Privacy & Compliance

Your data remains your data.

Organizations using M&E Plus retain full ownership and control of all information stored within the platform. M&E Plus does not claim ownership over customer data, survey responses, beneficiary records, case files, attachments, reports, or any other information managed through the platform.
Customers can access, export, and manage their data at any time throughout their subscription period.

We are committed to protecting personal and organizational data through responsible data management practices and internationally recognized privacy principles.

Our privacy framework is designed to support customer compliance with applicable data protection regulations, including the General Data Protection Regulation (GDPR) and other relevant privacy requirements.

We strive to collect only the information necessary to deliver our services and to ensure that data is processed transparently, securely, and for legitimate purposes.

Protecting customer data is a core component of the M&E Plus platform.

Our security approach combines secure cloud infrastructure, encryption technologies, role-based access controls, authentication mechanisms, audit logging, backup procedures, and operational safeguards designed to reduce risk and protect customer information.

Security is continuously reviewed and strengthened as technologies, threats, and customer requirements evolve.

Protecting customer data is a core component of the M&E Plus platform.

Our security approach combines secure cloud infrastructure, encryption technologies, role-based access controls, authentication mechanisms, audit logging, backup procedures, and operational safeguards designed to reduce risk and protect customer information.

Security is continuously reviewed and strengthened as technologies, threats, and customer requirements evolve.

Artificial Intelligence is integrated into selected M&E Plus capabilities to improve efficiency, support analysis, and assist users in generating insights.

We believe AI should support people, not replace them.

Our Responsible AI approach emphasizes transparency, accountability, fairness, human oversight, privacy protection, and responsible innovation. AI-generated outputs should always be reviewed by qualified users and considered as decision-support tools rather than autonomous decision-making systems.

Customer data is never used to train public artificial intelligence models without explicit authorization.

We believe customers should clearly understand how their information is managed, protected, and processed.

Through this Trust Center, we provide access to our privacy, security, compliance, and responsible AI commitments, as well as information regarding data ownership, subprocessors, retention practices, and customer rights.

We continuously review and improve our policies and controls to align with evolving regulations, emerging technologies, and the needs of the organizations we serve.

Customer Data Ownership

Customers retain full ownership of all information stored within M&E Plus.

Secure Cloud Infrastructure

M&E Plus is hosted on secure cloud infrastructure designed to provide reliability, availability, and protection of customer information.

Controlled Access

Access to information is governed through user roles, permissions, and authentication controls.

Privacy by Design

Privacy considerations are incorporated into the design, development, and operation of our platform.

Responsible Innovation

AI-enabled features are developed and deployed in accordance with ethical and responsible technology principles.

Continuous Improvement

We regularly review our policies, procedures, and security practices to strengthen protection and improve customer trust.
Additional Information
The Trust Center provides access to detailed information regarding:

• Privacy Policy
• Data Ownership & Processing
• Security Overview
• GDPR Compliance Statement
• Data Retention & Deletion
• Subprocessors
• Incident Response
• Responsible AI
• Terms of Service

Questions regarding privacy, security, compliance, or responsible AI practices may be directed to:
privacy@mandeplus.com

M&E Plus is designed around a simple principle: organizations should retain full ownership and control of their information.

Whether you are managing monitoring and evaluation data, assessments, surveys, case management records, beneficiary information, project documentation, or organizational reports, ownership of that information always remains with your organization.

M&E Plus does not claim ownership of customer data and does not use customer information for commercial purposes unrelated to the delivery of the platform and associated services.

All information uploaded, collected, generated, stored, or managed within M&E Plus remains the sole property of the Customer.

This includes, but is not limited to:

• User-generated content
• Survey and assessment responses
• Beneficiary and participant records
• Case management information
• Project and program data
• Monitoring and evaluation data
• Attachments and supporting documents
• Dashboards, reports, and analytics generated from customer data

Customers maintain full control over how their information is collected, accessed, used, retained, shared, and deleted.

In most deployments, the Customer acts as the Data Controller.
As Data Controller, the Customer determines:

• What information is collected
• Why information is collected
• Who can access information
• How long information is retained
• Applicable consent requirements
• Applicable legal and regulatory obligations

ArabiaGIS K&A Plus acts as the Data Processor and processes information solely for the purpose of providing, securing, maintaining, and supporting the M&E Plus platform.

Access to customer information by ArabiaGIS K&A Plus personnel is restricted and controlled.

Access may occur only when:

• Requested or authorized by the Customer
• Required for technical support
• Required for troubleshooting or maintenance
• Required to investigate security incidents
• Required by applicable law

All such access is subject to internal authorization procedures and may be logged for audit and accountability purposes.

ArabiaGIS K&A Plus does not:

• Sell customer data
• Rent customer data
• Share customer data for advertising purposes
• Use customer data for marketing activities
• Create commercial profiles based on customer data
• Monetize customer information

Customer information is processed solely for the delivery and operation of M&E Plus services.

Customers may access and export their information throughout their subscription period.

Where applicable, exports may be available in commonly used formats such as:

• Excel
• CSV
• JSON
• PNG
• Files or Other supported formats

This enables organizations to retain full control over their information and avoid vendor lock-in.

If a Customer decides to discontinue the use of M&E Plus, the Customer may request a complete export of its information.

Following the completion of the export process and any applicable retention period, customer information will be removed from active production systems and subsequently deleted from backup systems in accordance with established retention and deletion procedures.

Security is a core component of the M&E Plus platform.

We recognize that organizations use M&E Plus to manage operational, programmatic, and in some cases sensitive information. Our security approach combines technology, processes, and operational controls designed to help protect customer information from unauthorized access, disclosure, alteration, or loss.

M&E Plus is hosted on secure cloud infrastructure designed to provide reliability, scalability, and availability.
The platform benefits from modern cloud security capabilities including physical security, network protection, infrastructure monitoring, and redundancy mechanisms.

M&E Plus uses encryption technologies to help protect information during transmission and storage.

Security measures may include:

• Encrypted communications using industry-standard TLS protocols
• Encryption of stored information where applicable
• Secure password storage mechanisms
• Secure backup procedures

Access to information within M&E Plus is governed through role-based permissions and user authentication controls.

Organizations can define user roles and access levels according to their operational requirements.

Access control capabilities may include:

• Role-based permissions
• User management
• Password policies
• Multi-factor authentication capabilities
• Session management controls

M&E Plus supports accountability through audit and monitoring capabilities.

Depending on configuration, audit records may include:

• User logins
• Data creation activities
• Data modifications
• Data exports
• Administrative actions
• Security-related events

To help protect customer information against accidental loss or system failure, M&E Plus incorporates backup and recovery procedures.

Backup processes are designed to support business continuity and service recovery requirements.

Security controls and platform operations are regularly reviewed to identify risks, strengthen protections, and support platform reliability.

Security measures continue to evolve as technology, regulations, and customer requirements change.

Security is a shared responsibility.

While M&E Plus provides technical and operational safeguards, customers also play an important role through:

• Appropriate user management
• Access control reviews
• Strong password practices
• User awareness and training
• Responsible for handling exported information

Together, these measures help create a secure environment for managing organizational data.

M&E Plus is committed to protecting personal information and supporting customers in meeting their privacy and data protection obligations.

Our privacy practices are designed to align with internationally recognized data protection principles, including those reflected in the European Union General Data Protection Regulation (GDPR).

For most implementations of M&E Plus:

The Customer acts as the Data Controller.

ArabiaGIS K&A Plus acts as the Data Processor.

As Data Controller, the Customer determines:

• The purpose of data collection
• The lawful basis for processing
• Data retention requirements
• User permissions and access rights

As Data Processor, ArabiaGIS K&A Plus processes information solely for the purpose of providing and supporting the M&E Plus platform.

M&E Plus is designed to support customer obligations related to data subject rights.

Depending on configuration and customer policies, organizations may use platform capabilities to support:

• Access requests
• Data correction requests
• Data export requests
• Data deletion requests
• Data portability requests

Requests relating to personal data should generally be directed to the organization acting as the Data Controller.

Privacy considerations are integrated into the design, development, and operation of the platform.

This includes consideration of:

• Access controls
• Data minimization
• User permissions
• Auditability
• Secure processing practices

M&E Plus incorporates technical and organizational measures designed to help protect personal information, including:

1. Access controls
2. Authentication mechanisms
3. Encryption technologies
4. Audit logging capabilities
5. Backup and recovery procedures
6. Security monitoring practices

Where information is processed using cloud infrastructure or authorized service providers, appropriate safeguards are applied to support the secure handling of information.

Questions relating to privacy, data protection, or GDPR-related matters may be directed to:
privacy@mandeplus.com

We continuously review our privacy practices and policies to align with evolving regulations, customer expectations, and industry best practices.

M&E Plus incorporates artificial intelligence (AI) technologies to assist users in managing information, generating insights, improving efficiency, and supporting decision-making processes.

This policy explains how AI features are used within M&E Plus and outlines our commitment to transparency, accountability, and human oversight.

We believe that AI should support people, not replace them.

AI capabilities within M&E Plus are designed to assist organizations in performing tasks more efficiently while ensuring that final decisions remain under human control.

AI-generated outputs should be considered recommendations, suggestions, summaries, or decision-support tools rather than authoritative or final decisions.

Depending on enabled modules and customer configurations, AI features may assist with:

• Indicator suggestions
• Logframe development
• Reporting support
• Proposal drafting assistance
• Data categorization
• Data quality checks
• Translation services
• Summarization
• Dashboard insights
• Knowledge management
• Survey design support
• Text analysis and sentiment analysis

Capabilities may evolve as new features are introduced.

Human review remains essential.

Organizations and users remain responsible for:

• Reviewing AI-generated outputs
• Validating recommendations
• Verifying calculations and conclusions
• Approving reports and decisions
• Ensuring compliance with organizational policies

M&E Plus does not make autonomous decisions on behalf of customers.

Where AI-generated outputs are provided, M&E Plus seeks to clearly distinguish AI-generated content from user-generated content whenever practical.

Users should understand:

• When AI is being used
• The purpose of the AI capability
• The limitations of AI-generated outputs

Customer information remains protected under the same privacy and security controls applicable to the rest of the platform.

M&E Plus does not use customer information to train public artificial intelligence models without explicit customer authorization.

We strive to promote fairness and reduce the risk of unintended bias in AI-assisted features.

Organizations should independently evaluate AI-generated outputs before applying them to sensitive operational, programmatic, or policy decisions.

AI-generated outputs should not be used as the sole basis for decisions involving:

• Beneficiary eligibility
• Legal determinations
• Employment decisions
• Protection referrals
• Financial assistance approvals
• Human rights assessments
• Sensitive case management outcomes

Appropriate human review should always be maintained.

We continuously review AI-enabled capabilities to improve quality, transparency, safety, and reliability.

Feedback from customers plays an important role in this process.

Questions regarding AI governance or responsible AI practices may be directed to:
privacy@mandeplus.com

By accessing or using M&E Plus, you agree to be bound by these Terms of Service.

If you are using M&E Plus on behalf of an organization, you represent that you are authorized to accept these Terms on behalf of that organization.

M&E Plus is a cloud-based platform designed to support impact management, monitoring, evaluation, learning, surveys, assessments, case management, reporting, data collection, analytics, and related operational functions.

Services may evolve over time as new features, integrations, and capabilities are introduced.

Customers are responsible for:

• Maintaining account security
• Managing user permissions
• Protecting credentials
• Ensuring authorized access

M&E Plus reserves the right to suspend access in cases of abuse or security risks.

All customer data remains the property of the Customer.

M&E Plus does not claim ownership over information stored within the M&E Plus platform.

Additional details are available in the Data Ownership & Processing Policy.

All rights, title, and interest in M&E Plus, including:

• Software
• Source code
• Architecture
• Design
• Documentation
• Methodologies
• Templates
• Indicators Library
• Trademarks

remain the exclusive property of M&E Plus and its licensors.

These Terms do not grant ownership of the platform itself.

We strive to provide reliable and uninterrupted service.
However, M&E Plus is provided on a commercially reasonable basis, and availability may be affected by:

• Maintenance activities
• Infrastructure issues
• Security events
• Circumstances beyond reasonable control

Support services may be provided according to the Customer's subscription plan, support agreement, or contractual arrangements.

Response times and service levels may vary by subscription type.

M&E Plus may integrate with third-party products or services.

M&E Plus is not responsible for the availability, content, or practices of third-party services.

Each party agrees to protect confidential information received from the other party and to use such information solely for authorized purposes.

Confidential information shall not be disclosed except as required by law or authorized by the disclosing party.

To the maximum extent permitted by law, M&E Plus shall not be liable for indirect, incidental, special, consequential, or punitive damages arising from the use or inability to use M&E Plus platform.

Total liability shall not exceed amounts paid by the Customer for the applicable subscription period unless otherwise agreed in writing.

Customers may discontinue use of M&E Plus in accordance with their subscription terms.

ArabiaGIS K&A Plus may suspend or terminate access where necessary to protect platform security, comply with legal obligations, or address material violations of these Terms.

These Terms shall be governed by the laws applicable to the contractual agreement between the parties unless otherwise specified in a separate written agreement.

We may update these Terms periodically.

Material updates will be communicated through appropriate channels and published through the M&E Plus Trust Center.

Questions regarding these Terms may be directed at:
privacy@mandeplus.com or info@mandeplus.com