Privacy Policy

(Effective as of October 24, 2026 – replaces all previous versions)

‍

1. Data Controller

Rebuilding Syria Platform / 2x Next UG (haftungsbeschränkt)
Managing Director: Maher Daboul
Fössestraße 38, 30451 Hannover, Germany
Tel.: +49 155 606 222 00
E-Mail: info@rebuilding-syria.com

‍

2. Hosting & Content Delivery Network

This website is hosted by Webflow Inc., 398 11th St, San Francisco, CA 94103, USA.
Webflow uses content delivery networks to deliver the site quickly and securely.
In doing so, personal data (e.g., IP addresses in server logs) may be transferred to servers in the United States.
Webflow relies on the EU Commission’s Standard Contractual Clauses and, for certified companies, the EU-US Data Privacy Framework to safeguard data transfers.
Requests to our website also pass through Cloudflare, Inc. (USA), which routes them and protects the site against attacks; Cloudflare is certified under the EU-US Data Privacy Framework.
We also use Cloudflare as our processor to store messages exchanged through our WhatsApp Business account, in a database located in the European Union; any transfer to Cloudflare, Inc. in the United States relies on the same certification (details and legal basis: §6c).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a secure and efficient website).

‍

3. Server Log Files

When you visit our website, Webflow automatically stores technical information, including:

IP address (anonymized after 24 hours)
Date and time of access
Requested URL
Referrer URL
Browser and device information

These logs are used solely to ensure the technical operation of the website and are deleted after a maximum of 30 days.

‍

4. Cookies & Consent

Without your consent we only use technically necessary cookies, such as:

Session cookies from Webflow
Authentication and language cookies from Outseta (for login and localization purposes)
Security and routing cookies from our network provider Cloudflare

Analytics, marketing and tracking tools run only with your explicit consent — see “Measurement and advertising tools” below.
A consent dialog is shown on your first visit (§25(1) TDDDG). Optional tools stay fully blocked until you agree.
You can change or withdraw your choice at any time via “Manage consent settings” in the footer; your decision is stored for 180 days and then we ask again.

Measurement and advertising tools (Microsoft Clarity & Meta Pixel)

We use two optional tools, and neither runs before your explicit consent. On your first visit a dialog lets you choose; your choice is kept for six months and then we ask again. Until you choose, these tools are not loaded and write nothing to your device.

Experience measurement — Microsoft Clarity. A tool from Microsoft Ireland Operations Ltd. that records how you move through a page — where you click, how you scroll, where you stop — so we can see where the experience breaks. Microsoft keeps these recordings for 30 days and then deletes them. Data may be processed in the United States under the EU-US Data Privacy Framework.

Ad measurement — Meta Pixel. A tool from Meta Platforms Ireland Ltd. that links your visit to an ad you saw on Facebook or Instagram, so we can tell which ad actually brought visitors. For the collection and transmission of this data, we and Meta are joint controllers within the meaning of Art. 26 GDPR; the processing that follows is Meta’s sole responsibility. Data may be processed in the United States on the same basis.

Legal basis and withdrawal. Your consent — Art. 6(1)(a) GDPR and §25(1) TDDDG. You may withdraw it at any time via “Manage consent settings” in the footer; withdrawal does not affect the lawfulness of processing before it, and on withdrawal we delete the cookies these tools have set. Essential cookies for sign-in, security and language need no consent, because the site cannot work without them.

‍

5. User Accounts & Authentication (Outseta)

We use Outseta Inc., Dover, New Hampshire, USA to manage user registrations, logins, and membership accounts.
Outseta stores only the information necessary to create and maintain user accounts (e.g., name, email address, password hash).
Session cookies are used to enable login functionality and expire automatically upon logout.
Data transfers to the United States are safeguarded by Standard Contractual Clauses under Art. 46(2)(c) GDPR.

For more information on Outseta’s privacy practices, please refer to their official Privacy Policy:
https://www.outseta.com/privacy-policy

‍

6. Contact Forms

Mandatory fields: name/company, email address, and message.
Submitted data are transmitted securely via Webflow, temporarily stored, and then forwarded to us through Outseta or email.

Purpose: Processing your inquiry
Legal basis: Art. 6(1)(b) GDPR (pre-contractual communication)
Retention period: Data are deleted no later than six months after the inquiry has been resolved.

‍

6a. Newsletter (Outseta Email Lists)

If you subscribe to our newsletter, we use the integrated email service provided by Outseta Inc., Dover, NH, USA.
Your name and email address are stored to send you updates about projects, partnerships, and platform activities.
We only add an address to the newsletter with your explicit consent: when you subscribe yourself, or when you tick the box agreeing to receive emails on one of our forms.
You may unsubscribe at any time by clicking the unsubscribe link in any email.
After unsubscribing, your data will be deleted within 30 days.

Legal basis: Art. 6(1)(a) GDPR (consent).

‍

6b. Processing of Form Submissions

Form submissions are passed on by an automation service hosted in the European Union to a database service provider in the United States, where they are stored so that we can handle your request. Transfers to the United States are safeguarded by the EU Standard Contractual Clauses.

Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in efficient data management).

‍

6c. Communication via WhatsApp

If you write to our WhatsApp Business account, we process your phone number (if WhatsApp shares it with us), your WhatsApp profile name and username, the user IDs WhatsApp assigns to you for our business, the content of your messages (text, captions, file names, reactions, and any location or contact you share; attachments themselves stay with WhatsApp) and technical details (time, message type, delivery, read and error status, billing category).

Purpose: Answering your inquiry and the business communication that follows from it; the technical details help us ensure delivery, fix errors and track messaging costs. From this account we only reply to your messages and send no promotional messages.

We use the WhatsApp Business Platform (Cloud API) of Meta Platforms Ireland Ltd., which processes the messages for us as our processor and keeps their content for up to 30 days to provide the service; Meta may also use some data as an independent controller to keep the service safe and secure and to enforce its terms. Meta may transfer data to Meta Platforms, Inc. (USA) as its sub-processor, relying on the EU-US Data Privacy Framework (Art. 45 GDPR) and/or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); you can request a copy of these safeguards from us (§1).

We store your messages and our replies, with their delivery information, in our own database, located in the European Union and hosted by Cloudflare as our processor (see §2). Members of our team may also use WhatsApp on their own phones to contact you about your inquiry, a meeting with us or your membership, to tell your company about tenders and opportunities in its field, or to pass a request you sent through a company’s page on to that company; we log many of these contacts, some with the message text, in the database described in §6b, and the legal basis in this section applies to them.

Legal basis: Art. 6(1)(b) GDPR where the communication concerns a contract with you (e.g., your membership) or steps you ask for before one; otherwise Art. 6(1)(f) GDPR (legitimate interest in business communication with you and in managing our business relationships). Technical details: Art. 6(1)(f) GDPR (legitimate interest in reliable, cost-controlled messaging).

Retention period: Messages in our database are deleted six months after our last exchange with you, unless a business relationship follows; then they are kept for its duration and, where they count as business correspondence, for the statutory periods under German commercial and tax law (generally six years; Art. 6(1)(c) GDPR with §257 HGB and §147 AO). Technical delivery and error records are deleted after three months. Chats on our team members’ phones are kept only as long as they are needed for our business communication with you.

Using WhatsApp is voluntary; you can also reach us by email (§1), including to stop WhatsApp contact or to exercise your rights (§9).

WhatsApp’s own processing is described in its privacy policy:
https://www.whatsapp.com/legal/privacy-policy-eea

‍

6d. Notification emails and linking company pages

We send short emails to tell a company that something has arrived for it on the platform. They come from noreply@notify.rebuilding-syria.com, a sending address we use only for these emails, and replies go to service@rebuilding-syria.com. These emails never contain the text of a visitor's message or of a conversation message, the name, email address or phone number of the person who sent it, or the name of a company that asked to talk: all of that stays on the platform. They contain no advertising.

Member companies. When a visitor writes through the contact form on a member's company page, an offer arrives on its request, another company asks to start a conversation, or a conversation message arrives, we send a notice to the email address of the member's account, and at most one reminder a day about what is still waiting. For visitor messages only, if the account has no address, the notice and its reminders may go to the company's business address in our records. Members can switch these emails off at any time under Preferences in their dashboard.

Companies listed in our directory that do not have an account yet. When a visitor message or a conversation request is waiting for such a page, we send an email to the company's business address within about an hour, and at most one email per page in that hour. It gives only the number of items waiting, and a link to create an account, or sign in to an existing one, and read them. We send no reminders, and nothing about the pages of official bodies. The business address is the contact address the company itself gave us when it registered with us on the platform. We keep it with our company records in the database described in §6b.

Stopping these emails. Every email we send to a company address from our records carries a stop link. One click on the page it opens, or on the unsubscribe button that many email programs show, ends all notification emails to that address at once, without signing in. We then delete the address from the notification addresses we hold for pages not linked to an account, and keep only a one-way fingerprint of it (not the address itself) on our stop list, so that we never write to it again. You can also object or ask for erasure by writing to service@rebuilding-syria.com (see §9).

Linking a page to an account. So that messages reach whoever manages a company page, we link the page to a company account in the Business Portal. When someone creates an account or signs in and asks to link a page, for example through the link in the email above, we compare the email address of the account with the page's address in our records, and the domain of the account's email address with the company's website. If either matches, the page can be linked at once and the messages waiting for it pass to the account; otherwise our team reviews the request before anything is linked. The link in the email works once, for 30 days and for that page only. When you open it, your browser keeps it for up to two hours so that it is still there after you create your account or sign in; this storage is strictly necessary for the step you asked for (§25(2) No. 2 TDDDG). We keep a record that the link was used, without the address, for 60 days.

Conversation requests to a page not linked yet. When a member company asks to talk with a company whose page is not linked to an account, we keep the request and its first message on the platform for up to 60 days. Until the page is linked, the requested company learns only how many requests are waiting, in our notification email if we send one; once it is linked, the requests reach its account. A request can be withdrawn at any time. When it is withdrawn or expires we delete its text, and we delete the rest of the record after 12 months.

Processor. Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) runs the server and the database behind these features and sends the emails for us as our processor. Any transfer to the United States relies on Cloudflare's certification under the EU-US Data Privacy Framework (see §2).

Legal basis: for emails to members, Art. 6(1)(b) GDPR (providing the member services they use). For emails to companies that are not members, for linking pages, for keeping waiting conversation requests and for the stop list, Art. 6(1)(f) GDPR: our legitimate interest, shared by the people who wrote to a company, in the company learning that messages are waiting for its page, in its page reaching the people who really manage it, and in respecting an objection for good.

Retention period: a company's business address stays among our notification addresses while its page is listed on the platform. For a page not linked to an account, it is deleted 30 days after the page leaves our directory, and at once when the emails to that address are stopped. Fingerprints on the stop list are kept for as long as we must respect the objection. The delivery log (time, type and status of each email, with an account or page identifier or an address fingerprint, never the address itself) is kept as long as it is needed to apply the limits above and to show that a stop request was honored.

‍

7. Interactive Maps (Mapbox, OpenFreeMap)

Platform map (Mapbox). On our map page we use Mapbox Inc., 740 15th Street NW, Washington, D.C. 20005, USA to display an interactive map. When you open the map page, your browser connects to Mapbox servers and transmits technical data (e.g., IP address, browser type, geographic region). This data is used solely to provide and display the map properly.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a visually appealing presentation).
More information: https://www.mapbox.com/legal/privacy

Project location maps (OpenFreeMap). On individual project pages, a small map of the project's location loads only when you click “Show map”. Until you click, no data is sent to any map provider. When you click, your browser connects to three services:

jsDelivr (Volentio JSD Limited, England and Wales), which delivers the map software (MapLibre);
OpenFreeMap (Hyperknot Software Kft., Hungary), which delivers the map data;
Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), the network through which OpenFreeMap delivers its files.

These services receive the technical data that accompanies every web request, in particular your IP address, browser information and the time of the request, and use it to deliver the files, for statistics and to keep their services secure. OpenFreeMap states that its logs contain no IP addresses. Data may be processed in the United States: Cloudflare is certified under the EU-US Data Privacy Framework, and the United Kingdom is covered by an adequacy decision of the European Commission. The map data comes from OpenStreetMap (© OpenStreetMap contributors, Open Database License).

Legal basis: your consent, given by clicking “Show map” (Art. 6(1)(a) GDPR). Your click applies only to that page; on every other project page the map waits for a new click.
Independently of the map, project pages load the image-slider software from jsDelivr when they open (Art. 6(1)(f) GDPR, legitimate interest in a working page).

‍

8. AI-Assisted Features

The AI assistant in the members’ area and the pre-screening of marketplace posts use an AI service provider in the United States. When you ask the assistant a question or submit a marketplace post, its text is sent to this provider to generate an answer or a screening suggestion; whether a post is published is always decided by a person on our team. Question logs are kept for up to 90 days and conversation history for up to 60 days. The transfer is safeguarded by the EU Standard Contractual Clauses included in the provider’s data processing terms.

Legal basis: Art. 6(1)(b) GDPR (providing the member services you use) and Art. 6(1)(f) GDPR (legitimate interest in keeping the marketplace free of abuse).

‍

9. Rights of Data Subjects

Under the GDPR you have the following rights:

Access (Art. 15): Obtain confirmation and a copy of your personal data being processed.
Rectification (Art. 16): Request correction of inaccurate or incomplete data.
Erasure (Art. 17): Request deletion (“right to be forgotten”).
Restriction (Art. 18): Limit processing to specific purposes.
Data Portability (Art. 20): Receive your data in a machine-readable format.
Objection (Art. 21): Object to processing based on legitimate interests, and to direct marketing at any time.

You also have the right to file a complaint with a data protection supervisory authority.

‍

10. Updates & Amendments

This privacy policy is effective as of October 24, 2026.
We may update this policy to reflect technical developments or changes in legal requirements.
The current version is always available at:
https://www.rebuilding-syria.com/privacy-policy

‍