Privacy Policy — Donors

This English text is a translation. In case of any difference, the Arabic text prevails.

Article 1 — Who we are

1.1 This Policy is issued by Khaima Platform (منصة خيمة), a platform officially registered with the competent government authorities, with its address at Al-Jalaa Street, Gaza City, Palestine (hereinafter "the Platform", "we" or "us").

1.2 The Platform is the controller of the personal data described in this Policy. It operates the mobile application, the website, and the systems used by its staff, camp managers and partners.

1.3 The Platform works with governmental and official bodies and with local and international humanitarian organizations to coordinate humanitarian aid.

Article 2 — Scope of this Policy

2.1 This Policy applies to individuals who donate through the Platform's application or website, and to visitors of the Platform's website (each a "Donor").

2.2 Only persons aged eighteen (18) or over may create an account on the Platform.

Article 3 — Definitions

For the purposes of this Policy:

• Personal data: any information relating to an identified or identifiable natural person.
• Sensitive data: personal data concerning health, disability, injury, or the circumstances of death of a family member, national identity numbers, and financial account details.
• Processing: any operation performed on personal data, including collection, recording, storage, use, disclosure, transfer and erasure.
• Partner organization: a humanitarian, charitable, governmental or international body that works with the Platform under a written data agreement.
• Official partner: a governmental or international body that has concluded a written data agreement with the Platform.
• Registration assistant: a person authorized by the Platform solely to register families on their behalf.

Article 4 — Our principles

4.1 We process personal data in accordance with the humanitarian principles of humanity, impartiality, neutrality and independence, and the principle of do no harm.

4.2 We collect only the data necessary for defined humanitarian purposes, use it only for those purposes, keep it accurate, and keep it no longer than necessary.

4.3 Decisions about a family are always taken or reviewed by a human being.

Article 5 — Data we collect

5.1 Account data: name, e-mail address and/or telephone number, password (stored in protected form), and, where you sign in through a third-party account, the identifier provided by that account.

5.2 Donation data: donations made, their amounts and dates, the needs or families supported, your choice of anonymity, messages you write, wallet top-ups, and packages purchased or shipped.

5.3 Communications: messages exchanged with families through the Platform's messaging service.

5.4 Technical data: login dates, IP address, device information, notification tokens, app usage and crash data, and, on the website, cookies in accordance with Article 11.

5.5 In-app service data: the sections and governorates you follow in the news section and their notification settings, the news items you opened, your reactions and comments on news, and support messages and their attachments.

Article 6 — Purposes and legal bases of processing

6.1 We process your data in order to:
(a) create and manage your account;
(b) process your donations and deliver them to their beneficiaries;
(c) issue confirmations and keep financial records;
(d) prevent fraud and protect the security of the Platform; and
(e) communicate with you about your donations and your account;
(f) send you news and alerts according to your preferences; and
(g) answer support requests.

6.2 This processing is based on the performance of the service you request, on the legal obligation to keep financial records, and on the Platform's legitimate interest in preventing fraud. Website analytics are based on your consent (Article 11).

Article 7 — Payments

7.1 Card payments are processed by a specialized payment processor. The Platform does not receive or store your card number.

7.2 Cryptocurrency donations are processed by a specialized cryptocurrency payment processor.

7.3 Donation forms may be protected by an automated anti-abuse verification service.

Article 8 — Anonymity

8.1 You may choose to donate anonymously.

8.2 Where you do not choose anonymity, your name may be shown to the family or need you support, together with any message you write.

8.3 If you comment on a news item in the app, your comment is shown to registered app users with your first name and family name only, and you may delete it at any time. Other users cannot see who read or reacted to news, and staff see totals only.

Article 9 — What you see about families, and your obligations

9.1 You see only the needs of families that have chosen to make them public. You do not receive families' identity numbers, telephone numbers or contact details.

9.2 Any communication with a family takes place only through the Platform's messaging service.

9.3 You undertake not to attempt to identify, locate or contact any family outside the Platform, not to publish information or images of families, and not to use the Platform to exert pressure on or seek any benefit from a family. The Platform may suspend any account that breaches this undertaking.

Article 10 — Communications

10.1 We send you messages related to your account and your donations.

10.2 We never use families' data for marketing.

10.3 First replies to support messages may be given by an automated assistant using artificial intelligence; its replies are labelled as coming from the automated assistant. The assistant does not receive your name or contact details unless you write them in your message, and you may ask in the conversation at any time to speak to a member of staff.

Article 11 — Website cookies and analytics

11.1 The Platform's website uses essential cookies necessary for it to function.

11.2 Analytics cookies, which help us understand how the website is used, are activated only after you accept them through the cookie banner. You may change your choice at any time through the "Cookie settings" link at the bottom of the website.

11.3 The application collects usage statistics and crash reports to improve the service. These data are not used for advertising.

Article 12 — Retention periods

Article 13 — Deleting your account

13.1 You may delete your account from within the application or through the deletion link published on the Platform's website.

13.2 Within thirty (30) days of the request, we erase your account data and your messages.

13.3 Donation and payment records are kept in anonymized form for seven (7) years, as required for financial records.

Article 14 — Your rights

14.1 You have the right to know what data we hold about you and to obtain a copy of it, to correct it, to request its deletion (Article 13), and to withdraw your consent to analytics cookies at any time.

14.2 Requests are submitted in accordance with Article 22.

Article 15 — Service providers

15.1 We use service providers to operate the Platform, including providers of hosting, cloud storage, communications (text messages and e-mail), payment processing, analytics and crash reporting, and technical tools used by authorized staff under their direct supervision.

15.2 Service providers process data only on our instructions and for the purposes of providing their services.

15.3 We use artificial-intelligence services provided by a technology provider for: (a) a first review of identity documents uploaded by families (Article 9 of the Families and Beneficiaries Policy); (b) first replies to support messages; and (c) preparing general news and the aggregated statistics we publish. We send these services only the minimum data each task needs. The provider is bound not to use the data to train its models, and every decision concerning a person remains with Platform staff.

15.4 The news section of the app is prepared with the help of automated tools that collect news from public news sources, write it up and may publish it automatically. News items may include the names of people as they appear in those sources. Anyone may ask us to remove their name, the name of a relative, or any information about them from a published item under Article 22, and we will act on the request without delay.

Article 16 — Disclosure to official bodies

16.1 We may disclose personal data to official partners that have concluded a written data agreement with the Platform, for humanitarian or administrative purposes related to the coordination of aid.

16.2 We may also disclose personal data where required by applicable law or by a binding judicial order.

16.3 We never disclose personal data to any military, security or foreign authority that is a party to the conflict.

Article 17 — International transfers

17.1 The Platform's servers are located in the European Union (France). Documents may be stored with a cloud storage provider in the European Union and/or other countries.

17.2 Some partner organizations operate outside Palestine. Data is shared with them only under written agreements that require appropriate protection.

17.3 The artificial-intelligence provider referred to in Article 15 is located in the United States of America. Data sent for the purposes of that Article is transferred to and processed there, under contractual terms that require the provider to protect it.

Article 18 — Security

18.1 We protect personal data through measures that include encryption of connections, role-based access limited to what each user needs, and logging of actions on the Platform.

18.2 We are implementing encryption at rest of the most sensitive data, including identity numbers, health data and bank details.

18.3 Persons with access to families' data are bound by confidentiality obligations.

18.4 Backup copies are kept on a rolling basis for ninety (90) days; deleted data disappears from backups within that period.

Article 19 — Data breaches

19.1 If a breach of personal data occurs, we will take immediate measures to contain it.

19.2 We will notify affected partner organizations and, where the breach presents a high risk, the affected persons within seventy-two (72) hours of discovering it.

Article 20 — No sale, no advertising

We never sell or rent personal data, and we never use it for advertising or marketing.

Article 21 — Persons in the European Union and the United Kingdom

Persons located in the European Union or the United Kingdom also have the rights provided under the applicable data-protection legislation, including the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with the competent supervisory authority.

Article 22 — How to exercise your rights

22.1 You may submit a request through the application, by telephone or WhatsApp on +972 59-728-3833, or by e-mail to info@khaima-gaza.com.

22.2 We may verify your identity before acting on a request.

22.3 We respond within thirty (30) days. This period may be extended once by a further thirty (30) days, with notice to you.

Article 23 — Complaints

23.1 If you are not satisfied with our response, you may request a review by the Platform's management.

23.2 You may also refer the matter to the competent Palestinian authorities.

Article 24 — Changes to this Policy

24.1 Amendments to this Policy are approved by the Platform's management.

24.2 We will announce material changes through the application, by text message or on the website at least thirty (30) days before they take effect, and we may ask you to acknowledge the updated Policy.

24.3 Previous versions of this Policy are kept and published.

Article 25 — Governing law and language

25.1 This Policy is governed by the applicable Palestinian legislation. The competent courts of Gaza City have jurisdiction over any dispute arising from it.

25.2 In addition, the Platform applies international humanitarian data-protection standards as a minimum baseline.

25.3 This Policy is issued in Arabic and English. In case of any difference, the Arabic text prevails.

Article 26 — Contact

Khaima Platform · Al-Jalaa Street, Gaza City, Palestine
Telephone / WhatsApp: +972 59-728-3833 · E-mail: info@khaima-gaza.com

Annex — Version history

Version 1.1 — effective 18-10-2026: this version discloses services added to the Platform after version 1.0: the use of artificial-intelligence services for a first review of identity documents, for first replies to support messages and for preparing and publishing news, with the data these services need transferred to a provider in the United States of America; the news section (following, notifications, reactions and comments); technical support and account recovery; surveys; and requests to form an independent family. This version does not change any of your rights.

Version 1.0 — effective 06-10-2026: first version.