Privacy Policy — Families and Beneficiaries

This English text is a translation. In case of any difference, the Arabic text prevails.

Article 1 — Who we are

1.1 This Policy is issued by Khaima Platform (منصة خيمة), a platform officially registered with the competent government authorities, with its address at Al-Jalaa Street, Gaza City, Palestine (hereinafter "the Platform", "we" or "us").

1.2 The Platform is the controller of the personal data described in this Policy. It operates the mobile application, the website, and the systems used by its staff, camp managers and partners.

1.3 The Platform works with governmental and official bodies and with local and international humanitarian organizations to coordinate humanitarian aid.

Article 2 — Scope of this Policy

2.1 This Policy applies to heads of families, family members (including children), and any person who applies to register, or is registered, as a beneficiary on the Platform.

2.2 A family may be registered only:
(a) by the family itself through the Platform's application;
(b) by a registration assistant authorized by the Platform, acting on the family's behalf; or
(c) by the Platform's authorized staff.

2.3 Partner organizations, camp managers and area managers may not register a new family; they may only work with families that are already registered.

2.4 Separate policies apply to partner organizations, to camp management, and to donors. They are available at the same address as this Policy.

Article 3 — Definitions

For the purposes of this Policy:

• Personal data: any information relating to an identified or identifiable natural person.
• Sensitive data: personal data concerning health, disability, injury, or the circumstances of death of a family member, national identity numbers, and financial account details.
• Processing: any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer and erasure.
• Partner organization: a humanitarian, charitable, governmental or international body that works with the Platform under a written data agreement.
• Official partner: a governmental or international body that has concluded a written data agreement with the Platform.
• Registration assistant: a person authorized by the Platform solely to register families on their behalf.

Article 4 — Our principles

4.1 We process personal data in accordance with the humanitarian principles of humanity, impartiality, neutrality and independence, and the principle of do no harm.

4.2 We collect only the data necessary for defined humanitarian purposes, use it only for those purposes, keep it accurate, and keep it no longer than necessary.

4.3 Decisions about a family are always taken or reviewed by a human being.

Article 5 — Data we collect

5.1 Identity data: full name, national identity number, date of birth, gender and photograph.

5.2 Contact data: telephone number and e-mail address.

5.3 Household data: the members of the family and their relationship to the head of the family, including children, with their names, identity numbers and dates of birth.

5.4 Location and housing data: governorate, city, neighborhood, camp and housing status. We do not collect the precise geographic (GPS) location of families.

5.5 Family-status data: the status of the father of the family and, where he is deceased, the date and cause of death and the death certificate, for the purpose of establishing the orphan status of children before organizations that support orphans.

5.6 Financial data: bank account details, where they are needed for cash assistance.

5.7 Documents: copies of identity documents, guardianship documents, death certificates, proof of house damage, and other documents submitted in support of the application.

5.8 Aid data: records of aid allocated, received or refused, complaints, transfer requests between camps, and needs published by the family.

5.9 Technical data: login dates, IP address, device information, notification tokens, and app usage and crash data.

Article 6 — Optional sensitive data

6.1 Information about health conditions, disability and war injuries, and the related reports and cards, is entirely optional.

6.2 Not providing this information does not affect a family's eligibility for aid provided through the Platform.

6.3 Where provided, this information is used only to enable verified organizations specialized in such cases to offer appropriate assistance, and is visible only to those organizations and to the Platform's authorized staff.

Article 7 — Sources of data

7.1 We obtain personal data:
(a) directly from you, when you register or update your information;
(b) from a registration assistant who registers you on your behalf; the assistant must read to you a short notice explaining how your data is used before completing the registration;
(c) from official civil-registry records, to verify identity and household information and to pre-fill it; and
(d) from lists submitted by partner organizations, which are only matched against families already registered and never create a new family record.

Article 8 — Purposes and legal bases of processing

8.1 We process personal data for the following purposes:
(a) registering families and verifying their eligibility;
(b) distributing aid fairly and preventing duplication;
(c) coordinating aid with partner organizations and official partners;
(d) communicating with families about their applications and aid;
(e) protecting the security of the Platform and preventing fraud; and
(f) producing aggregated, non-identifying statistics.

8.2 Because families in humanitarian need often have no real alternative to aid, we do not rely on consent as the basis for the purposes in 8.1. We rely on the vital interests of the persons concerned, the public humanitarian interest, and our legitimate interest in delivering aid fairly and securely, while informing families and respecting their right to object (Article 15).

8.3 We rely on your consent, which you may withdraw at any time, only for optional uses: public visibility of your needs (Article 12) and the publication of photographs.

Article 9 — Decisions on applications and the right of appeal

9.1 The Platform applies automated checks (such as duplicate detection and identity verification). The final decision to accept or reject an application is always taken by a member of staff.

9.2 The reasons for a rejection are communicated to the family.

9.3 A family may appeal any decision concerning it. The appeal is reviewed by a member of staff other than the one who took the original decision, and the outcome is communicated with reasons.

Article 10 — Who may access your data

10.1 Platform staff: according to their roles, on a need-to-know basis.

10.2 Your camp manager: identity and contact data and the family file for families in the manager's own camp only, for verification and aid delivery on the ground, under a signed confidentiality undertaking.

10.3 Area and governorate managers: data of families in their area, with identity numbers and telephone numbers masked unless specifically authorized.

10.4 Partner organizations: basic family data and household size, to coordinate aid. Only verified organizations specialized in the relevant cases may access health and disability data (Article 6).

10.5 Official partners: in accordance with Article 18.

10.6 Service providers: in accordance with Article 17.

10.7 Partner organizations work on a shared registry in order to prevent duplication and coordinate aid.

Article 11 — Donors

11.1 Donors do not receive your identity number, telephone number or contact details.

11.2 Any communication between a donor and a family takes place only through the Platform's messaging service.

11.3 Reports provided to donors contain aggregated statistics only, except for the needs of families who have chosen public visibility under Article 12.

Article 12 — Public visibility

12.1 Your family's information is not visible to the public by default.

12.2 You may choose, in the application, to show your needs to donors. In that case, the family name, a cover photograph, household size, housing type, neighborhood and the needs you publish may be displayed publicly in the application and on the website, and may appear in search engines.

12.3 You may switch public visibility off at any time; your information is then removed from public display.

12.4 Your identity number, telephone number and documents are never displayed publicly.

Article 13 — Children

13.1 Children's data is provided by their parent or legal guardian when registering the family.

13.2 Only persons aged eighteen (18) or over may hold an account in the application. Persons under eighteen appear only as members of their family.

13.3 Photographs showing children are published only with the explicit consent of the parent or legal guardian, which may be withdrawn at any time.

13.4 In every case, the best interests of the child prevail.

Article 14 — Retention periods

Article 15 — Your rights

15.1 You have the right to:
(a) know what data we hold about you and obtain a copy of it;
(b) correct inaccurate or incomplete data;
(c) request the deletion of your data (Article 16);
(d) object to the sharing of your data with partner organizations;
(e) withdraw your consent to optional uses at any time;
(f) appeal decisions concerning you (Article 9).

15.2 If you object to sharing with partner organizations, you will continue to receive aid provided through the Platform and your camp. However, organizations that cannot see your data may be unable to help you.

15.3 Certain rights may be limited where this is necessary to comply with a legal obligation or to keep aid records required for audit.

Article 16 — Deleting your account

16.1 You may delete your account from within the application or through the deletion link published on the Platform's website.

16.2 Within thirty (30) days of the request, we erase your name, contact details, health and disability data, documents and photographs.

16.3 We keep only anonymized aid records and a protected fingerprint of the identity number, solely to prevent duplicate registration, for the periods stated in Article 14.

16.4 Where the head of a family deletes the account, the family record is closed in the same manner, unless another adult member of the family takes over as head of the family within thirty (30) days.

Article 17 — Service providers

17.1 We use service providers to operate the Platform, including providers of hosting, cloud storage, communications (text messages and e-mail), payment processing, analytics and crash reporting, and technical tools used by authorized staff under their direct supervision.

17.2 Service providers process data only on our instructions and for the purposes of providing their services.

Article 18 — Disclosure to official bodies

18.1 We may disclose personal data to official partners that have concluded a written data agreement with the Platform, for humanitarian or administrative purposes related to the coordination of aid.

18.2 We may also disclose personal data where required by applicable law or by a binding judicial order.

18.3 We never disclose personal data to any military, security or foreign authority that is a party to the conflict.

Article 19 — International transfers

19.1 The Platform's servers are located in the European Union (France). Documents may be stored with a cloud storage provider in the European Union and/or other countries.

19.2 Some partner organizations operate outside Palestine. Data is shared with them only under written agreements that require appropriate protection.

Article 20 — Security

20.1 We protect personal data through measures that include encryption of connections, role-based access limited to what each user needs, and logging of actions on the Platform.

20.2 We are implementing encryption at rest of the most sensitive data, including identity numbers, health data and bank details.

20.3 Persons with access to families' data are bound by confidentiality obligations.

20.4 Backup copies are kept on a rolling basis for ninety (90) days; deleted data disappears from backups within that period.

Article 21 — Data breaches

21.1 If a breach of personal data occurs, we will take immediate measures to contain it.

21.2 We will notify affected partner organizations and, where the breach presents a high risk, the affected persons — through the application, a text message or their camp — within seventy-two (72) hours of discovering it.

Article 22 — App permissions and analytics

22.1 The application requests permission to send notifications, and accesses photographs and files only when you choose to upload them.

22.2 The application collects usage statistics and crash reports to improve the service. These data are not used for advertising.

22.3 The use of cookies on the Platform's website is governed by the cookie notice displayed on the website.

Article 23 — No sale, no advertising

We never sell or rent personal data, and we never use it for advertising or marketing.

Article 24 — How to exercise your rights

24.1 You may submit a request:
(a) through the application;
(b) through your camp manager or a registration assistant, who must record your request;
(c) by telephone or WhatsApp: +972 59-728-3833;
(d) by e-mail: info@khaima-gaza.com.

24.2 We may verify your identity before acting on a request.

24.3 We respond within thirty (30) days. This period may be extended once by a further thirty (30) days, with notice to you.

Article 25 — Complaints

25.1 If you are not satisfied with our response, you may request a review by the Platform's management.

25.2 You may also refer the matter to the competent Palestinian authorities.

Article 26 — Persons in the European Union and the United Kingdom

Persons located in the European Union or the United Kingdom also have the rights provided under the applicable data-protection legislation, including the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with the competent supervisory authority.

Article 27 — Changes to this Policy

27.1 Amendments to this Policy are approved by the Platform's management.

27.2 We will announce material changes through the application, by text message or on the website at least thirty (30) days before they take effect, and we may ask you to acknowledge the updated Policy.

27.3 Previous versions of this Policy are kept and published.

Article 28 — Governing law and language

28.1 This Policy is governed by the applicable Palestinian legislation. The competent courts of Gaza City have jurisdiction over any dispute arising from it.

28.2 In addition, the Platform applies international humanitarian data-protection standards as a minimum baseline.

28.3 This Policy is issued in Arabic and English. In case of any difference, the Arabic text prevails.

Article 29 — Contact

Khaima Platform · Al-Jalaa Street, Gaza City, Palestine
Telephone / WhatsApp: +972 59-728-3833 · E-mail: info@khaima-gaza.com

Annex A — Notice read to families by a registration assistant

"I am registering your family on Khaima Platform so that aid can reach you fairly. Your information will be seen only by those who help you: Platform staff, your camp manager, and partner organizations. Health and disability information is optional, and your aid does not depend on it. Nothing about you will be shown to the public unless you choose to. You may see, correct or delete your information, or object to its sharing, by calling +972 59-728-3833 or through your camp manager. The full policy is available on the Platform's website."