Skip to content
SADT — Syrian Association for Digital Transformation ع Sign in Join

Privacy Policy

Draft — pending legal review. This page is a working draft describing what sadt.org actually collects and how it is used today. It has not yet been reviewed by a lawyer; bracketed items (data controller details, retention periods, applicable legal bases, hosting location) must be confirmed before this is published as final.

Last updated: [date] — replace once approved.

1. Who this policy covers

This policy applies to visitors and members of sadt.org, operated by Syrian Association for Digital Transformation ("SADT"). Data controller: [legal entity name and registered address to be confirmed]. Privacy contact: [email address to be confirmed] or via the contact form.

2. What we collect

  • Account data: name, email address, and a securely hashed password (or third-party sign-in identifier if you use one).
  • Profile data (optional): bio, country, skills and availability, shown in the Members directory only if you turn on directory visibility.
  • Content you post: forum topics and replies, RFCs, working-group and project contributions, and any files or links you include.
  • Contact/enquiry data: name, email and message when you use the contact form, plus which topic you selected (general, partnership, media, or security).
  • Technical data: IP address (used for rate-limiting and abuse prevention), session identifiers, CSRF tokens, and error/request logs identified by a request ID for troubleshooting.

3. Cookies & local storage

The Site uses a session cookie to keep you signed in and a CSRF token stored in your session to protect forms from cross-site attacks — both are strictly necessary for the Site to function. Your light/dark theme preference is stored only in your browser's local storage, not sent to our servers or shared with third parties. We do not use third-party advertising or analytics cookies.

4. Spam & bot protection (ALTCHA)

Public forms (like the contact form) use ALTCHA, a privacy-preserving proof-of-work challenge. Unlike some alternatives, it does not track you across sites or share your data with a third-party advertising network.

5. How we use your data

We use your data to operate your account, display your content to other members as you've configured it, respond to enquiries, moderate the community, secure the Site against abuse, and comply with legal obligations. We do not sell your personal data.

6. Legal basis for processing

Where applicable law requires a stated legal basis (for example, for members in the EU/EEA or UK), we process account and profile data based on your consent and our performance of the agreement formed by these terms, and technical/security data based on our legitimate interest in keeping the Site secure. [To be confirmed in full by legal counsel once the applicable jurisdictions are known.]

7. Sharing with third parties

We may share data with: email delivery providers (to send verification and notification emails), a third-party sign-in provider if you choose to use one, and law enforcement or regulators where legally required. We do not sell or rent your personal data to advertisers.

8. Data retention

Account and content data is retained while your account is active. Enquiry-form submissions and security logs are retained for [retention period to be confirmed] for support and security purposes. You may request deletion of your account and associated personal data via the contact form, subject to any legal retention requirements.

9. Your rights

Depending on your location, you may have rights to access, correct, export or delete your personal data, and to opt out of directory visibility (available directly in your account settings). To exercise these rights, use the contact form or the privacy contact above.

10. Children's privacy

The Site is not directed at children under [age to be confirmed — 16 or 18 depending on jurisdiction] and we do not knowingly collect personal data from them. If you believe a child has provided us data, please contact us so we can remove it.

11. International & diaspora members

SADT's community includes members inside Syria and in the diaspora worldwide. Data may be processed on servers located in [hosting location to be confirmed], which may be outside your country of residence. [Cross-border transfer safeguards to be confirmed by legal counsel.]

12. Security measures

We use password hashing, optional two-factor authentication, CSRF protection, rate limiting, encrypted secrets, and standard security headers to protect your data. No system is completely secure, and we cannot guarantee absolute security.

13. Changes to this policy

We may update this policy from time to time; material changes will be noted on this page with an updated date.

14. Contact

For privacy questions or data requests, use the contact form or [privacy email to be confirmed].