Privacybeleid

ASSOIMPRESE – MIDDLE EAST AND NORTH AFRICA (A-MENA), Associazione Industriali Piccole e Medie Imprese Nazionali (“ASSOIMPRESE MENA”) is an association legally registered in the Republic of Lebanon on 14 July 2014 under Official Registration Number 11559. It operates the international business networking platform publicly branded “ASSOMENA” at https://assomena.org (“Platform”). ASSOMENA is the brand name; it is not a separate data controller. Unless another controller is identified for a particular activity, ASSOIMPRESE MENA determines the purposes and means of the personal-data processing described here.

For the purposes of applicable data-protection legislation, ASSOIMPRESE MENA will generally act as the data controller where it determines the purposes and means of processing personal data through the Platform. Where another organization determines those purposes and means, that organization may instead be the relevant controller.

This notice applies to website visitors, members, staff, company employees and representatives, candidates, external meeting guests, contact-form users, franchise enquirers, persons who report a profile and persons whose information appears in member-published content. It is intended to comply with the applicable data protection legislation and, where applicable, the EU General Data Protection Regulation (GDPR) 2016/679.

Account and authentication data: name, e-mail address, password hash (for password registration), Google account identifier where Google sign-in is used, optional telephone and country, account language, time zone, verification and last-login information. A plaintext password is not ordinarily stored by ASSOIMPRESE MENA.

Profiles and company data: photograph, biography, city, job title, skills, company details, business sectors, website and social links; contact addresses, VAT identifiers and company banking data where supplied; and a company e-mail address at the company’s own website domain, where the company confirms one to obtain the Verified badge. Company bank details are access-restricted or masked according to Platform settings.

Company-team and third-party information: names, jobs, photos and e-mails of employees or invitees supplied by a company, plus details of external meeting guests. The individual concerned may not have provided this information personally.

Professional activity and transactions: company listings, products, news, events, funding/tender and trade leads, business enquiries, meeting agendas and invitations, registrations, user messages and attachments, help-desk tickets, staff notes, certificates and uploaded company documents.

Employment applications: candidate CVs (including PDF attachments), cover letters, application status and employer ratings or assessments; candidates should avoid including special-category data unless necessary and lawful.

Enquiry and support data: contact forms may include name, company, country and city, phone, e-mail, message, IP address and browser information; franchise applications may also include professional role, business turnover, proposed investment budget and business plan. Reports made through “Report this profile” include the reporter’s name, e-mail address, message and the reported profile.

Preferences, visibility and engagement: notification settings, an unused newsletter opt-in preference, profile visibility settings, saved items, company-viewer notices identifying signed-in viewers to the company owner, and AI matching scores with explanations.

Technical and device data, which may include device identifiers, operating system, language settings, login timestamps, security logs, approximate location derived from IP address, and similar diagnostic information. Technical access logs may include IP addresses, browser details, authentication session data and records of administrative actions; analytics and performance data may be collected through Vercel’s cookieless tools as described in the Cookie Policy.

The Platform does not provide dedicated form fields for health, religion, nationality, gender, date of birth or identity documents. However, users can include sensitive or special-category information in CVs, messages and uploads. Please avoid submitting such information unless lawful and necessary.

We obtain data directly from you, your employer or company administrator, other users who invite or message you, persons arranging meetings and applications, persons who report a profile, public business sites and funding/tender sources, Google sign-in, service providers and technical logs.

Users acting for a company or other organization are responsible for ensuring that any personal data they submit about colleagues, representatives or third parties has been lawfully obtained and may lawfully be provided to ASSOIMPRESE MENA.

Account identifiers needed for registration and security are necessary to provide the requested Platform service; without them an account cannot be opened or maintained. Many profile and business fields are optional, although publishing a company profile or applying to a job may require additional information specific to that feature.

Account creation, authentication, directory membership, profile management, communications, requested meetings and Platform services: performance of the agreement with the user or steps requested by the user before entering it (GDPR Article 6(1)(b), where applicable).

Security, fraud and abuse prevention, access controls, audit logging, troubleshooting, platform performance and proportionate user-generated-content moderation, including the handling of reports: our legitimate interests in maintaining a safe, reliable service (Article 6(1)(f)), subject to an appropriate balancing assessment; legal obligation where specifically required (Article 6(1)(c)).

Business-networking visibility, appropriate member activity notices, relevant product, company and opportunity discovery, company verification, contact handling and routine operational analytics, including cookieless view counting: performance of contract where necessary, or proportionate legitimate interests subject to data minimization and applicable objections and opt-outs.

Applicant information, employee/team records and company enquiries: provision of requested services and/or the legitimate interests of the participating employer, company or Platform; individual organizations may be independent controllers for their own hiring and business decisions.

AI assistant, AI company matching, document/website extraction and source-listing processing: the lawful basis appropriate to the requested feature, usually contract necessity or balanced legitimate interests; consent will be obtained where specifically required. Users may decline optional AI features where available.

Legal compliance, response to valid authority requests and disputes: compliance with legal obligations (Article 6(1)(c)) and, where applicable, legitimate interests in establishing, exercising or defending legal claims.

Optional marketing and any future non-essential trackers: consent where required by applicable law; otherwise a separately assessed lawful basis where lawful. No marketing e-mails and no advertising or marketing tracking cookies are used.

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Member profiles are generally public by default according to profile settings, but account e-mail and telephone are hidden by default. Company directory contacts may be visible to signed-in members. Uploaded certificates and company documents may be public, members-only or private according to the uploader’s setting.

Company administrators and editors can access job applications and candidate material received by their company; permitted event staff can see registrations; meeting participants can see relevant agenda and guest details; relevant recipient companies and authorized staff can view trade and contact requests. Reports made through “Report this profile” are seen only by our staff, not by the reported company.

Messages and attachments are visible to the participants. Authorized administrators can list conversations with a preview of the last message and remove messages; these access rights are not the same as unrestricted access to all message histories. Support staff may access tickets and internal notes as needed.

Staff access is permission-based; agents and sub-agents are limited to assigned countries or companies. A company owner can receive an in-app notice showing the name of a signed-in member who views the company. Users should therefore not assume that all profile viewing is anonymous.

The OpenAI-powered member assistant may receive the member’s name and e-mail, company names, user role and prompt messages. Assistant conversations are not stored by the Platform; information transmitted to the AI provider is nevertheless processed by that provider according to the applicable commercial and privacy arrangements.

AI opportunity matching sends company profiles and opportunity details and returns scores, reasons and suggested next steps, visible to relevant company members and administrators. AI profile autofill sends website addresses and available website text; event flyer autofill sends the uploaded image or text; funding/tender extraction sends publicly available listing text.

AI outputs may be inaccurate. AI match scores do not control access to features, and AI is not currently used to assess job applicants. No solely automated decision with legal or similarly significant effects on individuals has been identified in the current Platform features; this will be reassessed if functionality changes. The automatic warning signs that help our staff review new company profiles do not decide anything on their own: a staff member decides whether to act.

If an AI feature later involves processing that constitutes a significant legal decision, regulated high-risk use, or additional disclosure obligations, we will assess it and provide additional safeguards and notices before use.

The following providers support the current service, subject to the data each receives:

• Supabase (database; Stockholm, Sweden);
• Railway (servers, jobs and uploaded files; Netherlands);
• Vercel (website hosting and cookieless usage and performance analytics; Frankfurt-region hosting with a US-incorporated provider);
• OpenAI (AI features; US provider);
• Resend (platform e-mail delivery; US provider);
• Google (Google sign-in);
• Zoho (organisation e-mail; EU data centre);
• Jina AI reader (public URLs for fallback reading of public web pages);
• GoDaddy (domain registration);
• Cortex Solutions LLC (US-based technical support and development, with access that may include personal data).

Provider locations and contractual transfer arrangements may change. This list is updated whenever our providers change.

We may disclose information to member companies and employers for the requested service, qualified professional advisers, regulators or law enforcement where lawful, and successors in a permitted restructuring subject to appropriate confidentiality, necessity and legal safeguards.

We do not sell your data.

A website link to a public tender or third-party social-sharing site does not necessarily involve sending your personal data to that site until you activate it; separate third-party services may process data under their own policies.

The core website and storage infrastructure is hosted within the European Union, including services operating from Germany, Sweden and the Netherlands. However, some providers and support personnel are located or incorporated outside the EU, including in the United States, and certain features may involve access or transfer from other countries.

Where the GDPR or equivalent transfer restrictions apply, ASSOIMPRESE MENA will use an appropriate transfer mechanism and safeguards required by applicable law, such as adequacy decisions, approved contractual clauses or another lawful basis. Users may request further information at info@assomena.org.

The Platform uses authentication, security and functional cookies, browser storage for display preferences and other choices the user makes, and Vercel Web Analytics and Speed Insights, which use no cookies. No marketing or advertising tracking cookies are used.

Views of company, news and job pages by signed-out visitors are counted without a cookie. The server computes a one-way code from the date, the IP address and the browser type; it is kept for one hour only to avoid counting the same view twice, changes every day, and cannot be turned back into the IP address. Nothing is stored on the visitor’s device for this purpose.

The current names, purposes, providers and lifetimes appear in our separate Cookie Policy. None of these technologies requires prior consent; any future optional technology will be used only after consent.

We send service messages including verification, password-reset, account invitations, membership and company-status updates, applications, events, meetings, trade requests, messages, Verified badge confirmations and support replies. A message notification e-mail may contain a short preview of the new message. Meeting invitations can be sent to non-member guests with calendar details.

No marketing e-mails are currently sent. A newsletter preference is stored but not used. Members can switch off certain categories of activity e-mails in their settings; service-critical security or account notifications may remain necessary. Before any marketing starts, appropriate consent or opt-out mechanisms and any required unsubscribe functionality will be introduced.

Account information is generally retained while your account remains active and for any additional period justified by a specific lawful purpose. Members can delete their account through the Platform, with immediate account-level effect, and administrators also have deletion rights. If the person was the only administrator of a company, that company may also be deleted.

Certain records do not necessarily disappear from every system when an account is deleted: an audit record of deletion (including e-mail and role), contact submissions and reports, employee invitations, previously published news, events and trade leads and records of staff administrative actions may remain. Some information may also remain in lawful archives, backups, other users’ independently maintained records or where legal obligations and claims require it.

Members can download a limited self-service data export containing their profile, settings, sectors and saved items; the download link expires after 24 hours. Messages, job applications and tickets are not included in that self-service export. This technical limitation does not restrict a statutory access or portability request; contact us for a fuller request subject to applicable law.

The Platform does not currently delete data automatically after fixed periods. Retention is assessed by the purpose, the active relationship, applicable limitation periods, legal recordkeeping and security requirements; requests for case-specific periods may be sent to info@assomena.org.

Our security measures include HTTPS and security headers, Argon2id one-way password hashing, rotating sessions valid for up to 30 days, permission-based administrative access, audit logs recording staff changes, expiring file links and file type and size checks, plus spam protection and rate limits on selected forms.

No internet service can guarantee absolute security. Users must keep passwords secure, restrict internal staff permissions and notify us promptly of suspected compromise at info@assomena.org.

Where applicable, you may also have the right to object to certain processing, withdraw consent, request information about processing and safeguards for international transfers, and not be subject to a decision based solely on automated processing where such a right applies. These rights may be subject to statutory conditions, limitations and exemptions.

Subject to applicable law, you may request access, correction, erasure, restriction of processing, objection to processing based on legitimate interests, portability of eligible data, and information on decisions and international transfers. You may withdraw a consent at any time without affecting earlier lawful processing. You may complain to the competent supervisory authority; EU/EEA residents may complain to the authority in their habitual residence, workplace or place of alleged infringement.

Requests should be sent to info@assomena.org. We may need to verify your identity before acting on a request and may retain a record of the request as required by law.

A request may also concern information another company uploaded about you. ASSOIMPRESE MENA may need to coordinate with that company or direct you to the independent controller for that activity. We will respond within the time required by applicable law, including extensions where permitted.

The Platform is intended for business and professional users aged 18 or over and is not directed to children. We do not knowingly seek to collect personal data from children through the Platform.

The Platform does not currently perform automated age verification. If we learn that an ineligible child has registered, we will take proportionate steps to suspend the account and handle their data as required by law. Where sensitive data is voluntarily contained in submitted CVs, messages or uploads, special legal protections may apply.

We may update this Privacy Policy from time to time to reflect legal, regulatory, technical or operational developments. The revised version will be published on the Platform with an updated effective date. Where required by law, we will provide additional notice or seek renewed consent.

The website is available in several languages, but the legal pages are presently in English only. Translations, if provided later, should be checked for legal consistency.

E-mail: info@assomena.org.