🔒 Legal notice and privacy policy
Version 1.0
Draft text to be validated by the data controller before going live. Items in [brackets] are to be completed.
1. Data controller
Plan International Niger, READ project (project owner, responsible for data processing). Contact: [address and e-mail of the data protection contact to be completed].
2. Purposes
- Planning, reporting and validation of activities of supported organisations.
- Production of aggregated statistics and reports for the project and the donor.
- Security and traceability of operations (audit log).
3. Data processed
- User accounts: name, username, e-mail, phone, role, language, login dates.
- Organisations: name, type, commune, focal point contact details.
- Beneficiaries: aggregated counts only (sex, age group, status, declared disability). No name, date of birth or individual identifier of a beneficiary is collected; no health data.
- Technical logs: IP address, date and nature of operations.
4. Retention
| Category | Duration (days) |
|---|---|
| messages | 3904 |
| needs | 3904 |
| good_practices | 3904 |
| report_exports | 3904 |
| audit_logs | 3904 |
| login_attempts | 3904 |
Default: project duration (22/07/2022 to 30/03/2028) plus 5 years of archiving. Data is then purged according to a documented, logged procedure.
5. Your rights
In accordance with Niger Law No. 2017-28 of 3 May 2017 on personal data protection and the principles of the GDPR, you have the right to access, rectify, object to and request erasure of your data by contacting the data controller. You may lodge a complaint with the HAPDP (Haute Autorité de Protection des Données à caractère Personnel).
6. Hosting and security
Hosting: [to be specified]. Encrypted exchanges (TLS), hashed passwords, attachments accessible only via time-limited signed links, daily backups on separate storage.