Privacy Policy

(Effective as of September 23, 2026 – replaces all previous versions)

‍

1. Data Controller

Rebuilding Syria Platform / 2x Next UG (haftungsbeschränkt)
Managing Director: Maher Daboul
Fössestraße 38, 30451 Hannover, Germany
Tel.: +49 155 606 222 00
E-Mail: [email protected]

‍

2. Hosting & Content Delivery Network

This website is hosted by Webflow Inc., 398 11th St, San Francisco, CA 94103, USA.
Webflow uses content delivery networks to deliver the site quickly and securely.
In doing so, personal data (e.g., IP addresses in server logs) may be transferred to servers in the United States.
Webflow relies on the EU Commission’s Standard Contractual Clauses and, for certified companies, the EU-US Data Privacy Framework to safeguard data transfers.
Requests to our website also pass through Cloudflare, Inc. (USA), which routes them and protects the site against attacks; Cloudflare is certified under the EU-US Data Privacy Framework.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a secure and efficient website).

‍

3. Server Log Files

When you visit our website, Webflow automatically stores technical information, including:

IP address (anonymized after 24 hours)
Date and time of access
Requested URL
Referrer URL
Browser and device information

These logs are used solely to ensure the technical operation of the website and are deleted after a maximum of 30 days.

‍

4. Cookies & Consent

Without your consent we only use technically necessary cookies, such as:

Session cookies from Webflow
Authentication and language cookies from Outseta (for login and localization purposes)
Security and routing cookies from our network provider Cloudflare

Analytics, marketing and tracking tools run only with your explicit consent — see “Measurement and advertising tools” below.
A consent dialog is shown on your first visit (§25(1) TDDDG). Optional tools stay fully blocked until you agree.
You can change or withdraw your choice at any time via “Manage consent settings” in the footer; your decision is stored for 180 days and then we ask again.

Measurement and advertising tools (Microsoft Clarity & Meta Pixel)

We use two optional tools, and neither runs before your explicit consent. On your first visit a dialog lets you choose; your choice is kept for six months and then we ask again. Until you choose, these tools are not loaded and write nothing to your device.

Experience measurement — Microsoft Clarity. A tool from Microsoft Ireland Operations Ltd. that records how you move through a page — where you click, how you scroll, where you stop — so we can see where the experience breaks. Microsoft keeps these recordings for 30 days and then deletes them. Data may be processed in the United States under the EU-US Data Privacy Framework.

Ad measurement — Meta Pixel. A tool from Meta Platforms Ireland Ltd. that links your visit to an ad you saw on Facebook or Instagram, so we can tell which ad actually brought visitors. For the collection and transmission of this data, we and Meta are joint controllers within the meaning of Art. 26 GDPR; the processing that follows is Meta’s sole responsibility. Data may be processed in the United States on the same basis.

Legal basis and withdrawal. Your consent — Art. 6(1)(a) GDPR and §25(1) TDDDG. You may withdraw it at any time via “Manage consent settings” in the footer; withdrawal does not affect the lawfulness of processing before it, and on withdrawal we delete the cookies these tools have set. Essential cookies for sign-in, security and language need no consent, because the site cannot work without them.

‍

5. User Accounts & Authentication (Outseta)

We use Outseta Inc., Dover, New Hampshire, USA to manage user registrations, logins, and membership accounts.
Outseta stores only the information necessary to create and maintain user accounts (e.g., name, email address, password hash).
Session cookies are used to enable login functionality and expire automatically upon logout.
Data transfers to the United States are safeguarded by Standard Contractual Clauses under Art. 46(2)(c) GDPR.

For more information on Outseta’s privacy practices, please refer to their official Privacy Policy:
https://www.outseta.com/privacy-policy

‍

6. Contact Forms

Mandatory fields: name/company, email address, and message.
Submitted data are transmitted securely via Webflow, temporarily stored, and then forwarded to us through Outseta or email.

Purpose: Processing your inquiry
Legal basis: Art. 6(1)(b) GDPR (pre-contractual communication)
Retention period: Data are deleted no later than six months after the inquiry has been resolved.

‍

6a. Newsletter (Outseta Email Lists)

If you subscribe to our newsletter, we use the integrated email service provided by Outseta Inc., Dover, NH, USA.
Your name and email address are stored to send you updates about projects, partnerships, and platform activities.
We only add an address to the newsletter with your explicit consent: when you subscribe yourself, or when you tick the box agreeing to receive emails on one of our forms.
You may unsubscribe at any time by clicking the unsubscribe link in any email.
After unsubscribing, your data will be deleted within 30 days.

Legal basis: Art. 6(1)(a) GDPR (consent).

‍

6b. Processing of Form Submissions

Form submissions are passed on by an automation service hosted in the European Union to a database service provider in the United States, where they are stored so that we can handle your request. Transfers to the United States are safeguarded by the EU Standard Contractual Clauses.

Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in efficient data management).

‍

7. Interactive Maps (Mapbox, OpenFreeMap)

Platform map (Mapbox). On our map page we use Mapbox Inc., 740 15th Street NW, Washington, D.C. 20005, USA to display an interactive map. When you open the map page, your browser connects to Mapbox servers and transmits technical data (e.g., IP address, browser type, geographic region). This data is used solely to provide and display the map properly.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a visually appealing presentation).
More information: https://www.mapbox.com/legal/privacy

Project location maps (OpenFreeMap). On individual project pages, a small map of the project's location loads only when you click “Show map”. Until you click, no data is sent to any map provider. When you click, your browser connects to three services:

jsDelivr (Volentio JSD Limited, England and Wales), which delivers the map software (MapLibre);
OpenFreeMap (Hyperknot Software Kft., Hungary), which delivers the map data;
Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), the network through which OpenFreeMap delivers its files.

These services receive the technical data that accompanies every web request, in particular your IP address, browser information and the time of the request, and use it to deliver the files, for statistics and to keep their services secure. OpenFreeMap states that its logs contain no IP addresses. Data may be processed in the United States: Cloudflare is certified under the EU-US Data Privacy Framework, and the United Kingdom is covered by an adequacy decision of the European Commission. The map data comes from OpenStreetMap (© OpenStreetMap contributors, Open Database License).

Legal basis: your consent, given by clicking “Show map” (Art. 6(1)(a) GDPR). Your click applies only to that page; on every other project page the map waits for a new click.
Independently of the map, project pages load the image-slider software from jsDelivr when they open (Art. 6(1)(f) GDPR, legitimate interest in a working page).

‍

8. AI-Assisted Features

The AI assistant in the members’ area and the pre-screening of marketplace posts use an AI service provider in the United States. When you ask the assistant a question or submit a marketplace post, its text is sent to this provider to generate an answer or a screening suggestion; whether a post is published is always decided by a person on our team. Question logs are kept for up to 90 days and conversation history for up to 60 days. The transfer is safeguarded by the EU Standard Contractual Clauses included in the provider’s data processing terms.

Legal basis: Art. 6(1)(b) GDPR (providing the member services you use) and Art. 6(1)(f) GDPR (legitimate interest in keeping the marketplace free of abuse).

‍

9. Rights of Data Subjects

Under the GDPR you have the following rights:

Access (Art. 15): Obtain confirmation and a copy of your personal data being processed.
Rectification (Art. 16): Request correction of inaccurate or incomplete data.
Erasure (Art. 17): Request deletion (“right to be forgotten”).
Restriction (Art. 18): Limit processing to specific purposes.
Data Portability (Art. 20): Receive your data in a machine-readable format.
Objection (Art. 21): Object to processing based on legitimate interests.

You also have the right to file a complaint with a data protection supervisory authority.

‍

10. Updates & Amendments

This privacy policy is effective as of September 23, 2026.
We may update this policy to reflect technical developments or changes in legal requirements.
The current version is always available at:
https://www.rebuilding-syria.com/privacy-policy

‍