Privacy Policy
Last updated: 28 September 2026This policy explains how ELHASSANE STUDIO ("we", "the Platform") handles personal data from users of our construction project-management platform. It is designed to comply with the Saudi Personal Data Protection Law (PDPL) and the EU General Data Protection Regulation (GDPR) where applicable.
1. Data we collect
| Category | Examples | Purpose |
|---|---|---|
| Account data | Name, email, job title, company name | Account creation & access management |
| Usage data | Login logs, IP address, device data | Security & platform operations |
| Business data | Projects, tasks, expenses, worker rosters | Core service delivery (processed on your behalf) |
| Uploaded files | Drawings, photos, drone reports | Storage & sync (per your instructions) |
2. Legal basis for processing
- Contract performance: to provide the services you request.
- Legitimate interest: security, platform operations, fraud prevention.
- Consent: optional marketing/newsletters (revocable at any time).
- Legal obligation: accounting & invoicing records.
3. How we share data
We never sell your personal data. We share it only:
- Service providers: hosting, email, analytics — under confidentiality agreements.
- Within your organisation: business data is stored under your company only and never shared across tenancies.
- By law: when required to comply with a legal obligation.
4. Security
We use transport encryption (TLS), cross-company data isolation (multi-tenant), role-based permissions, audit logs and encrypted backups. Logins are logged to help detect intrusions.
5. Retention
We keep account data for the life of your subscription, transaction data for statutory periods, and usage data for internal analytics for a maximum of 24 months. When an account is closed, data is permanently deleted and backups are purged within 30 days.
6. Your rights
- Access and obtain a copy of your personal data.
- Rectify inaccurate data.
- Delete your data (where a legal basis applies).
- Restrict or object to processing.
- Data portability.
- Withdraw marketing consent at any time.
Note: due to our tenancy isolation, your company admins cannot access other companies' data; access requests follow an "account owner + company admin" workflow.
7. Cookies & tracking
We use secure sessions for authentication and local storage for preferences (language, theme). We do not use third-party tracking cookies for marketing. You can browse without unnecessary cookies.
8. Cross-border data
Our servers are hosted in the Morocco region. When transferring data to trusted providers, we ensure appropriate safeguards (standard contracts/contractual clauses).
9. Minors
The platform is intended for users aged 18 and above. If we learn that a minor's data was collected without parental consent, we delete it immediately.
10. Changes to this policy
We update this policy as needed and note the date above. We notify subscribers of material changes by email.
11. Contact us
For any privacy question or to exercise your rights: elhassane.opencode@gmail.com
Data Processing Agreement: since your business is the Controller of its data and we are the Processor, your data is processed under the DPA executed with each subscriber.
← Back to home