Privacy Policy

  Syria Recovery Trust Fund

 Privacy Policy

 

 

Last Updated [02/03/2026]

 

Introduction

 

You can rely on the protection and security of your personal data. SRTF for Management Services - Jordan LLC (Not for Profit) (referred to in this document as "SRTF Jordan", “we”, “our” or “us”) consider it its responsibility to protect your privacy when processing your personal data. The following Privacy Policy provide an overview of the processing of your data and the rights you have under the Jordanian Personal Data Protection Law no. 24 of 2023 and the regulations and instructions issued pursuant thereto (the “Personal Data Protection Laws”) when using the products and services of Syria Recovery Trust Fund (also referred to in this document as “SRTF”).

 

The Type of Personal Data Processed by the SRTF

 We process personal data we receive from our business partners and website visitors in connection with the use of our website for the purposes of fulfilling the objectives of the SRTF only in line with the Personal Data Protection Laws. We may also process personal data from a range of sources including third parties, such as government agencies, global verification system services for high-risk entities and individuals or publicly available sources.

Personal data processed by us refers to personal details (such as name, address, telecommunications data, date and place of birth), Identification data (such as ID, Passport, residence registration data), contractual data, documentation data, registration data and similar information. 

 

How the SRTF Uses Your Personal Data

In collecting and processing your personal data, we are acting as a data controller under the Personal Data Protection Laws, and the provisions of the said laws will be considered by us while processing the said personal data.

In accordance with the Personal Data Protection Law, SRTF Jordan will ensure that the purpose of the processing of your personal data is lawful, specific and clear; and that it aligns with the purpose for which your personal data was collected. Also, the processing of your personal data will be made in legal manner and that will not infringe your rights. In addition, we will make sure that the processing of your personal data will be conducted in a manner that ensures the confidentiality of your personal data and without any change thereof.

 

Prior Consent(s)

We value your privacy and are committed to protecting your personal data. Before we collect, process, or share any of your personal data, we will obtain your explicit consent. By consenting, you agree to the terms outlined in this privacy policy. You will be fully informed about the specific data we collect, the purposes for which it will be used, the third parties with whom it will be shared, and the duration for which it will be retained.

Your consent is freely given, specific, and informed. You have the right to withdraw your consent(s) at any time by contacting us at the contact information below. Any prior consent(s) that has been granted by you under this policy and/or in accordance with the Data Protection Laws may be revoked by you at any time. This does not, however, affect the legality of processing carried out before consent was revoked.

We will maintain a record of your prior consent(s), including the date and method by which it was given. This ensures transparency and accountability in our data processing activities.

Prior consent(s) is required for all data processing activities, except in specific instances such as when necessary to protect the vital interests of the data subject, as required or permitted by legislation or court decision, or when processing involves data publicly available from the data subject.

To comply with the Data Protection Laws, the SRTF Jordan must rely on at least one of the following grounds when processing your data:

1. General Communications and Use of the Online Applications for the Purpose of Fulfilling Contractual Obligations:

• General communications, particularly via the contact us form
• Use of our online applications, for example, our Supplier Registration Application or Project Concept Note or Submit Compliant online

The processing of your personal data in this context is generally a prerequisite for concluding and performing a contract with you or entering into a preliminary agreement with you. You are not legally obligated to make your personal data available to us. Without it, however, we will not be able to perform the relevant contract with you. Such processing is necessary for the performance of a contract to which you are a party or in order to take steps prior to entering into a contract.

• Authentication Procedure for the SRTF Online Applications

 To enable the use of the SRTF online applications

(https://www.srtfund.org/forms/supplier_registration_application), (https://www.srtfund.org/forms/pcn), (https://www.srtfund.org/forms/ombudsperson), your surname, first name, email address and telemetric data are communicated to the Microsoft Corporation outside Jordan during the registration process. This serves the technically necessary purpose of being able to authenticate your registration process by sending an email. The Microsoft Corporation has undertaken to comply with the data protection standards of the EU. Your data are stored by the Microsoft Corporation for a maximum of 30 days and then deleted.

 

2- Legal Obligations and Compliance – For the Purpose of Safeguarding Justified Interests:

Our justified purpose consists of complying with applicable legal provisions, maintaining the security of our IT systems and, in case of non-compliance with legal requirements or violations of security regulations, responding adequately to such circumstances, for instance by asserting legal claims. SRTF Jordan is subject to a significant number of regulatory requirements and has a responsibility to our business partners to ensure compliance with the corresponding security requirements and regulations. We protect the relevant data in such a way that we do not see any overriding disadvantages to you.

Justified purpose shall include but not limited to:

• Assertion of legal claims and defense in legal disputes.
• Prevention and investigation of criminal activities.
• Guarantee of IT security and IT operations at the SRTF.
• Compliance at the SRTF

 

3- Analysis of User Behavior and Direct Market – For the Purpose of Safeguarding Justified Interests:

 Testing and assessing the systems pertaining to databases and processing, and the security, safeguarding and protecting the data which might include demand analysis procedures for direct communication with business partners, and measures related to business management and further development of services and products and the improvement of our website

We have a justified interest in aligning our offers with business partners’ behavior and improving them. As the SRTF must control and improve its offerings in order to fulfil its promotional mandate. The alignment with our business partners allows us to offer and improve services according to the needs and interests of our beneficiaries. We protect the relevant data in such a way that we do not see any overriding disadvantages to you.

 

Cookies and Other Technologies for Website Analysis

SRTF website uses cookies to understand how you use our site and to improve your experience. Subject to your consent to our use of cookies when using the SRTF site, certain information about the user, such as Internet protocol (IP) addresses, navigation through the Site, the software used and the time spent, along with other similar information, will be stored. These will not specifically identify the user.

The information will be used internally only for the SRTF website traffic analysis. If the user provides unique identifying information, such as name, address and other information on forms stored on the Site, such information will be used only for statistical purposes and will not be published for general access.

 

Social Media

You can access various social media from our website.

Caution: When choosing one of the following links, you will leave our website and be directed to the website of a social media platform. Any information available there was created without any involvement from us and we are therefore not responsible for this content. We do not accept any liability for the information being up -to-date, accurate or complete. Any reference to social media does not imply any approval on our part.

• X (previously known as Twitter),  795 FolsomSt., Suite 600, San Francisco, CA, 94107, USA

X privacy policy

• LinkedIn Ireland, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland

LinkedIn privacy policy

Particularly for reasons of data protection compliance, the relevant social media platform cannot be accessed directly. You may first have to click on integrated buttons after which the browser will connect you by establishing a direct connection with the social media platform’s servers. Please keep in mind that we are not aware of nor do we influence how and what data find their way to the social media platform.

By activating the button, you will provide the social media platform with the information that you have opened one of the web pages of the platform on the internet. If you are already registered with the social media platform, it will be able to link your visit with your account on the social media platform. However, even if you have not yet registered with the social media platform, it is not possible to preclude the possibility that it will collect and/or store your IP address after you click on the platform.

We strongly suggest you review the privacy policies of such platforms and websites. And to the extent any linked website, device, app, or other feature is not owned or controlled by us, we are not responsible for its content, use, or privacy practices.

 

Whom do we share personal information with

Within the SRTF Jordan, the departments and “other affiliate members” that need your data to fulfil our contractual and legal obligations receive access to your data. Service providers and subcontractors whose services we use may also receive data for these purposes if they observe data protection.

We may only disclose information about you to third parties if required to do so by law, if you have given your consent, or if we are authorized to provide such information for other reasons. Any such disclosure will be limited to the minimum amount of personal data necessary and will be proportionate to the specific purpose for which the disclosure is made, while ensuring the protection and integrity of the personal data and the rights of the data subject.

SRTF Jordan will ensure, to the extent reasonably practicable, that such disclosure does not directly or indirectly reveal the identity of another data subject unless such disclosure is lawful and permitted under applicable legislation.

Under these conditions and pursuant to the Personal Data Protection Law,[1] recipients of personal data could include:

• Public bodies and institutions in the event of a legal or official obligation.
• Donors and affiliate agencies
• Legal and other professional advisers and auditors
• Service providers who work for the SRTF, or provide services to the SRTF

Other data recipients may be bodies for which you have given us your consent to transfer data. If you need further information on individual recipients, please do not hesitate to contact us.

Where disclosure is made upon request of a data subject, a competent authority, or pursuant to applicable legislation, SRTF Jordan will verify that such disclosure complies with applicable data protection laws and regulations before releasing the requested information.

For the purposes of this document, the term “other affiliate members” includes SRTF, its subsidiaries, its affiliates, other organizations that are controlled by SRTF, organizations that are connected with SRTF and are part of SRTF or is a member of it. For the sake of clarification, this term includes: (1)  Syria Recovery Trust Fund "SRTF";  (2)  KfW as the trustee if the SRTF and in any capacity when receiving privacy data from SRTF Jordan; (3)  SRTF Jordan; (4)  SRTF YÖNETİM HİZMETLERİ ANONİM ŞİRKETİ "SRTF A.S.; (5)  SRTF staff in Jordan working under GOPA Infra Middle East; (6)  SRTF staff in Turkey working under GOPA Infra Turkey; (7)  SRTF staff in Erbil/Iraq working under EMP (Erbil Manpower) contracted by GOPA Infra Middle East; and (8) Ombudsman.

 

Transferring Your Personal Data to a Third Country or to an International Organization

The SRTF Jordan may transfer your personal data to one or more countries outside Jordan (known as third countries), where its “other affiliate members”, donors or its service providers or suppliers maintain operations. If your personal data is disclosed to third parties and/or “other affiliate members” outside Jordan, these third parties or “other affiliate members” may be based in territories that may not have equivalent data protection laws and may not provide adequate level of protection for personal data. In these circumstances, the SRTF Jordan will, as required by the Personal Data Protection Laws, ensure that your privacy rights are adequately protected by appropriate technical, organizational, contractual, or other lawful means.[2] The SRTF Jordan may transfer your personal data outside Jordan:

• In response to a request made by you;
• To “other affiliate members”;
• To the SRTF’s selected third party services providers or suppliers;
• Where the SRTF is legally required to do so;
• In order to facilitate the operation of the SRTF Jordan, where it is in the justified interests of SRTF Jordan and that SRTF Jordan has concluded these are not overridden by your rights.

 

Appointment of a Data Protection Officer (“DPO”)

In compliance with the Personal Data Protection Laws, the STRF Jordan has appointed a DPO who will oversee our database and ensure the processing of data aligns with the provisions of the Personal Data Protection Laws.

The DPO shall assume the tasks and responsibilities assigned to him/her under the Personal Data Protection Laws.[3] The DPO shall, among other things, monitor and ensure compliance with the Personal Data Protection Laws; conduct regular assessments of database and data processing systems for security and compliance; and ensure your rights in accordance with the Personal Data Protection Laws and enabling you to exercise your rights as provided by the aforementioned law.

 

How Long the SRTF Jordan Stores Your Personal Data

The duration of storage of personal data depends on the purposes of the relevant processing. The various storage periods cannot be listed here in a reasonable format. If we process data only for the purpose of executing a contractual relationship, we store the data for the duration of the contractual relationship. The SRTF Jordan will also retain your personal data for a certain period after your relationship with the SRTF Jordan ends, in order to meet the legal or regulatory requirements of the SRTF Jordan under the Personal Data Protection Laws.

Following the end of your relationship with the SRTF Jordan, your personal data will only be used for relevant legal or regulatory purposes and the SRTF Jordan will ensure that your personal data is adequately protected. If the SRTF Jordan does not need to keep personal data for this period of time, then SRTF Jordan may anonymize it or dispose of it securely after the expiry of the statutory storage obligations.

 

Your Data Protection Rights

Pursuant to the Personal Data Protection Laws, you have the following rights:

• Right of Access, the right to obtain confirmation from us as to whether or not personal data concerning you are being processed and, where that is the case, to access and retrieve these personal data and other information;
• Right to withdraw prior consent(s)
• Right of rectification, the right to correct your personal data if not correct or to modify, add to or update these data;
• Right to erasure or concealment in accordance with the Personal Data Protection Laws,[1]g. when personal data are no longer necessary in relation to the purposes for which they were processed, unless the applicable laws provided otherwise. Where personal data has been disclosed to third parties, SRTF Jordan will take reasonable steps to notify such recipients of the erasure request and request deletion of the relevant data, where applicable;
• Right to objection, the right to object to processing and profiling that is unnecessary for the purposes for which your data was collected, excessive for its requirements, discriminatory, or in violation of the Personal Data Projection Law.
• Right to restriction of processing, within a specific scope and
• Right to data portability, the right to receive your personal data from us in a structured, commonly used and machine-readable format and the right to transmit those data to another controller.

To submit an access, deletion, objection, correction, or transfer request, send your request to Privacy@srtfund.org.
SRTF Jordan may verify the identity of the requester before processing any request relating to personal data. Requests will be acknowledged upon receipt and addressed within fifteen (15) working days from the date of receipt, unless an extension is required for justified reasons in accordance with applicable data protection laws. Records of such requests may be maintained for compliance and audit purposes.

 

Personal Data Breach

In the event of any actual or suspected breach, violation, compromise, or unauthorized access affecting the security and integrity of your Personal Data, SRTF Jordan will take appropriate containment, investigation, and remediation measures and will notify relevant parties in accordance with the Personal Data Protection Law.
Where the breach is assessed as serious and could cause significant harm to you, we will notify affected Data Subjects as soon as possible and provide recommended measures to reduce or avoid potential consequences, and we will notify the competent Personal Data Protection Unit (“the Unit”) within 72 hours from discovery of the breach, including (to the extent available) the source of the breach, its mechanism, the affected Data Subjects (or affected groups), and other information required under applicable law or instructions. Where the breach is not assessed as serious or not likely to cause significant harm, we will still take appropriate containment, investigation, and remediation actions, and will notify you and/or the Unit where required by applicable law and instructions.

 

Updates to This Privacy Policy

We may update this Privacy Policy from time to time and without prior notice to you to reflect changes in our data processing practices. We will publish such policy on our website and indicate at the top of the policy when it was most recently updated.

 

Complaints

If you have any concerns or complaints regarding the handling of your personal information, you are encouraged to contact the Data Protection Officer (“DPO”) who oversees the complaint resolution process.

• All complaints will be reviewed promptly and addressed in accordance with the Personal Data Protection Laws and our internal policies and procedures.
• We aim to provide a response within ten (10) days of receipt of your complaint, where Possible.
• Upon registering a complaint, providing the complainant with a follow-up reference number for their records.
• Informing the complainant of the outcome of their complaint once it has been fully investigated.
• If you are not satisfied with the initial resolution provided by us, you may escalate the matter to the organizational unit responsible for personal data protection in accordance with the Personal Data Protection Laws.
• Submitting a request or complaint under this policy will not be subject to any fees.

You may contact the Data Protection Officer (“DPO”) by sending a message to Privacy@srtfund.org

 

Contact us

Should you have any additional inquiries about this policy, or wish to update or correct your information, submit a request, or ask us questions, please feel free to contact us using the following link:

https://www.srtfund.org/forms/contact