Personal data protection policy

1. Data controller and contact

The data controller is SPA MOUSTACHIR, with its registered office at: Cité SAIDI Ahmed CICAD lotissement 47 n°1, 16000 BORDJ EL KIFFAN, Alger, Algérie.

Trade register: 19 B 0525215 - 16/00; tax ID (NIF): 001942052521562.

For any question about your personal data or to exercise your rights, write to the data protection officer: contact@moustachir.dz. For technical support: support@moustachir.com.

2. Data we collect

We only collect the data needed for the purposes described below. Depending on how you use the platform, we process the following categories:

• Professional account data: last name, first name, phone, email address, role, password (encrypted).
• Activity and audit logs: actions performed in the application, IP address.
• Data of third parties you process as part of your duties (consultants, customers, prospects): it stays confidential and may only be used for the purpose of your assignment.

3. Purposes of the processing

Your data is used only for the following purposes. We make no other use of it without your consent:

• Administer the platform and manage consultant, customer and prospect files.
• Ensure traceability of actions and access security.

4. Recipients

Your data is never sold or handed over for commercial purposes. It is only accessible to the following recipients:

• Authorised people of the company, within the limits of their duties.
• Algerian administrative or judicial authorities, when the law requires it.

5. Hosting in Algeria and no transfer abroad

Your data is hosted in Algeria, with an Algerian cloud provider, and is secured. It is neither used nor shared outside the platform service, and it is not transferred abroad.

Two types of backups exist, both located in Algeria: automatic backups every three days at the hosting provider, and an encrypted, access-restricted local copy on a private server at our head office, made roughly once a month or every two months. Deleted data disappears from backups at the end of their rotation cycle, and every restore of a backup is followed by re-applying the deletions already made.

Service emails (account verification, notifications) are sent by a mail server hosted with the same Algerian provider.

6. Security

We apply technical and organisational measures appropriate to the risks (article 38 of Law n° 18-07): encrypted connections, irreversibly encrypted passwords, role-based access limited to what is strictly necessary, private document storage, access logging, backups and staff bound by confidentiality.

7. Retention periods

We keep your data only as long as needed for the purposes for which it was collected, then delete or anonymise it:

• Account and profile: for the life of your account, then twelve (12) months after it is closed.
• Consultants' identity documents, NIN, RIB and bank proofs: for the whole duration of the collaboration, because they are necessary for the legal relationship and for paying fees, then five (5) years after it ends to meet accounting obligations and possible disputes.
• Contracts, invoices and accounting records: for the legal retention period, ten (10) years at most.
• Abandoned or refused registration files: twelve (12) months.
• Registrations through a partner: for the duration of the partnership with that partner.
• Sales prospects: three (3) years from the last contact.
• Login and security logs: twelve (12) months.

8. Your rights

You can exercise these rights free of charge by writing to contact@moustachir.dz. If you believe your rights are not respected, you may refer the matter to the National Authority for the Protection of Personal Data (ANPDP).

• Right of access: know whether your data is processed, for which purposes, which categories and which recipients, and obtain a copy.
• Right to rectification, update, erasure or blocking of data that is inaccurate, incomplete or processed in breach of the law. We answer free of charge within ten (10) days.
• Right to object, on legitimate grounds, to the processing of your data, and right to object to its use for commercial prospecting.
• Right to withdraw your consent at any time, from your account settings or by writing to us, without affecting the lawfulness of the earlier processing.

9. Cookies

We only use cookies that are strictly necessary for the service to work (login session, language, theme). We use no advertising cookies, no marketing trackers and no third-party audience analytics.

10. Data breaches

If a personal data breach occurs, we document it, notify the National Authority for the Protection of Personal Data within five (5) days of becoming aware of it and, when people's rights and freedoms are at risk, we inform the persons concerned.

11. Minors

The platform is reserved for people aged eighteen (18) or over. We do not knowingly collect data about minors.

12. Changes to this policy

We may change this policy, in particular to follow changes in the law. Any substantial change is notified to you and submitted for a new acceptance before you continue using the platform. History is identified by the version number shown at the top of this page.