Personal data protection policy

1. Data controller and contact

The data controller is SPA MOUSTACHIR, with its registered office at: Cité SAIDI Ahmed CICAD lotissement 47 n°1, 16000 BORDJ EL KIFFAN, Alger, Algérie.

Trade register: 19 B 0525215 - 16/00; tax ID (NIF): 001942052521562.

For any question about your personal data or to exercise your rights, write to the data protection officer: contact@moustachir.dz. For technical support: support@moustachir.com.

2. Data we collect

We only collect the data needed for the purposes described below. Depending on how you use the platform, we process the following categories:

• Identity and contact: last name, first name, phone, email address, password (stored in irreversibly encrypted form).
• Professional profile: headline, biography, specialisations, certifications, hourly rate, availability, professional links.
• Identity documents: national identification number (NIN) and a copy of the identity card.
• Bank data: bank identity statement (RIB) and bank proof (crossed cheque), needed to pay your fees.
• Contract and financial data: membership agreement, sessions, invoices and payments.
• Technical data: IP address, browser type, login and security logs.

3. Purposes of the processing

Your data is used only for the following purposes. We make no other use of it without your consent:

• Create and manage your account, authenticate you and secure access.
• Verify your identity and establish your membership agreement (identity document, NIN).
• Pay your fees (RIB, bank proof) and keep the accounts.
• Show your professional profile to the client organisations you work with, for matching and mission follow-up.
• Send you service communications (verification, security, missions, payments).
• Keep the platform secure and prevent fraud.

4. Recipients

Your data is never sold or handed over for commercial purposes. It is only accessible to the following recipients:

• Authorised teams of the company (administration, verification, accounting), within the limits of their duties.
• The client organisations you work with, only for your professional profile and mission contact details, with your consent.
• Algerian administrative or judicial authorities, when the law requires it.

5. Hosting in Algeria and no transfer abroad

Your data is hosted in Algeria, with an Algerian cloud provider, and is secured. It is neither used nor shared outside the platform service, and it is not transferred abroad.

Two types of backups exist, both located in Algeria: automatic backups every three days at the hosting provider, and an encrypted, access-restricted local copy on a private server at our head office, made roughly once a month or every two months. Deleted data disappears from backups at the end of their rotation cycle, and every restore of a backup is followed by re-applying the deletions already made.

Service emails (account verification, notifications) are sent by a mail server hosted with the same Algerian provider.

6. Security

We apply technical and organisational measures appropriate to the risks (article 38 of Law n° 18-07): encrypted connections, irreversibly encrypted passwords, role-based access limited to what is strictly necessary, private document storage, access logging, backups and staff bound by confidentiality.

7. Retention periods

We keep your data only as long as needed for the purposes for which it was collected, then delete or anonymise it:

• Account and profile: for the life of your account, then twelve (12) months after it is closed.
• Consultants' identity documents, NIN, RIB and bank proofs: for the whole duration of the collaboration, because they are necessary for the legal relationship and for paying fees, then five (5) years after it ends to meet accounting obligations and possible disputes.
• Contracts, invoices and accounting records: for the legal retention period, ten (10) years at most.
• Abandoned or refused registration files: twelve (12) months.
• Registrations through a partner: for the duration of the partnership with that partner.
• Sales prospects: three (3) years from the last contact.
• Login and security logs: twelve (12) months.

8. Your rights

You can exercise these rights free of charge by writing to contact@moustachir.dz. If you believe your rights are not respected, you may refer the matter to the National Authority for the Protection of Personal Data (ANPDP).

• Right of access: know whether your data is processed, for which purposes, which categories and which recipients, and obtain a copy.
• Right to rectification, update, erasure or blocking of data that is inaccurate, incomplete or processed in breach of the law. We answer free of charge within ten (10) days.
• Right to object, on legitimate grounds, to the processing of your data, and right to object to its use for commercial prospecting.
• Right to withdraw your consent at any time, from your account settings or by writing to us, without affecting the lawfulness of the earlier processing.

9. Cookies

We only use cookies that are strictly necessary for the service to work (login session, language, theme). We use no advertising cookies, no marketing trackers and no third-party audience analytics.

10. Data breaches

If a personal data breach occurs, we document it, notify the National Authority for the Protection of Personal Data within five (5) days of becoming aware of it and, when people's rights and freedoms are at risk, we inform the persons concerned.

11. Minors

The platform is reserved for people aged eighteen (18) or over. We do not knowingly collect data about minors.

12. Changes to this policy

We may change this policy, in particular to follow changes in the law. Any substantial change is notified to you and submitted for a new acceptance before you continue using the platform. History is identified by the version number shown at the top of this page.