Privacy Policy

Haseef Legal Office Management System – Haseef.

Effective Date: 01/01/2025 Version: 3.0 Last Updated: 29/07/2026

1. Scope and Introduction

1.1 This Privacy Policy ("Policy") describes how Almaqar Information Technology Company ("Almaqar," "we") collects, processes, and protects data in connection with the Haseef Legal Office Management System ("the Platform"), accessible via our website and its authorized domains.

1.2 This Policy applies to the Platform's marketing website, to customized client installations, and to all authorized users (administrators, lawyers, employees, accountants) subscribed to the System.

1.3 This Policy must be read in conjunction with the Terms of Use, the Security and Data Protection Policy, and the Cookies Policy; all such Policies constitute an integral part of this agreement and shall be read together as a single instrument.

1.4 Platform Architecture and Precise Isolation: The "Haseef" System is provided as a cloud-hosted service for multiple independent Customers. Each Customer receives a dedicated application instance under a single-instance architecture, logically and programmatically isolated; each Customer deployment is a completely independent and isolated environment with its own dedicated application instance, dedicated database, independent file repository, independent application configuration, independent encryption keys, and independent authentication sessions, operating on professionally managed cloud infrastructure operated by Almaqar Information Technology Company. Customer data is never stored in shared databases, and no Customer can access another Customer's data through the Platform.

2. Data Controller and Data Processor Roles

2.1 The Customer as Data Controller

2.1.1 Both parties acknowledge that the Customer (the law office, civil law firm, or legal department) is the Data Controller for all personal and professional data, client information, and case records processed and entered within their installation; the Customer alone has the authority to determine the purposes and means of processing such data.

2.1.2 The Customer (the office) bears direct and sole legal responsibility for:

(a) Determining the lawful basis and obtaining all explicit and necessary consents from data subjects (clients, opposing parties, employees) for the entry of their personal data into the System;
(b) Responding individually and legally to data subject requests (such as access, rectification, erasure, or portability requests) under applicable data protection legislation (including the EU General Data Protection Regulation (GDPR) where applicable, and governing local legislation);
(c) Ensuring that all data and files entered or uploaded to the Platform comply with applicable laws and professional rules.

2.2 Almaqar Information Technology Company as Data Processor

2.2.1 Almaqar Information Technology Company acts as Data Processor under applicable data protection legislation when processing personal data technically on behalf of the Customer and pursuant to its documented instructions, namely operating and using the Platform's interfaces. The Company's technical processing activities are exclusively limited to: hosting and maintaining the leased infrastructure, providing software updates and security patches, performing routine five-day backup operations, providing technical support upon the Customer's documented request, and monitoring general server cybersecurity.

2.2.2 If the Customer or the processed data is subject to legislation requiring the execution of an independent data processing agreement (such as Article 28 of the EU General Data Protection Regulation (GDPR)), Almaqar Information Technology Company shall provide a separate and independent Data Processing Addendum (DPA) that complies with such requirements, which shall be available for the Customer to execute and be bound by as an integral part of this agreement.

3. Data That Almaqar Information Technology Company Does Not Routinely Collect or Process

3.1 Due to the architecture of the "Haseef" System based on the programmatic isolation of customer accounts and databases, Almaqar Information Technology Company does not routinely collect, access, review, process, or store any category of data entered or uploaded within a client's installation, which includes:

(a) Case files, matters, documents, court instruments, and legal pleadings of offices;
(b) Names, information, identities, or records of clients, opposing parties, witnesses, and experts;
(c) Internal notes, correspondence, appointments, hearing schedules, and office tasks;
(d) Invoice records, financial accounts, and financial and banking data of clients and their principals;
(e) Internal audit logs and user activity tracking within the installation;

3.2 All such sensitive data and contents reside exclusively within the Customer's dedicated application instance, namely the isolated database environment and the dedicated file storage that is protected with AES-256 encryption where applicable. Almaqar Information Technology Company personnel do not access or review this data during normal operation or routine support activities. Any exceptional access, where required, is strictly limited to authorized technical, security, maintenance, legal, or Customer-approved circumstances (such as Customer-authorized technical support, security incident response, disaster recovery, or compliance with applicable laws or valid legal orders), and is performed in accordance with the Company's security policies and access control procedures, including the principle of least privilege, documented operational need, and audit logging.

4. Data That Almaqar Information Technology Company Collects and Processes for Its Own Purposes (As an Independent Controller)

Almaqar Information Technology Company collects and processes, in its capacity as an independent controller, the very narrow scope of data necessary to manage the commercial relationship and licensing with the Customer, namely:

License Registration and Activation Data: includes the name of the subscribing law office or firm, the administrator's name and official email address, phone numbers, and correspondence and invoicing information for subscription renewal and financial claims.
Marketing Website Data: when visiting our public website, information voluntarily submitted via contact or inquiry forms (such as name, email) may be collected, along with automatically collected technical performance data (such as anonymized IP address, browser type, and operating system) for session management and website performance improvement in accordance with the Cookies Policy.
Documented Technical Support Data: includes support ticket details and correspondence via official email, and metadata and server logs that record engineer access to resolve a critical structural issue on the server at the Customer's explicit request.

5. Strict Restrictions and Limitations on Processing Purposes

5.1 Almaqar Information Technology Company is strictly and absolutely committed to processing data solely for the purpose of providing services and fulfilling the contract; it is absolutely prohibited from using Customer data or accessing it for any of the following purposes:

(a) Targeted advertising, behavioral tracking, or commercial analytics;
(b) Creating behavioral profiles or competitive statistical comparisons;
(c) Developing proprietary products or exploiting ideas to develop competing software systems;
(d) Reselling, renting, lending, or sharing with any third parties for their independent purposes.

6. Absolute Confidentiality and Employee Technical Access

6.1 The Platform's operating code, its algorithms, and its architecture constitute trade and technical secrets exclusively owned by the Company; in return, the Customer's data, files, and cases constitute highly confidential information protected by "professional privilege" and the confidentiality of communications between the lawyer and his client.

6.2 All Almaqar Information Technology Company employees and engineers whose purely technical tasks (such as support and critical upgrades to the leased infrastructure) require server access are bound by strict confidentiality agreements and conflict-of-interest avoidance obligations, within narrow need-to-know limits and exclusively through secure channels and documented server logs.

6.3 Automatic Decryption: Uploaded files and documents are automatically and transparently decrypted upon being requested by an authorized user with application-level access privileges, or by the technical support team upon the Customer's documented request to diagnose a technical problem; employee access in routine cases is limited to unencrypted text data tables in the database for troubleshooting.

7. Optional Third-Party Integration

7.1 The Platform's integration and linking features with third-party services (such as linking the server to Google Drive for file synchronization or sending appointment reminders and notifications via WhatsApp Business) are entirely optional features subject to the administrator's preference and configuration in the office.

7.2 When enabled, files or data are transferred to such services in their technical format; such services are entirely independent platforms operated by external companies (such as Google LLC or Meta Platforms), subject to the privacy policies and terms of use imposed by those companies, and Almaqar Information Technology Company has no access, visibility, or storage authority over Customer login data with them, and is fully released from responsibility for the security and confidentiality of data once it leaves the "Haseef" server toward such external companies' servers.

8. International Transfer, Data Retention, and Deletion

8.1 Customer data remains stored within the isolated database on leased VPS servers which may be hosted inside Libya or abroad depending on technical data center requirements, and is subject to the same standards of protection, encryption, and consistency.

8.2 Final Deletion Policy upon Termination: Almaqar Information Technology Company — in strict commitment to data security and confidentiality — upon the occurrence of the actual termination or cancellation date of the subscription, shall permanently cancel the installation, and completely and irreversibly technically destroy and delete all associated databases and files on the server and the five-day backups within a maximum period of thirty (30) days from the actual cessation date.

8.3 Data retained after termination shall be limited to paper license records, financial invoices, and standard contract information, which shall be retained for five (5) years only as required by the financial system and commercial and accounting laws in effect in the State of Libya.

9. Compliance and Legal Legislation

9.1 Almaqar Information Technology Company complies in its practices, security, and privacy policies with all applicable Libyan laws and regulations, including Libyan Communications Law No. 12 of 2010, Electronic Transactions Law No. 6 of 2022, and the rules and ethics of the legal profession, and applies internationally recognized OWASP standards and GDPR principles in areas where local law is silent, to achieve the highest levels of fortification and safety for law office data.