1. Who is responsible for the processing

The person responsible for processing the data is Projecto Caridade, with the contact details indicated in the footer of this website.

For any questions about privacy or to exercise your rights, write to info@caridade.ao or use the rights form.

We process data in accordance with Law No. 22/11, of 17 June (Personal Data Protection Law of Angola) and, when applicable, with the General Data Protection Regulation of the European Union (Regulation (EU) 2016/679).

2. What data do we collect

• Volunteer registration: name, email, country, telephone, area of ​​interest and message.
• Beneficiary registration: name, date of birth, document number, country, telephone, email, address, number of adults and children in the household, description of the situation and types of support needed.
• Contact: name, email, country, telephone, subject and message.
• Newsletter: email.
• Account on the portal or app: name, email, desired and assigned profile, account status, password (only stored in an irreversible encrypted form), date of last access and active sessions.
• Support requests (beneficiaries with account): subject, description and status.
• Team operational records: campaigns, stock, deliveries of goods, referrals, prevention actions, needs and donations, which may contain names and contact details.
• Usage statistics, only if you accept statistical cookies (see section 6).

3. What we use the data for and on what basis

We do not use your data for advertising, we do not sell it and we do not make automated decisions that affect you.

• Evaluate requests and provide support to beneficiaries — with their explicit consent.
• Manage applications and the collaboration of volunteers and professionals — with your consent and to follow up on your request.
• Respond to messages and requests for information — legitimate interest in responding and consent.
• Send the newsletter — with your consent, which you can withdraw at any time.
• Manage accounts, authentication and portal security — necessary to provide the service you requested and legitimate interest in security.
• Organize internal activity and report on the support provided — legitimate interest of a non-profit organization, with guarantees of confidentiality.
• Comply with legal obligations, including responding to requests to exercise rights.

4. Sensitive data

The description of the social situation and health needs of beneficiaries are sensitive data. We only process them with your express and separate consent, only to evaluate and provide support, and only coordination people with a need to know them have access to them.

We ask that you do not include diagnoses, exams or clinical documents on the forms. You can withdraw consent at any time, without affecting the processing already carried out.

5. Accounts, access and security

Access to data is only through our servers and is limited by each person's profile (administration, coordination, volunteer, professional or beneficiary). Passwords are stored with irreversible encryption, sessions can be revoked and there are limits against abusive attempts.

We don't send recovery emails: if you lose access, an administrator will deliver a single-use access code to you via a secure channel.

We use encrypted connections (HTTPS) and infrastructure with data encryption at rest.

6. Cookies and statistics

We only use the cookies and local storage necessary for the website to function (language, portal session and recording your choice of cookies).

Only with your consent do we use Google Analytics to measure, in aggregate form, how the site is used. You can accept, reject or change your choice at any time in “Cookie preferences” in the footer. Find out more at Cookie Policy.

7. Who we share the data with

• Members of the Projecto Caridade team, according to their profile and as necessary.
• Google Cloud / Firebase (Google), which provides hosting and database services on our behalf, under data processing agreements.
• Google Analytics (Google), only if you consent to statistical cookies.
• Public authorities, when the law requires it.

8. Where data and international transfers are located

The site is served from data centers in the European Union (Netherlands) and the database is hosted in Google data centers in South Africa. Google Analytics statistics, where authorized, may be processed in the United States.

These transfers are made with the contractual guarantees provided by Google (including standard contractual clauses) and, when required by applicable law, with the authorizations of the data protection authorities.

9. How long do we keep the data

• Contact messages: 24 months.
• Volunteer registration: 36 months.
• Newsletter: until you withdraw consent.
• Beneficiary registrations and support requests and delivery records: 60 months after the last support, after which they are anonymized.
• Accounts: while they are active; accounts without access for 24 months are reviewed and deleted.
• Requests to exercise rights: 36 months after response.
• Technical security sessions and records: automatically deleted in days or hours.

10. Your rights

You can exercise these rights in the rights form, by email to info@caridade.ao or, if you have an account, in “My account” (export the data or delete the account). We will respond within 30 days and may ask you to confirm your identity.

• Know what data we have about you and obtain a copy (access and portability).
• Correct incorrect or incomplete data (rectification).
• Request the deletion of your data (deletion).
• Request limitation of treatment or oppose it.
• Withdraw consent at any time.

11. Complaints

If you consider that your data has not been processed correctly, you can lodge a complaint with the Angolan Data Protection Agency (APD) or, if you reside in the European Union, with the data protection authority in your country. We appreciate you contacting us first so we can try to resolve the situation.

12. Minors

Accounts on the portal and app are intended for people aged 16 or over. Of the minors who are part of a household, we only record the number of children, without identifying them.

13. Changes to this policy

We may update this policy. The date and current version are shown at the top of this page; If the changes are material, we will ask for your consent again when necessary.