
Article 6 — Data we collect about Managers
6.1 Full name, national identity number, telephone number, the assigned camp or area, and the role held.
6.2 Login dates, IP address and device information, and a record of the actions performed on the Platform.
6.3 Records of acceptance of the confidentiality undertaking, including its version, date and time.
Article 7 — Camp data
7.1 The Platform keeps, for each camp: its name, description, neighborhood, images, exact geographic location and address, needs, posts, assets, stock, and aid rounds and their records.
7.2 The exact geographic location and the address of a camp are visible only to authorized users of the Platform and to partner organizations, and are not displayed to the public.
Article 8 — What is public
8.1 Only the camp's name and neighborhood, and the needs and posts that the camp manager expressly marks as public, are displayed to the public.
8.2 Aid records and lists of families are never made public.
Article 9 — Access to families' data
9.1 A camp manager may access the identity data, contact data and file of the families in the manager's own camp only, solely for on-the-ground verification and the delivery of aid.
9.2 Area and governorate managers may access the data of families in their area, with identity numbers and telephone numbers masked unless specifically authorized.
9.3 Managers may not register a new family on the Platform; they work only with families that are already registered.
9.4 Managers must record any request that a family makes to them concerning its data (access, correction, deletion, objection or appeal) and transmit it through the Platform.
Article 10 — Confidentiality undertaking and code of conduct
10.1 Before first access, and whenever a new version is issued, every Manager must accept, within the application, the Platform's confidentiality undertaking and code of conduct.
10.2 Under this undertaking, the Manager shall in particular:
(a) use families' data only for the purposes stated in Article 9;
(b) not copy, export, photograph or take screenshots of families' data, and not share it outside the Platform;
(c) not disclose families' data to any person or body, including official bodies, other than through the Platform;
(d) protect access credentials and not share the account with any other person; and
(e) report immediately any actual or suspected breach.
10.3 Breach of the undertaking leads to the immediate suspension of access, without prejudice to any other measures available to the Platform under applicable law.
Article 11 — Photographs in camp posts
11.1 Photographs showing children are published only with the explicit consent of the parent or legal guardian, which the Manager must confirm before publication.
11.2 Any person shown in a photograph may request its removal, and the Platform will remove it from public display.
Article 12 — Purposes and legal bases of processing
12.1 We process Managers' data in order to manage their access, ensure accountability for actions taken on families' data, secure the Platform, and coordinate aid within camps.
12.2 This processing is based on the undertaking accepted by the Manager, on the Platform's legitimate interest in the security and integrity of aid coordination, and on the public humanitarian interest.
Article 13 — Audit and monitoring
The Platform records the actions performed by Managers, together with the IP address, and may review these records to ensure compliance with this Policy and with the undertaking.
Article 14 — Retention and end of role
14.1 When a Manager is removed or replaced, the Manager's access ends immediately.
14.2 The Manager's past actions remain in the audit record. The Manager's own family account, if any, is not affected.
14.3 Aid records are retained for seven (7) years, then anonymized. Login records are retained for three (3) years, then deleted.
Article 15 — Rights of Managers
15.1 Managers have the right to know what data we hold about them, to obtain a copy of it, to correct it, and to request its deletion, subject to the retention of the records required under Article 14.
15.2 Requests are submitted in accordance with Article 22.
Article 16 — Service providers
16.1 We use service providers to operate the Platform, including providers of hosting, cloud storage, communications (text messages and e-mail), payment processing, analytics and crash reporting, and technical tools used by authorized staff under their direct supervision.
16.2 Service providers process data only on our instructions and for the purposes of providing their services.
Article 17 — Disclosure to official bodies
17.1 We may disclose personal data to official partners that have concluded a written data agreement with the Platform, for humanitarian or administrative purposes related to the coordination of aid.
17.2 We may also disclose personal data where required by applicable law or by a binding judicial order.
17.3 We never disclose personal data to any military, security or foreign authority that is a party to the conflict.
Article 18 — International transfers
18.1 The Platform's servers are located in the European Union (France). Documents may be stored with a cloud storage provider in the European Union and/or other countries.
18.2 Some partner organizations operate outside Palestine. Data is shared with them only under written agreements that require appropriate protection.
Article 19 — Security
19.1 We protect personal data through measures that include encryption of connections, role-based access limited to what each user needs, and logging of actions on the Platform.
19.2 We are implementing encryption at rest of the most sensitive data, including identity numbers, health data and bank details.
19.3 Persons with access to families' data are bound by confidentiality obligations.
19.4 Backup copies are kept on a rolling basis for ninety (90) days; deleted data disappears from backups within that period.
Article 20 — Data breaches
20.1 If a breach of personal data occurs, we will take immediate measures to contain it.
20.2 We will notify affected partner organizations and, where the breach presents a high risk, the affected persons within seventy-two (72) hours of discovering it.
Article 21 — No sale, no advertising
We never sell or rent personal data, and we never use it for advertising or marketing.
Article 22 — How to exercise your rights
22.1 You may submit a request through the application, through your area manager, by telephone or WhatsApp on +972 59-728-3833, or by e-mail to info@khaima-gaza.com.
22.2 We may verify your identity before acting on a request.
22.3 We respond within thirty (30) days. This period may be extended once by a further thirty (30) days, with notice to you.
Article 23 — Complaints
23.1 If you are not satisfied with our response, you may request a review by the Platform's management.
23.2 You may also refer the matter to the competent Palestinian authorities.
Article 24 — Changes to this Policy
24.1 Amendments to this Policy are approved by the Platform's management.
24.2 We will announce material changes through the application, by text message or on the website at least thirty (30) days before they take effect, and we may ask you to acknowledge the updated Policy.
24.3 Previous versions of this Policy are kept and published.
Article 25 — Governing law and language
25.1 This Policy is governed by the applicable Palestinian legislation. The competent courts of Gaza City have jurisdiction over any dispute arising from it.
25.2 In addition, the Platform applies international humanitarian data-protection standards as a minimum baseline.
25.3 This Policy is issued in Arabic and English. In case of any difference, the Arabic text prevails.
Article 26 — Contact
Khaima Platform · Al-Jalaa Street, Gaza City, Palestine
Telephone / WhatsApp: +972 59-728-3833 · E-mail: info@khaima-gaza.com
Questions or requests about your data