1. Controller
The controller is Elaco Digitech, a single-member limited liability company (SUARL) with a share capital of 2 250 TND, registered with the Tunisian National Business Register (RNE) under unique identifier T1820166, with its registered office at Résidence Al Bassatine 2, Rue Misr, Soliman Riadh, 8020 Soliman, Nabeul, Tunisia. For any question or to exercise your rights: contact@coworkingos.com.
This policy covers visitors to the CoworkingOS website, people who create an account and their staff. For the data of a coworking space’s own customers (bookings, memberships), the space is the controller and Elaco Digitech acts as processor: please contact the space first.
2. Data we collect
- Account: first name, last name, email address, phone, password (stored only in hashed form), language.
- Space: name, address, number of desks, billing country, locations, plan and billing history.
- Usage and security: login logs, IP address, browser type, actions taken in the dashboard.
- Communications: messages sent to support or through the contact form.
We collect no sensitive data and never receive payment card numbers.
3. Purposes and legal bases
- Creating and managing the account, providing the Platform, the trial and support: performance of the contract.
- Invoicing and accounting: legal obligation.
- Securing the Platform, preventing fraud and abuse, improving the service from statistics: legitimate interest.
- Service messages (trial, renewals, changes to the Terms): performance of the contract. Optional marketing messages are only sent with your consent or, for business customers, about similar services, with an unsubscribe link.
4. International transfers
Elaco Digitech is established in Tunisia and its hosting providers are located outside Tunisia. Transfers are made in accordance with Organic Law No. 2004-63 and the requirements of the National Authority for the Protection of Personal Data (INPDP).
For people in the European Union or the European Economic Area, transfers to Tunisia or to another country without an adequacy decision are covered by the European Commission’s Standard Contractual Clauses and supplementary security measures.
5. Retention periods
- Account and Space: for the term of the contract, then deleted within 90 days after it ends (or after the end of an unconverted trial, after at least 90 days).
- Invoices and accounting records: 10 years, as required by law.
- Security logs: 12 months.
- Communications with a prospect: 3 years after the last contact.
6. Security
Connections are encrypted (HTTPS), passwords are hashed, each space’s data is isolated by database-level access rules, and internal access is limited to the people who need it.
7. Your rights
You can ask to access, correct or delete your data, and object to its processing on legitimate grounds, by writing to contact@coworkingos.com. We answer within one month. Proof of identity may be requested.
Tunisia: these rights are guaranteed by Organic Law No. 2004-63. You may contact the INPDP (www.inpdp.tn).
European Union: you also have the rights to restriction and portability, to withdraw consent at any time, and to lodge a complaint with the data protection authority of your country (for example the CNIL in France).
United States and Canada: depending on your state or province (for example California), you may request to know, correct or delete your data, and you will not be discriminated against for exercising these rights. We do not sell or share your data for targeted advertising.
9. Changes
We may update this policy. The update date is shown at the top of the page; account holders are informed by email of any significant change.
This text is available in French, English and Arabic. If the versions differ, the French version prevails.