Policy
Privacy Notice
Last updated: July 2026
This notice explains how MZA Consultancy ("MZA", "we", "us") processes personal data in connection with this website, with corporate enquiries, and with the project and advisory mandates we undertake. It is written to meet the transparency requirements of the EU General Data Protection Regulation (GDPR) and, where applicable, Jordanian Personal Data Protection Law No. 24 of 2023.
1. Who is responsible for your data
MZA Consultancy is the data controller for the processing described in this notice. MZA is registered in the Netherlands (Registration No. 9121986) and in Jordan (Registration No. 101013412).
Head office: Herikerbergweg 32, 1101 CM Amsterdam, The Netherlands.
Regional office: Mecca Street, Building 186, P.O. Box 143776, Postal Code 11814, Amman, Jordan.
Contact for privacy matters: info@mza-c.com
MZA has not appointed a statutory Data Protection Officer, as its processing does not meet the thresholds in Article 37 GDPR. Privacy enquiries are handled by the address above.
2. Categories of personal data we process
We process a limited set of business-context personal data:
- Contact and identification data. Name, job title, organisation, corporate email address, telephone number and country.
- Enquiry and correspondence data. The content of your message, the subject or opportunity it relates to, and subsequent correspondence.
- Counterparty qualification data. Where you request access to confidential project information, the organisational, financial and track-record information you submit in support of that request, together with the outcome of any qualification or sanctions screening we are required to perform.
- Recruitment data. Where you submit a professional profile, your CV and the career information it contains.
- Subscription data. Where you subscribe to MZA insights, your email address and subscription status.
- Technical data. Server logs generated when the site is served, including IP address, user agent, requested URL and timestamp. These are used to operate and secure the site, and are not used to build profiles.
We do not knowingly collect special categories of personal data, and we ask that you do not include them in enquiries. This site is not directed at children.
3. Why we process it, and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Responding to and administering your enquiry | Steps taken at your request prior to an engagement (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | 24 months from last contact |
| Assessing participation interest in published opportunities | Pre-contractual steps (Art. 6(1)(b)) | Duration of the opportunity plus 24 months |
| Counterparty qualification and integrity screening | Legal obligation (Art. 6(1)(c)); legitimate interests in commercial and sanctions compliance (Art. 6(1)(f)) | 7 years, in line with statutory record-keeping periods |
| Managing an advisory or project mandate | Performance of a contract (Art. 6(1)(b)) | Term of the mandate plus 7 years |
| Sending MZA insights to subscribers | Consent (Art. 6(1)(a)), withdrawable at any time | Until you unsubscribe |
| Considering professional profiles | Pre-contractual steps (Art. 6(1)(b)); consent for retention | 12 months, unless you ask us to keep it on file |
| Operating, securing and maintaining this website | Legitimate interests in service integrity (Art. 6(1)(f)) | Server logs: maximum 90 days |
Where we rely on legitimate interests, we have assessed that our interest in operating a professional advisory business and responding to business enquiries is not overridden by your interests or fundamental rights, given the limited, business-context nature of the data.
4. Confidential project information
Much of MZA's work concerns programmes where the sponsor, counterparties, location and commercial terms are confidential. Where you request access to that information, your request is handled under the qualification and non-disclosure conditions stated with the relevant opportunity. Information you provide in support of such a request may be shared with the project sponsor or its advisers where that is necessary to assess your participation, and only after you have been informed.
5. Who we share personal data with
We do not sell personal data and we do not share it for advertising purposes. We share it with:
- Service providers who support MZA's corporate operations, including website hosting, email and document management. These act as processors under written agreements imposing confidentiality and security obligations.
- Professional advisers, including legal counsel and auditors, where necessary and under professional duties of confidentiality.
- Project counterparties, in the limited circumstances described in section 4.
- Public authorities, where disclosure is required by law, regulation or a valid order.
6. International transfers
MZA operates from the Netherlands and Jordan, so personal data may be transferred between the European Economic Area and Jordan. Jordan is not covered by a European Commission adequacy decision. Transfers are therefore made under the European Commission's Standard Contractual Clauses, supported by appropriate technical and organisational measures. You may request information about the safeguards applied by writing to the contact address above.
7. Security
We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, access control on a need-to-know basis, and confidentiality obligations binding on personnel and contractors. No transmission over the internet is entirely secure, so we ask that you do not send sensitive commercial or personal information by unencrypted email. Where a mandate requires it, MZA will agree a secure exchange mechanism with you.
8. Your rights
Subject to applicable law, you have the right to:
- request access to the personal data we hold about you;
- request correction of inaccurate or incomplete data;
- request erasure, where there is no overriding basis for us to retain it;
- request restriction of processing;
- object to processing carried out on the basis of legitimate interests;
- request portability of data you provided to us, where processing is based on consent or contract and is carried out by automated means;
- withdraw consent at any time, without affecting processing carried out before withdrawal.
Requests can be sent to info@mza-c.com. We respond within one month, and will tell you if we need to extend that period. We may ask for information to confirm your identity before acting on a request.
9. Complaints
If you consider that our processing infringes data protection law, you may lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (Bezuidenhoutseweg 30, 2594 AV The Hague). We would welcome the chance to address your concerns directly first.
10. Cookies
This site uses only essential cookies. The detail is set out in our Cookie Notice.
11. Changes to this notice
We review this notice periodically and will update it where our processing changes. The date at the top records the current version. Material changes affecting how we use your data will be notified directly where we hold contact details for you.