Privacy Notice

Operator and contact

Responsible operator

Prof Akram Anbari Foundation

Country of establishment

Syria

Postal address

Prof Akram Anbari Foundation
Anbari Building
H 18-0003
Saadi Shirazi Street
Abo-Romaneh, Damascus, Syria.

Privacy email

contact@paafoundation.org

1. Information used by the website

• Accounts: name, email address, password hash and registration details; optional professional title and profile photo. The password is stored as a hash, not as readable text.
• Learning: module and section progress, bookmarks, quiz/completion results, certificate identifiers and the name saved on each issued certificate. Video tracking stores viewing intervals, source reference and playback-session information to calculate completion.
• Alumni: institution, graduation/training year, specialty, city, membership review status, directory preference and announcement read state.
• Administration and communication: submitted feedback, account-deletion requests, and a record of the terms version and privacy notice acknowledged at new registration when these pages are published. The agreement record does not add an IP address.
• Security and hosting: login-attempt counts/time windows and hashed identifiers derived from email/IP addresses; the hosting service may also hold IP addresses and request details in server logs.

2. Purposes and applicable legal bases

The website uses account and learning information to provide sign-in, save progress, issue and verify completion certificates, manage alumni access and respond to requests. Security records help prevent misuse. The operator’s confirmed legal bases and any additional jurisdiction-specific explanation are set out below; acknowledging this notice is not blanket consent.

Proposed purposes: operate learning accounts, save progress, issue certificates, respond to requests and secure the service. Identify the applicable law and confirm a lawful basis for each purpose with qualified advice. Registration acknowledgement alone is not a legal basis for every use.

3. What others can see

Your account photo is displayed on your account page. A certificate you download includes its saved recipient name. Someone holding its verification link or code can check the module and completion date, but the website’s verification page does not disclose your name or email.

Approved alumni can see another approved member’s name, institution, year, specialty and city only when that member enables directory visibility. Administrators can access information needed to manage the service. Public campaign reports can contain published photos and captions; publication permissions must be handled by the Foundation separately.

4. Enquiries, feedback and email

The public enquiry forms open a draft in your own email app; you decide whether to send it. The website does not submit or save those enquiry-form messages. Once sent, the message is handled by your email provider and the Foundation’s mailbox. Lecture feedback is different: it is saved in the website database for administrators.

Where password recovery is enabled, the configured email service sends a reset link. Reset links expire after 30 minutes; expiry does not itself erase the stored reset record. Staging copies disable outgoing email and real enquiry drafts. Do not include patient records or other unnecessary sensitive information.

5. Hosting, service providers and transfers

The website is hosted using GoDaddy services. The confirmed processing locations and relevant hosting/email/other service-provider arrangements are listed below. External linked organisations are not automatically recipients of your account details.

Hosting provider: GoDaddy. Processing country: insert the country confirmed for the hosting account. Email provider and storage country: insert confirmed details. List any other providers receiving personal information and their role.

Identify where the Foundation, host, email provider and other processors access or store personal information. If an international transfer occurs, describe its applicable legal mechanism and safeguards after confirming them. Do not claim a transfer agreement or adequacy status without verification.

6. Session cookies and embedded content

The site uses a session cookie for sign-in, language preference and form security. It signs out inactive accounts after two hours. Browser session-restoration settings may preserve a session cookie beyond closing a window. Blocking the session cookie can prevent account features from working.

Embedded YouTube videos and remotely hosted media or logos can connect your browser to third-party servers, exposing connection details such as IP address and browser information. Those services may use cookies or other storage under their own policies. A youtube-nocookie.com embed is not a promise that no data is sent. An embedded player may connect to its provider when it loads, before playback starts. Joining WhatsApp is optional and subject to its own privacy practices.

7. Retention of account and learning information

The approved periods or criteria below govern retention. The application does not automatically delete accounts, learning records or security records solely because they become old.

Keep account, profile and alumni information while the account is active. Review inactive accounts after 24 months. Process approved deletion requests within 30 days, subject to documented legal exceptions. These proposed periods require approval and an operational deletion process.

Keep learning and certificate records while the account is active. On approved deletion, remove associated online records unless a specific lawful retention requirement is documented. Keep agreement records only for a documented necessary period; for example, review necessity annually.

8. Security records, backups and test copies

Account deletion is reviewed by an administrator. When processed, it removes the active account and related website records, including online certificate verification and agreement records. Previously downloaded certificates and existing backup copies are not erased by that action.

Authorised administrators may use protected, separately configured staging copies for testing. A database copy can contain the account and learning information present when it was copied. Access, refresh and deletion of these copies must follow the operator’s retention arrangements. Backups and export files must be kept private.

review login-attempt records after 90 days and expired password-reset records after 7 days. Ask the hosting provider to confirm server-log retention, for example 30 days, before adopting a period. The current application does not automatically perform these deletions.

Proposed schedule: rotate backups after 30 days and refresh or delete staging copies within 30 days of testing. Restrict access and reapply approved deletions after restoring a backup. Confirm the actual provider and manual-backup arrangements before adopting this schedule.

9. Your choices and requests

You can edit your profile, remove an optional avatar, remove bookmarks and change alumni-directory visibility where the feature is available. The account page lets you request deletion, which requires administrator review. Contact the privacy email above for access, correction, deletion or other data-protection requests.

The rights available, any lawful limits and the applicable complaint route depend on the relevant law and circumstances. Registering is not consent to marketing. No marketing opt-in is collected by the registration agreement.

Contact the confirmed privacy email to request access, correction or deletion. Proposed response target: acknowledge within 7 days and respond within 30 days, subject to applicable legal requirements. Insert the competent complaint authority and its contact details after confirming jurisdiction.

10. Updates

This notice is identified by its document version. Material changes should be communicated appropriately. The operator should review the notice when features, providers, retention practices or applicable requirements change.