Your Privacy Matters

1. Introduction & Responsible Party

African Research Society ("ARS", "we", "us", or "our") is committed to protecting your personal information and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, services, and website.

ARS is the responsible party for the processing of your personal information in terms of the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPI Act") of South Africa.

Information Officer:
Waheed Amanjee
Chief Operating Officer
Email: coo@africanresearchsociety.org

By accessing or using our platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our policies and practices, please do not use our services.

2. What Personal Information We Collect

3. Purpose of Collection (POPI Principle: Purpose Specification)

We collect and process your personal information for the following specified purposes:

• Waitlist Management: To manage waitlist registrations and send launch notifications
• Account Creation: To create and manage your user account and provide platform access
• Chapter Membership: To facilitate chapter applications, memberships, and administration
• Event Management: To process event RSVPs, send event notifications, and manage attendance
• Resource Access: To provide access to downloadable resources and track usage
• Communication: To send you updates about ARS programs, events, opportunities, and platform features
• Platform Improvement: To analyze usage patterns, improve our services, and enhance user experience
• Legal Compliance: To comply with legal obligations, resolve disputes, and enforce our agreements
• Community Building: To facilitate networking, collaboration, and connections within the research community
• Research and Analytics: To conduct anonymized research and generate insights (where data is aggregated and anonymized)

4. How We Use Your Information (POPI Principle: Processing Limitation)

We use your personal information only for the purposes specified in Section 3 above. Specifically:

• We process your information only for legitimate, specified purposes
• We do not sell, rent, or trade your personal information to third parties for commercial purposes
• We use your information internally to operate and improve our platform
• We communicate with you about your account, events, and ARS-related matters
• We administer events, programs, and chapter activities
• We conduct research and analytics using anonymized and aggregated data where possible
• We ensure that processing is adequate, relevant, and not excessive in relation to the purpose

5. Sharing and Disclosure

We may share your personal information in the following circumstances:

We do not sell, rent, or trade your personal information to third parties for commercial purposes without your explicit consent.

6. Data Security (POPI Principle: Security Safeguards)

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our security measures include:

• Encryption: Data is encrypted in transit using HTTPS/TLS protocols and encrypted at rest in our databases
• Secure Authentication: We use Supabase Auth for secure user authentication and password management
• Access Controls: We implement role-based access controls and limit access to personal information to authorized personnel only
• Regular Security Audits: We conduct regular security assessments and vulnerability testing
• Staff Training: Our team is trained on data protection best practices and POPI Act compliance
• Incident Response: We have procedures in place to detect, respond to, and mitigate security incidents
• Data Backup: Regular backups are performed to prevent data loss

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining the highest standards of data protection.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Accounts: We retain your information while your account is active and you are using our services
• Inactive Accounts: If your account is inactive for 3 years, we will anonymize or delete your personal information, subject to legal requirements
• Legal Requirements: We may retain certain information longer if required by law, regulation, or to resolve disputes
• Deletion Requests: We will process requests for deletion within 30 days, subject to legal obligations
• Backup Data: Information in backups may be retained according to our backup retention policy, but will not be actively used

8. Your Rights Under POPI Act (POPI Principle: Data Subject Participation)

Under the POPI Act, you have the following rights regarding your personal information:

• Right to Access: You may request a copy of the personal information we hold about you
• Right to Correction: You may request that we correct or update inaccurate or incomplete information
• Right to Deletion: You may request that we delete your personal information, subject to our legal obligations to retain certain data
• Right to Object: You may object to the processing of your information for direct marketing purposes
• Right to Restrict Processing: You may request that we limit how we process your information in certain circumstances
• Right to Data Portability: You may request to receive your personal information in a structured, commonly used format
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Information Regulator of South Africa if you believe we have violated your privacy rights

To exercise any of these rights, please contact our Information Officer at coo@africanresearchsociety.org. We will respond to your request within 30 days.

9. Cross-Border Data Transfers

Our service providers, including Supabase and Vercel, may store and process your personal information on servers located outside of South Africa. When we transfer your information across borders, we ensure that:

• Appropriate safeguards are in place, including contractual clauses and data processing agreements
• Service providers are bound by data protection obligations equivalent to those under the POPI Act
• We obtain your consent to such transfers where required
• We comply with notification requirements to the Information Regulator where applicable

By using our platform, you consent to the transfer of your information to countries outside South Africa for the purposes described in this Privacy Policy.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform. Types of cookies we use include:

• Essential Cookies: Required for authentication, security, and basic platform functionality. These cookies cannot be disabled as they are necessary for the platform to function.
• Analytics Cookies: Used to understand how visitors interact with our platform (used only with your consent). These help us improve our services and user experience.
• Preference Cookies: Remember your settings and preferences to provide a personalized experience.
• Third-Party Cookies: Used by third-party services such as Google services and analytics providers (with your consent).

11. Children's Privacy

Our platform is intended for users who are 18 years of age or older. If you are under 18, you may use our platform only with the consent and supervision of a parent or guardian.

We do not knowingly collect personal information from children under the age of 13. If we become aware that we have collected information from a child under 13 without parental consent, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at coo@africanresearchsociety.org.

12. Third-Party Services

Our platform integrates with third-party services that may collect or process your information. We share information with these services only as necessary to provide our platform functionality:

We encourage you to review the privacy policies of these third-party services to understand how they handle your information. We are not responsible for the privacy practices of third-party services.

13. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification to registered users for material changes
• Displaying a notice on our platform

Your continued use of our platform after such changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

15. Complaints Procedure

If you believe we have violated your privacy rights or failed to comply with the POPI Act, you have the right to lodge a complaint: