Legal

Your data remains your data.

Organizations using M&E Plus retain full ownership and control of all information stored within the platform. M&E Plus does not claim ownership over customer data, survey responses, beneficiary records, case files, attachments, reports, or any other information managed through the platform.
Customers can access, export, and manage their data at any time throughout their subscription period.

We are committed to protecting personal and organizational data through responsible data management practices and internationally recognized privacy principles.

Our privacy framework is designed to support customer compliance with applicable data protection regulations, including the General Data Protection Regulation (GDPR) and other relevant privacy requirements.

We strive to collect only the information necessary to deliver our services and to ensure that data is processed transparently, securely, and for legitimate purposes.

Protecting customer data is a core component of the M&E Plus platform.

Our security approach combines secure cloud infrastructure, encryption technologies, role-based access controls, authentication mechanisms, audit logging, backup procedures, and operational safeguards designed to reduce risk and protect customer information.

Security is continuously reviewed and strengthened as technologies, threats, and customer requirements evolve.

Protecting customer data is a core component of the M&E Plus platform.

Our security approach combines secure cloud infrastructure, encryption technologies, role-based access controls, authentication mechanisms, audit logging, backup procedures, and operational safeguards designed to reduce risk and protect customer information.

Security is continuously reviewed and strengthened as technologies, threats, and customer requirements evolve.

Artificial Intelligence is integrated into selected M&E Plus capabilities to improve efficiency, support analysis, and assist users in generating insights.

We believe AI should support people, not replace them.

Our Responsible AI approach emphasizes transparency, accountability, fairness, human oversight, privacy protection, and responsible innovation. AI-generated outputs should always be reviewed by qualified users and considered as decision-support tools rather than autonomous decision-making systems.

Customer data is never used to train public artificial intelligence models without explicit authorization.

We believe customers should clearly understand how their information is managed, protected, and processed.

Through this Trust Center, we provide access to our privacy, security, compliance, and responsible AI commitments, as well as information regarding data ownership, subprocessors, retention practices, and customer rights.

We continuously review and improve our policies and controls to align with evolving regulations, emerging technologies, and the needs of the organizations we serve.

Customer Data Ownership

Customers retain full ownership of all information stored within M&E Plus.

Secure Cloud Infrastructure

M&E Plus is hosted on secure cloud infrastructure designed to provide reliability, availability, and protection of customer information.

Controlled Access

Access to information is governed through user roles, permissions, and authentication controls.

Privacy by Design

Privacy considerations are incorporated into the design, development, and operation of our platform.

Responsible Innovation

AI-enabled features are developed and deployed in accordance with ethical and responsible technology principles.

Continuous Improvement

We regularly review our policies, procedures, and security practices to strengthen protection and improve customer trust.
Additional Information
The Trust Center provides access to detailed information regarding:

• Privacy Policy
• Data Ownership & Processing
• Security Overview
• GDPR Compliance Statement
• Data Retention & Deletion
• Subprocessors
• Incident Response
• Responsible AI
• Terms of Service

Questions regarding privacy, security, compliance, or responsible AI practices may be directed to:
privacy@mandeplus.com

M&E Plus is designed around a simple principle: organizations should retain full ownership and control of their information.

Whether you are managing monitoring and evaluation data, assessments, surveys, case management records, beneficiary information, project documentation, or organizational reports, ownership of that information always remains with your organization.

M&E Plus does not claim ownership of customer data and does not use customer information for commercial purposes unrelated to the delivery of the platform and associated services.

All information uploaded, collected, generated, stored, or managed within M&E Plus remains the sole property of the Customer.

This includes, but is not limited to:

• User-generated content
• Survey and assessment responses
• Beneficiary and participant records
• Case management information
• Project and program data
• Monitoring and evaluation data
• Attachments and supporting documents
• Dashboards, reports, and analytics generated from customer data

Customers maintain full control over how their information is collected, accessed, used, retained, shared, and deleted.

In most deployments, the Customer acts as the Data Controller.
As Data Controller, the Customer determines:

• What information is collected
• Why information is collected
• Who can access information
• How long information is retained
• Applicable consent requirements
• Applicable legal and regulatory obligations

ArabiaGIS K&A Plus acts as the Data Processor and processes information solely for the purpose of providing, securing, maintaining, and supporting the M&E Plus platform.

Access to customer information by ArabiaGIS K&A Plus personnel is restricted and controlled.

Access may occur only when:

• Requested or authorized by the Customer
• Required for technical support
• Required for troubleshooting or maintenance
• Required to investigate security incidents
• Required by applicable law

All such access is subject to internal authorization procedures and may be logged for audit and accountability purposes.

ArabiaGIS K&A Plus does not:

• Sell customer data
• Rent customer data
• Share customer data for advertising purposes
• Use customer data for marketing activities
• Create commercial profiles based on customer data
• Monetize customer information

Customer information is processed solely for the delivery and operation of M&E Plus services.

Customers may access and export their information throughout their subscription period.

Where applicable, exports may be available in commonly used formats such as:

• Excel
• CSV
• JSON
• PNG
• Files or Other supported formats

This enables organizations to retain full control over their information and avoid vendor lock-in.

If a Customer decides to discontinue the use of M&E Plus, the Customer may request a complete export of its information.

Following the completion of the export process and any applicable retention period, customer information will be removed from active production systems and subsequently deleted from backup systems in accordance with established retention and deletion procedures.

Security is a core component of the M&E Plus platform.

We recognize that organizations use M&E Plus to manage operational, programmatic, and in some cases sensitive information. Our security approach combines technology, processes, and operational controls designed to help protect customer information from unauthorized access, disclosure, alteration, or loss.

M&E Plus is hosted on secure cloud infrastructure designed to provide reliability, scalability, and availability.
The platform benefits from modern cloud security capabilities including physical security, network protection, infrastructure monitoring, and redundancy mechanisms.

M&E Plus uses encryption technologies to help protect information during transmission and storage.

Security measures may include:

• Encrypted communications using industry-standard TLS protocols
• Encryption of stored information where applicable
• Secure password storage mechanisms
• Secure backup procedures

Access to information within M&E Plus is governed through role-based permissions and user authentication controls.

Organizations can define user roles and access levels according to their operational requirements.

Access control capabilities may include:

• Role-based permissions
• User management
• Password policies
• Multi-factor authentication capabilities
• Session management controls

M&E Plus supports accountability through audit and monitoring capabilities.

Depending on configuration, audit records may include:

• User logins
• Data creation activities
• Data modifications
• Data exports
• Administrative actions
• Security-related events

To help protect customer information against accidental loss or system failure, M&E Plus incorporates backup and recovery procedures.

Backup processes are designed to support business continuity and service recovery requirements.

Security controls and platform operations are regularly reviewed to identify risks, strengthen protections, and support platform reliability.

Security measures continue to evolve as technology, regulations, and customer requirements change.

Security is a shared responsibility.

While M&E Plus provides technical and operational safeguards, customers also play an important role through:

• Appropriate user management
• Access control reviews
• Strong password practices
• User awareness and training
• Responsible for handling exported information

Together, these measures help create a secure environment for managing organizational data.

M&E Plus is committed to protecting personal information and supporting customers in meeting their privacy and data protection obligations.

Our privacy practices are designed to align with internationally recognized data protection principles, including those reflected in the European Union General Data Protection Regulation (GDPR).

For most implementations of M&E Plus:

The Customer acts as the Data Controller.

ArabiaGIS K&A Plus acts as the Data Processor.

As Data Controller, the Customer determines:

• The purpose of data collection
• The lawful basis for processing
• Data retention requirements
• User permissions and access rights

As Data Processor, ArabiaGIS K&A Plus processes information solely for the purpose of providing and supporting the M&E Plus platform.

M&E Plus is designed to support customer obligations related to data subject rights.

Depending on configuration and customer policies, organizations may use platform capabilities to support:

• Access requests
• Data correction requests
• Data export requests
• Data deletion requests
• Data portability requests

Requests relating to personal data should generally be directed to the organization acting as the Data Controller.

Privacy considerations are integrated into the design, development, and operation of the platform.

This includes consideration of:

• Access controls
• Data minimization
• User permissions
• Auditability
• Secure processing practices

M&E Plus incorporates technical and organizational measures designed to help protect personal information, including:

1. Access controls
2. Authentication mechanisms
3. Encryption technologies
4. Audit logging capabilities
5. Backup and recovery procedures
6. Security monitoring practices

Where information is processed using cloud infrastructure or authorized service providers, appropriate safeguards are applied to support the secure handling of information.

Questions relating to privacy, data protection, or GDPR-related matters may be directed to:
privacy@mandeplus.com

We continuously review our privacy practices and policies to align with evolving regulations, customer expectations, and industry best practices.

This Privacy Policy applies to:

• M&E Plus web applications
• Mobile applications
• APIs and integrations
• Customer support services
• Related websites and online services

In most deployments:

• The Customer acts as the Data Controller.
• M&E Plus acts as the Data Processor.

The Customer determines:

• What information is collected
• Why information is collected
• How long is the information retained
• Who can access information

M&E Plus processes information solely to provide, maintain, secure, and support the platform.

Depending on how M&E Plus is configured and used, information processed may include:

Account Information

• Name
• Organization
• Email address
• User role
• Authentication details

Operational Information

• Project information
• Monitoring and evaluation data
• Survey responses
• Assessments
• Indicators
• Activity records

Beneficiary and Case Information

Where applicable:

• Demographic information
• Contact details
• Program and project participation records
• Case management information
• Uploaded documents

Technical Information

• Device information
• Browser information
• Login history
• IP addresses
• Audit logs
• Usage statistics

Information may be processed for the following purposes:

• Delivering platform services
• Managing user access
• Generating reports and analytics
• Providing technical support
• Improving system performance
• Maintaining platform security
• Meeting legal obligations

Information is not sold, rented, or used for advertising purposes.

M&E Plus may provide AI-assisted features to support analysis, reporting, data management, and decision-support activities.

AI-generated outputs:

• Are intended to assist users
• Do not replace human judgment
• Should be reviewed before use

Customer information is not used to train public artificial intelligence models without explicit authorization from the Customer.

We implement technical and organizational measures designed to protect information from unauthorized access, disclosure, alteration, or destruction.

Measures may include:

• Encryption technologies
• Access controls
• User authentication
• Audit logging
• Backup procedures
• Security monitoring

No system can guarantee absolute security; however, we continuously improve our safeguards.

Information is retained according to:

• Customer instructions
• Contractual obligations
• Legal requirements
• Operational needs

Customers may define project-specific retention periods where applicable.

Information may only be disclosed:

• To authorized users designated by the Customer
• To approved service providers supporting platform operations
• To comply with legal obligations
• To protect security, rights, or safety

We do not sell customer information.

Information may be processed using cloud infrastructure and authorized service providers located in different jurisdictions.

Appropriate safeguards are applied to support secure processing and transfer of information.

Subject to applicable laws, individuals may have rights, including:

• Access to personal information
• Correction of inaccurate information
• Deletion of personal information
• Restriction of processing
• Data portability
• Withdrawal of consent where applicable

Requests should generally be directed to the Customer acting as Data Controller.

M&E Plus may use cookies and similar technologies to:

• Maintain user sessions
• Improve functionality
• Support security
• Analyze service performance

Additional details may be provided through the Cookie Policy.

We may update this Privacy Policy periodically.

Updated versions will be published through the M&E Plus website and Trust Center.

Questions regarding privacy or data protection may be directed to:
privacy@mandeplus.com

This Cookie Policy explains how M&E Plus uses cookies and similar technologies when users access our websites, applications, and related services.

Cookies help us improve security, functionality, performance, and user experience.

Cookies are small text files stored on a user's device when visiting a website or using an online service.
Cookies may be used to:

• Maintain user sessions
• Remember preferences
• Improve performance
• Support security
• Analyze platform usage

Essential Cookies

These cookies are necessary for the operation of the platform.

Examples include:

• Authentication
• Session management
• Security controls
• User login functionality

Without these cookies, certain services may not function properly.

Functional Cookies

These cookies help remember user preferences and settings.

Examples include:

• Language preferences
• User interface settings
• Saved preferences

Performance and Analytics Cookies

These cookies help us understand how visitors interact with our websites and services.

Examples may include:

• Page visits
• Navigation behavior
• Feature usage
• Performance monitoring

Information collected is generally aggregated and used to improve service quality.

Security Cookies

These cookies help detect suspicious activity and protect user accounts and platform resources.

Examples include:

• Fraud prevention
• Authentication validation
• Security monitoring

Third-Party Cookies

Certain third-party services integrated with M&E Plus websites may place cookies on user devices.

Examples may include:

• Analytics providers
• Embedded content providers
• Customer support tools

Such services operate according to their own privacy and cookie practices.

Managing Cookies

Users can control cookies through browser settings
Most browsers allow users to:

• View cookies
• Delete cookies
• Block cookies
• Configure cookie preferences

Please note that disabling certain cookies may affect platform functionality.

Consent

Where required by applicable regulations, users will be provided with options to accept, reject, or customize cookie preferences.

Continued use of the platform following acceptance of cookies may constitute consent where permitted by applicable law.

Updates

This Cookie Policy may be updated periodically to reflect operational, legal, or technical changes.

Updated versions will be published through the M&E Plus Trust Center.

Contact

Questions regarding cookies or online privacy may be directed to:
privacy@mandeplus.com

M&E Plus recognizes that responsible information management includes not only secure storage but also appropriate retention and deletion practices.

This policy explains how information is retained, archived, exported, and deleted throughout the lifecycle of customer subscriptions and projects.

Customers retain primary responsibility for determining:

• Information retention periods
• Legal and regulatory requirements
• Program-specific obligations
• Archiving requirements

Where available, customers may configure retention periods according to their organizational policies and project requirements.

Information may be retained for:

• Active project implementation
• Reporting and audit requirements
• Contractual obligations
• Legal compliance requirements
• Business continuity purposes

Retention periods may vary depending on:

• Project type
• Sector requirements
• Donor requirements
• National regulations
• Customer instructions

Customers may archive projects that are no longer active.
Archived information remains protected by the same security controls applied to active information.

Customers may request or perform exports of their information at any time during the subscription period.

Supported export formats may include:

• Excel
• CSV
• JSON
• Other supported formats

Upon termination or expiration of a subscription:

• Customers may export their information.
• Customers may request a final data package.
• Access to the platform may be restricted following termination.

Following completion of the offboarding process and subject to applicable contractual or legal requirements:

• Customer information is removed from active systems.
• Associated files and attachments are removed from production environments.
• User access credentials are disabled.

Information contained within encrypted backup systems may remain temporarily available until backup retention periods expire.

Upon expiration of backup retention periods, such information is automatically removed through standard backup lifecycle procedures.

Where required by law, regulation, court order, investigation, or contractual obligation, deletion may be delayed until applicable requirements have been satisfied.

This policy may be reviewed and updated periodically to reflect operational improvements, regulatory requirements, and customer needs.

M&E Plus maintains procedures designed to identify, assess, respond to, and recover from security incidents that may affect platform operations or customer information.

The objective of this policy is to support timely response, minimize impact, and maintain transparency with customers.

Security incidents may include:

• Unauthorized access attempts
• Malware or malicious activity
• Credential compromise
• Service disruptions
• Data exposure events
• Infrastructure security events

All identified incidents are evaluated according to their nature, severity, scope, and potential impact.

Detection

Potential incidents may be identified through

• Security monitoring
• Audit logs
• Customer reports
• Automated alerts
• Internal reviews

Assessment

Once identified, incidents are assessed to determine:

• Scope
• Severity
• Systems affected
• Potential impact on customers

Containment

Appropriate measures are taken to limit the impact of the incident and prevent further exposure or disruption.

Investigation

The incident is investigated to determine:

• Root cause
• Affected systems
• Corrective actions
• Preventive improvements

Recovery

Services and systems are restored using established recovery procedures.

Where an incident is determined to have materially affected customer information or platform services:

• Affected customers will be notified without undue delay.
• Available information regarding the incident will be shared.
• Recommended mitigation actions will be communicated when applicable.

Following significant incidents, lessons learned are incorporated into security practices, procedures, and controls to reduce the likelihood of recurrence.

Security concerns may be reported to:
security@mandeplus.com  or privacy@mandeplus.com

M&E Plus may engage carefully selected third-party service providers to support the delivery, security, maintenance, and operation of the platform.

These providers may process limited customer information solely for the purpose of delivering contracted services.

Subprocessors are evaluated based on factors including:

• Security practices
• Reliability
• Service quality
• Privacy commitments
• Regulatory compliance
• Operational necessity

The following categories of providers may be used to support M&E Plus operations:

Cloud Infrastructure

Purpose
Application hosting, storage, networking, backup, and infrastructure services.

Examples
AWS or equivalent approved infrastructure providers.

Email and Communication Services

Purpose

Customer communications, notifications, and support operations.

Examples

Google Workspace and related communication providers.

Artificial Intelligence Services

Purpose

AI-assisted platform capabilities where enabled by customers.

Examples

Approved AI service providers supporting analytics, reporting, translation, transcription, summarization, and other AI-enabled functionality.

Customer information is not used to train public AI models without customer authorization.

Monitoring and Security Services

Purpose

Platform monitoring, performance management, security operations, and reliability improvement.

All subprocessors are required to:

• Process information only for authorized purposes.
• Maintain appropriate security measures.
• Protect confidentiality.
• Comply with applicable contractual obligations.

This list may be updated as service providers change or new services are introduced.

Material changes may be reflected within the M&E Plus Trust Center.

M&E Plus incorporates artificial intelligence (AI) technologies to assist users in managing information, generating insights, improving efficiency, and supporting decision-making processes.

This policy explains how AI features are used within M&E Plus and outlines our commitment to transparency, accountability, and human oversight.

We believe that AI should support people, not replace them.

AI capabilities within M&E Plus are designed to assist organizations in performing tasks more efficiently while ensuring that final decisions remain under human control.

AI-generated outputs should be considered recommendations, suggestions, summaries, or decision-support tools rather than authoritative or final decisions.

Depending on enabled modules and customer configurations, AI features may assist with:

• Indicator suggestions
• Logframe development
• Reporting support
• Proposal drafting assistance
• Data categorization
• Data quality checks
• Translation services
• Summarization
• Dashboard insights
• Knowledge management
• Survey design support
• Text analysis and sentiment analysis

Capabilities may evolve as new features are introduced.

Human review remains essential.

Organizations and users remain responsible for:

• Reviewing AI-generated outputs
• Validating recommendations
• Verifying calculations and conclusions
• Approving reports and decisions
• Ensuring compliance with organizational policies

M&E Plus does not make autonomous decisions on behalf of customers.

Where AI-generated outputs are provided, M&E Plus seeks to clearly distinguish AI-generated content from user-generated content whenever practical.

Users should understand:

• When AI is being used
• The purpose of the AI capability
• The limitations of AI-generated outputs

Customer information remains protected under the same privacy and security controls applicable to the rest of the platform.

M&E Plus does not use customer information to train public artificial intelligence models without explicit customer authorization.

We strive to promote fairness and reduce the risk of unintended bias in AI-assisted features.

Organizations should independently evaluate AI-generated outputs before applying them to sensitive operational, programmatic, or policy decisions.

AI-generated outputs should not be used as the sole basis for decisions involving:

• Beneficiary eligibility
• Legal determinations
• Employment decisions
• Protection referrals
• Financial assistance approvals
• Human rights assessments
• Sensitive case management outcomes

Appropriate human review should always be maintained.

We continuously review AI-enabled capabilities to improve quality, transparency, safety, and reliability.

Feedback from customers plays an important role in this process.

Questions regarding AI governance or responsible AI practices may be directed to:
privacy@mandeplus.com