Tajdeed Privacy Policy

1. Who we are

Tajdeed ("Tajdeed," "we," "us," or "our") is operated by [PLACEHOLDER: full legal entity name], a limited liability company formed in [PLACEHOLDER: state of formation, e.g., Delaware], with a registered address at [PLACEHOLDER: registered agent / business address].

Tajdeed provides a device certification platform and related retail parts supply service ("Tajdeed Retail") primarily serving users, repair shops, and administrators in Algeria. This Privacy Policy explains what personal data we collect, why, how it's used, who it's shared with, and what rights you have over it.

This policy applies to our website, admin dashboard, desktop application, and any other service that links to it.

2. Scope and who this applies to

Tajdeed has three user roles, and what we collect can differ by role:

• Guest - end users who look up or receive a certificate for a device.
• Shop - registered repair shops who issue certifications and, where applicable, purchase parts through Tajdeed Retail.
• Admin - Tajdeed staff/operators managing the platform.

Where a data practice applies only to a specific role, this policy says so explicitly.

3. Information we collect

3.1 Account and registration data

• Name, email address, phone number
• For Shops: business name, business registration/verification details, physical address
• Authentication credentials - we never store your password or PIN in plain text; these are hashed using Argon2id before storage, and session/access tokens are hashed using SHA-256. We cannot see or recover your actual password.

3.2 Certification and device data

• Device identifiers (brand, model, serial/IMEI where applicable)
• Certification records: inspection results, condition assessments, certificate issuance date, issuing Shop
• Certificate files, stored as documents (PDF or similar) in our certificate storage system

3.3 Payment data

• Tajdeed does not directly collect or store your full card or payment credentials. Payments are processed by Chargily Pay, a third-party payment processor. We receive transaction confirmations, amounts, and status (success/failure/refund) but not your raw card details.
• For Tajdeed Retail purchases: order details, item(s) purchased, delivery/pickup information.

3.4 Technical and usage data

• IP address, device/browser type, log data, timestamps of actions taken on the platform
• Basic diagnostic and error data used to keep the service running

3.5 Communications

• Emails we send you (order confirmations, certificate notifications, account notices) are sent via Resend. If you email us, we retain that correspondence to respond to and document your request.

4. How we use your information

We use the data above to:

• Create and manage your account and verify your role (Admin/Shop/Guest)
• Issue, verify, and store device certifications
• Process payments and Tajdeed Retail orders
• Send transactional emails (certificate ready, payment confirmation, account security)
• Maintain audit logs for security and dispute resolution
• Detect fraud, abuse, or violations of our Terms & Conditions
• Improve and maintain platform reliability and security
• Comply with legal obligations

We do not sell personal data to third parties, and we do not use certification or device data for advertising.

5. Legal basis for processing

Where Algerian data protection law (Law No. 18-07 on the Protection of Individuals in the Processing of Personal Data) applies, we process personal data on the following bases: performance of a contract with you (providing the certification/retail service), your consent (e.g., at account creation), and our legitimate interest in operating and securing the platform. [PLACEHOLDER: confirm with counsel whether Tajdeed has completed any required notification/authorization with the Algerian data protection authority (ANPDP) if applicable to your processing volume.]

6. Who we share data with

We share data only with service providers who help us run Tajdeed, under obligations to protect it, and only to the extent needed for their function:

We do not sell, rent, or trade personal data to third parties for marketing purposes. We may disclose data if required by law, legal process, or to protect the rights, safety, or property of Tajdeed or its users.

[PLACEHOLDER: if Tajdeed Retail involves a delivery/logistics partner, add that provider to this table.]

7. Data storage, location, and security

Your data is stored using the providers listed above, which may store or process data outside Algeria (e.g., our backend runs on infrastructure in Frankfurt, Germany). By using Tajdeed, you acknowledge your data may be processed outside your country of residence, under security safeguards consistent with this policy.

We apply industry-standard safeguards, including:

• Password/PIN hashing with Argon2id
• Token hashing with SHA-256
• Encrypted data in transit (HTTPS/TLS)

No system is 100% secure, and we cannot guarantee absolute security, but we take reasonable measures to protect your data against unauthorized access, loss, or misuse.

8. Data retention

We retain personal data for as long as your account is active or as needed to provide the service. Certification records may be retained longer than account data because certificates may need to remain verifiable after a device changes ownership. [PLACEHOLDER: define concrete retention periods, e.g., "certification records are retained for X years after issuance; account data is deleted Y days after account closure, except where retention is required for legal or dispute-resolution purposes."]

9. Your rights

Depending on applicable law, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (subject to legal/record-keeping exceptions - e.g., we may need to retain certification records for verification integrity)
• Object to or restrict certain processing
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at [PLACEHOLDER: privacy contact email]. We will respond within [PLACEHOLDER: e.g., 30 days].

10. Children's privacy

Tajdeed is not directed at children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

11. Cookies and tracking

Our website may use cookies or similar technologies for session management and basic analytics. [PLACEHOLDER: confirm actual cookie usage - if you add analytics (e.g., Plausible, GA), list it here and add a cookie consent banner if targeting EU users.]

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify users via email or a notice on the platform before the changes take effect. Continued use of Tajdeed after changes take effect constitutes acceptance.

13. Contact us

Questions about this policy or your data can be sent to:

[PLACEHOLDER: support/privacy email, e.g., [email protected]]

[PLACEHOLDER: business address]

14. Governing law

This Privacy Policy is governed by the laws of [PLACEHOLDER: state of LLC formation], without prejudice to any mandatory data protection rights you have under the laws of Algeria or your country of residence where applicable.