Privacy Policy

1. About This Policy

This Privacy Policy explains how The Civic Chapter (“we”, “us”, “our”) collects, uses, stores, shares and protects personal data when you use the Civic Chapter Volunteer Portal (the “Platform”), accessible at volunteer.thecivicchapter.org.

We are committed to protecting your privacy and to processing your personal data in full compliance with the Data Protection Act, 2024 of Botswana (the “Act”). By using the Platform, and by providing your explicit consent at registration, you acknowledge this Policy.

Please read this Policy carefully. If you do not agree with any part of it, or if you do not consent to your data being processed in the manner described, you may not be able to use the Platform. You will be asked to provide explicit consent during registration and during your first login after this Policy takes effect.

2. Who Controls Your Data

The data controller responsible for personal data processed through the Platform is:

For any data protection enquiries, rights requests, or complaints, please contact us at the email address above, clearly stating “DATA PROTECTION” in the subject line. We will respond within 30 days.

Under section 12(1)(c) of the Act, we are required to notify the Information and Data Protection Commission before carrying out automated processing operations. The Civic Chapter has submitted the required notification to the Commission in respect of the processing activities described in this Policy.

3. What We Collect and Why

3.1 Volunteer Accounts

When you register as a volunteer and use the Platform, we collect:

• Identity data: full name, email address, phone number.
• Profile data: biography, city/location, skills, causes of interest, availability.
• Account data: role, account creation and update timestamps, notification preferences.
• Activity data: activities you sign up for, attendance records, hours volunteered, badges earned.
• Communication data: support tickets you submit, notifications you receive.
• Technical data: authentication metadata (email, encrypted password hash, session tokens), browser storage flags (session management).

3.2 Organisation Accounts

When you register an organisation, we collect:

• Organisation profile data: organisation name, description/bio, category, city, website, contact email, phone number, logo.
• Verification (KYC) data: certificate of registration/incorporation, representative identity document (national ID card or passport), proof of address (utility bill or bank statement). These documents are classified as sensitive personal data under the Act.
• Activity data: activities created, published, and managed through the Platform.
• Account data: KYC status, verification status, rejection reasons (if any), audit log entries.
• Communication data: support tickets, admin correspondence.

3.3 Data We Do Not Collect

We do not collect racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual life information, genetic data, or biometric data for recognition purposes beyond what is contained in submitted KYC identity documents, which are used solely for identity verification.

3.4 Automatically Collected Data

When you use the Platform, our infrastructure providers (Vercel, Supabase, and Cloudflare) automatically collect certain technical data including IP addresses, request logs, browser/device type, and usage patterns. This data is used for security, performance, and error monitoring. Vercel Analytics may collect anonymised page view and performance data. Cloudflare processes connection metadata (IP address, browser fingerprint, and behavioural signals) to provide bot and spam protection via its Turnstile service.

We do not use advertising trackers, third-party marketing pixels, or social media tracking technologies on the Platform.

4. Our Legal Bases for Processing

Under the Act (section 26), personal data may be processed where one or more of the following criteria are met. We rely on the following bases:

5. How and With Whom We Share Data

5.1 With Other Users of the Platform

• Volunteers and organisations: When a volunteer signs up for an activity, the volunteer's name and profile information may be visible to the organisation running that activity through the attendance sheet feature. Organisations do not receive your email address, phone number, or any document you have not directly submitted to them.
• Public activity listings: Activity details created by organisations are publicly visible to all registered volunteers on the Service Hub. No personal data of individual volunteers is publicly displayed.
• Civic Resume: A volunteer's participation history, earned badges, and hours are visible within their own account. This information is not shared externally or publicly without your action.

5.2 With Our Infrastructure Providers (Data Processors)

We use the following third-party services to operate the Platform. These services act as data processors on our behalf and are bound by data processing agreements:

Each of these providers acts as a data processor on our behalf and is subject to appropriate contractual and legal data protection obligations.

5.3 With Administrators

Authorised administrators of The Civic Chapter may access personal data, KYC documents, activity records, attendance logs, and support tickets for the purposes of platform moderation, verification, and compliance. All administrators are bound by confidentiality obligations.

5.4 Legal Disclosure

We may disclose personal data where required by Botswana law, by order of a competent court, or upon lawful request by the Information and Data Protection Commission in accordance with the Act.

5.5 Business Transfers

In the event of a merger, acquisition, or transfer of the Platform, personal data may be transferred to the successor entity. We will notify users and provide the opportunity to revoke consent prior to any such transfer.

6. International Data Transfers

The Platform is operated using cloud infrastructure located outside Botswana. Under the DPA 2024, international transfers of personal data are governed by Part XIV (sections 74 to 78). Transfers are freely permitted to countries that Botswana's Minister has designated as offering adequate protection. All other transfers require either prior authorisation from the Commission or a statutory derogation.

Our primary database is hosted in Germany (EU), which appears on Botswana's approved-countries list and therefore requires no further authorisation. Our application host (Vercel, Inc.) and bot-protection provider (Cloudflare, Inc.) are based in the United States, which is not on the approved list. We rely on the derogation in section 78(a) of the Act: you have given explicit, informed consent to this transfer at registration. We also rely on section 78(b): the transfer is necessary for the performance of the contract between you and The Civic Chapter. Without these US-based services the Platform cannot operate.

Countries Involved

You have the right to withdraw your consent to international transfer at any time by contacting us. If you withdraw consent and it is not possible to maintain your account on infrastructure located exclusively within Botswana, we will be unable to continue providing the service and your account will be scheduled for deletion, with a 30-day notice period.

7. Cookies and Local Storage

The Platform uses the following browser storage technologies:

We do not use advertising cookies, third-party tracking cookies, or social media cookies.

7.1 Usage Analytics

We use Vercel Analytics, provided by Vercel, Inc. (United States), to understand how visitors interact with the Platform. Vercel Analytics operates in privacy-preserving mode:

• It does not use cookies or store any personally identifiable information.
• It collects aggregated page view data, Web Vitals performance metrics, and general geographic region (country/region level) derived from your IP address at the time of the request.
• IP addresses are not stored, only the derived geographic region is retained.
• Analytics data is processed on Vercel infrastructure in the United States and is covered by the international transfer consent you provided at registration.
• Aggregated analytics data is automatically deleted after 90 days.
• We do not combine analytics data with your personal profile or share it with any third party.

Because Vercel Analytics does not use cookies or persistent identifiers, no separate cookie consent is required for this tool. If you wish to limit analytics collection, you may use browser privacy settings or a privacy-focused browser extension. This will not affect your access to the Platform.

8. Retention and Deletion

After the applicable retention period, personal data is securely deleted from active databases and storage. Backups containing personal data are subject to the same deletion schedule on a rolling basis.

You may request deletion of your account and associated personal data at any time via the Settings page or by emailing us. We will process deletion requests within 30 days.

9. Security

We implement appropriate technical and organisational security measures in accordance with section 62 of the Act, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using HTTPS/TLS 1.2+.
• Encryption at rest: Database storage and file storage are encrypted at rest by Supabase (AWS-level AES-256 encryption).
• Row-Level Security (RLS): Database access is controlled at the row level, users can only access their own data; organisations can only access data relating to their activities.
• Authenticated API routes: All sensitive operations require a valid authenticated session. Server-side API routes verify user identity and ownership before processing any data.
• Access controls: Admin access is role-gated. Only designated administrators may access the admin panel and user management functions.
• File access controls: KYC documents and uploaded files are stored in access-controlled storage buckets, not publicly accessible URLs.
• Password security: Passwords are never stored in plaintext. Supabase uses bcrypt hashing for password storage.
• Session management: Sessions expire automatically. The “Remember me” feature extends sessions up to 7 days only when explicitly selected.

Despite our measures, no internet-based service can guarantee absolute security. In the event of a personal data breach, we will notify the Information and Data Protection Commission within 72 hours of becoming aware (section 63 of the Act) and communicate to affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms (section 64 of the Act).

10. Automated Decision-Making

The Platform uses automated processing for the following purposes:

• Badge awards: Badges are automatically awarded based on participation thresholds (e.g., number of activities completed, hours volunteered). This does not constitute a decision that significantly affects your legal rights or produces legal effects.
• Cron-based reminders: Automated notifications are sent for KYC deadline enforcement and activity reminders. These are administrative in nature.
• Spot availability management: Activity spot counts are automatically maintained. If an activity is full, you are automatically placed on a waitlist.

No fully automated decisions that produce legal effects or significantly affect individuals are made without human review. KYC approval/rejection decisions are made by human administrators, not automated systems.

11. Your Rights

Under the Botswana Data Protection Act, 2024, you have the following rights as a data subject:

All rights requests are free of charge and will be answered within 30 days of receipt. We may request verification of your identity before processing a request.

If you are unsatisfied with our response, you have the right to submit a complaint to the Information and Data Protection Commission of Botswana.

12. Minors

The Platform is not intended for use by persons under the age of 18 without verified parental or guardian consent. Age restrictions on specific activities are set by the organising organisations and are displayed on each activity listing. We do not knowingly collect personal data from minors without appropriate safeguards.

Please note that under the Act, data of minors is classified as sensitive personal data and is subject to enhanced protection requirements.

13. Electronic Communications (ECTA)

Electronic marketing communications are separately governed by the Electronic Communications and Transactions Act (ECTA), Act No. 14 of 2014, in addition to the DPA 2024.

We send the following categories of email to registered users:

Under ECTA, every platform notification email includes an unsubscribe or “Manage Preferences” link. You may withdraw consent to platform notifications at any time by clicking that link or by visiting Settings › Notification Preferences in your account. Withdrawing consent to notifications will not affect your ability to use the Platform, but you may miss time-sensitive activity updates.

Transactional and security emails cannot be opted out of while your account is active, as they are necessary for the safe operation of the service.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our platform, or our data practices. Material changes (including changes to data categories, processing purposes, or international transfer arrangements) will be communicated to you via email and/or an in-platform notification, and you will be asked to review and re-consent where required by law.

Minor, non-material changes may be published with an updated “Last Reviewed” date without individual notification. The current version of this Policy is always accessible at volunteer.thecivicchapter.org/legal/privacy-policy.

Continued use of the Platform after a material change takes effect constitutes acceptance of the revised Policy, subject to any re-consent requirements.

15. Contact Us

For all data protection enquiries, rights requests, or complaints, please contact:

You may also reach us at our general inbox: thecivicchapter@gmail.com

You also have the right to lodge a complaint directly with the Information and Data Protection Commission of Botswana if you believe your rights under the Data Protection Act, 2024 have been violated.

16. Version History