1. Introduction
EURL METWORK (“Metwork”, “we”, “us”, “our”) operates the platform accessible at https://metwork.dz and associated mobile applications (collectively, the “Platform”).
We are committed to processing your personal data lawfully, fairly, and transparently. This Privacy Policy describes our practices in accordance with Algerian Law 18-07 of June 10, 2018, relating to the protection of natural persons in the processing of personal data (the “Law”), as well as its implementing decrees.
By creating an account or using our Platform, you acknowledge that you have read and understood this policy. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.
2. Data controller
The data controller responsible for your personal data is:
EURL METWORK
Commerce register: 31/00-1125194 B24
Boulevard de la Soumam N 02, Bloc 02, Apt 01, Oran
Email: contact@metwork.dz
Phone: +213670109105
Our Data Protection Officer (DPO) can be reached at dpo@metwork.dz.
3. Data we collect
We collect only the personal data that is necessary for the purposes described in this policy (principle of data minimisation). Categories of data we may process include:
3.1 Account data
When you register on Metwork, we collect:
- Full name
- Email address
- Phone number (Algerian mobile)
- City of residence
- Role (entrepreneur, investor, or incubator)
- Password (stored as a one-way cryptographic hash — we never store plaintext passwords)
3.2 Profile & activity data
As you use the Platform, we may also collect:
- Startup profile information (name, description, industry, funding details) if you list a startup
- Booking records for coworking spaces or programs
- Event registrations and attendance records
- Messages sent through the contact form
- Wallet and payment transaction records
3.3 Technical data
We automatically collect certain technical information when you visit the Platform:
- IP address and approximate geolocation
- Browser type, version, and language settings
- Device type and operating system
- Pages visited and time spent, referral source
- Session identifiers and authentication tokens
3.4 Data from third parties
If you use a third-party payment provider (SlickPay), we receive a transaction reference and status confirmation, but never your full card or banking details.
4. How we use your data
We use personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Contract performance |
| Verifying your phone number via OTP | Contract performance / Consent |
| Facilitating program applications and space bookings | Contract performance |
| Processing wallet top-ups and payments | Contract performance |
| Connecting entrepreneurs with investors | Consent |
| Sending transactional emails and notifications | Contract performance |
| Sending marketing communications (opt-in only) | Consent |
| Detecting and preventing fraud or abuse | Legitimate interest |
| Analysing platform usage to improve our services | Legitimate interest |
| Complying with legal obligations | Legal obligation |
5. Legal basis for processing
Under Article 14 of Law 18-07, the processing of personal data requires one of the following lawful grounds. We rely on:
- Explicit consent — You provide consent at account creation via a dedicated checkbox acknowledging this Privacy Policy and data processing. You may withdraw consent at any time by contacting us or deleting your account.
- Performance of a contract — Processing is necessary to deliver the services you requested when signing up (bookings, startup listings, wallet).
- Legal obligation — We may process and retain data to comply with applicable Algerian law (e.g., accounting and tax obligations).
- Legitimate interest — We process technical and analytics data to secure and improve the Platform, provided this does not override your fundamental rights and freedoms.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
6. Data retention
We retain personal data for as long as necessary to fulfil the purposes set out in this policy, and no longer than required by applicable law. Specific retention periods:
- Account data: Retained for the duration of your account plus 30 days after account deletion (to allow recovery if deletion was accidental), then permanently erased.
- Transaction records: Retained for 10 years as required by Algerian tax and accounting law.
- Contact form submissions: Retained for 2 years from submission date, then deleted.
- Technical logs: Retained for 12 months, then automatically purged or anonymised.
- OTP codes: Expire within 10 minutes and are never stored after verification.
Data subject to a legal hold (e.g., ongoing dispute or regulatory request) may be retained beyond standard periods until the hold is lifted.
9. Your rights under Law 18-07
Algerian Law 18-07 grants you the following rights with respect to your personal data. To exercise any right, contact us at dpo@metwork.dz or through your account settings. We will respond within 30 days.
Right of access
Obtain a copy of all personal data we hold about you, and information on how it is processed.
Right to rectification
Correct inaccurate or incomplete personal data. You can update most data directly in your account settings.
Right to erasure
Request deletion of your personal data where it is no longer necessary for the purpose it was collected, subject to legal retention obligations.
Right to restriction
Ask us to restrict processing of your data in certain circumstances (e.g., while accuracy is disputed).
Right to data portability
Receive your personal data in a structured, machine-readable format and transmit it to another controller.
Right to object
Object at any time to processing based on legitimate interest, including profiling for direct marketing.
Right to withdraw consent
Where processing is based on consent, withdraw it at any time without penalty. Withdrawal does not affect prior processing.
Right to lodge a complaint
File a complaint with the Algerian National Authority for Personal Data Protection (ANPDP) if you believe your rights have been violated.
Supervisory authority: You have the right to lodge a complaint with the ANPDP (Autorité Nationale de Protection des Données à caractère Personnel), the Algerian data protection authority, if you believe we have failed to comply with Law 18-07.
10. Data security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. Our measures include:
- Encryption in transit using TLS 1.2+ for all data exchanges
- Encryption at rest for database storage
- Passwords hashed using Argon2id (a memory-hard, salted algorithm)
- Role-based access controls limiting internal data access on a need-to-know basis
- Regular security assessments and penetration testing
- Automated anomaly detection and rate limiting
- Multi-factor authentication for administrative access
Despite these measures, no system is perfectly secure. In the event of a personal data breach likely to result in high risk to your rights and freedoms, we will notify you and the competent authorities without undue delay, and in any case within 72 hours of becoming aware, as required by Law 18-07.
11. Children's privacy
The Platform is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us immediately at contact@metwork.dz and we will delete the relevant data promptly.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will:
- Update the “Last updated” date at the top of this page
- Send an email notification to all registered users
- Display an in-app notice for 30 days after the update
Your continued use of the Platform after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree, you may close your account before the changes take effect.
13. Contact & Data Protection Officer
For any questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact our Data Protection Officer:
Data Protection Officer — Metwork
Email: dpo@metwork.dz
Boulevard de la Soumam N 02, Bloc 02, Apt 01, Oran
We will acknowledge your request within 5 business days and provide a substantive response within 30 calendar days. If your request is complex or you have submitted multiple requests, we may extend this period by up to two additional months, in which case we will inform you accordingly.