1. Roles
When an organization collects personal data through the platform’s tools for its own purposes (recruitment, program and event registration, tenders), the organization is the controller and Musrefy is a processor acting on its behalf. For member accounts and running the platform, Musrefy is the controller under the privacy policy.
2. Instructions
Musrefy processes this data only according to the organization’s settings, its use of the platform and its documented instructions, and never for its own purposes or marketing, unless the law requires otherwise.
3. Confidentiality
Every Musrefy team member with access to the data is bound by confidentiality. Access is granted on a need-to-know, least-privilege basis, and access to sensitive files is recorded in the audit log.
4. Security
We apply appropriate technical and organisational measures, including encryption in transit, encryption of sensitive files at rest, two-factor authentication for the admin team, backups and system monitoring.
5. Sub-processors
We use trusted providers for hosting, email and payment processing and bind them to protection obligations no weaker than this agreement. The list of sub-processors is available on request, and organizations are informed before any material change to it.
6. Data transfers
If providing the service requires transferring data outside the organization’s country, this is done with appropriate safeguards recognised by the applicable law.
7. Incidents
We notify the organization without undue delay after becoming aware of any breach affecting its data, with the available information on its nature, impact and the measures taken, and we cooperate with any notification the law requires.
8. Deletion and return
When the service ends, or at the organization’s request, we delete or return its data within a reasonable time unless the law requires us to keep it, noting that invoices and financial records are kept for the statutory periods.
9. Audit
We provide the organization with the reasonable information needed to show compliance with this agreement; any further audit, its scope and timing are agreed in advance.
10. Contact
For questions or to request a signed copy of this agreement, use the "Contact us" page. The legal entity and data protection officer details will be added once approved.
