Privacy Policy
This policy explains what personal data ATHAR processes, why it is needed, how it is protected, and the choices available to people who use the platform.
Data we process
Depending on the service used, ATHAR may process account and contact details, language and consent choices, security and session records, donation-balance and top-up records, allocations, receipts, messages, support requests, and volunteer or employment application information. An application may include an optional private PDF CV.
Purposes of processing
Data is used to provide requested services, authenticate users, protect accounts, process and reconcile financial records, issue eligible receipts, manage applications and support conversations, communicate material updates, meet legal obligations, prevent abuse, and maintain accountable audit records.
Access and sharing
Access is limited according to role and operational need. Sensitive records are available only to the account holder or specifically authorized ATHAR personnel. Data may be processed by approved infrastructure, payment, receipt, storage, email, or monitoring providers under appropriate contractual and security controls. ATHAR does not sell personal data.
Security and storage
ATHAR applies server-side authorization, database row-level security, restricted storage paths, encrypted transport, audit logging, and provider-secret isolation. No online service can guarantee absolute security; suspected incidents are investigated and handled through the approved incident process.
Retention
Personal data should be retained only for an approved operational, legal, accounting, security, or safeguarding purpose. Financial, receipt, audit, and safeguarding records may require longer retention than ordinary account data. Final retention periods require owner and legal approval and must be documented before public launch.
Your choices and rights
Subject to applicable law and record-preservation duties, you may request access, correction, export, restriction, objection, or deletion of eligible personal data. You may manage optional notification preferences from your account. Security-critical communications and records that must be preserved for legal or financial integrity may not be optional.
Contact and policy updates
Privacy questions and rights requests should use the approved contact channel published by ATHAR. Material policy changes should be versioned, reviewed, and published through the controlled content process.