Privacy Policy

1. Introduction & Responsible Party

African Research Society ("ARS", "we", "us", or "our") is committed to protecting your personal information and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, services, and website.

ARS is the responsible party for the processing of your personal information in terms of the Protection of Personal Information Act, 2013 (Act No. 4 of 2013) ("POPI Act") of South Africa.

Information Officer:
Waheed Amanjee
Chief Operating Officer
Email: coo@africanresearchsociety.org

By accessing or using our platform, you acknowledge that you have read and understood this Privacy Policy. Reading it is not the same as consenting to everything in it: section 4 sets out which lawful basis we rely on for each kind of processing, and consent is only one of them.

2. What Personal Information We Collect

3. Purpose of Collection (POPI Principle: Purpose Specification)

We collect and process your personal information for the following specified purposes:

• Account Creation: To create and manage your user account and provide platform access
• Membership: To assess membership applications and fee-waiver requests, to activate and renew memberships, and to give members access to member-only areas
• Payments: To take, reconcile, receipt, refund, and account for membership dues, shop orders, and donations
• Orders and Delivery: To fulfil shop orders, arrange delivery, and keep you informed about your order
• Event Management: To process event registrations, issue tickets, send event notifications, and manage attendance
• Courses: To enrol you in courses and record your progress
• Communication: To send you service email about your account, membership, tickets, and orders, and — where you have subscribed — our newsletter and other updates
• Platform Improvement: To analyse usage patterns, improve our services, and enhance user experience
• Legal Compliance: To comply with legal obligations, including financial record-keeping, and to resolve disputes and enforce our agreements
• Community Building: To facilitate networking, collaboration, and connections within the research community
• Research and Analytics: To conduct anonymised research and generate insights (where data is aggregated and anonymised)

4. Lawful Basis for Processing

The POPI Act allows processing on several grounds, and consent is only one of them. Which ground applies matters to you, because your rights differ depending on it. In plain terms:

• To conclude or perform a contract with you: processing your membership application, taking and reconciling your dues, fulfilling and delivering shop orders, issuing event tickets, and enrolling you in courses. We cannot provide these things without this information, so this processing does not rest on consent and withdrawing consent would not stop it
• To comply with a legal obligation: keeping records of payments, orders, and donations for the periods South African law requires of a non-profit organisation
• Our legitimate interests, or those of a third party: keeping the platform secure, preventing fraud and abuse, and understanding how the platform is used so that we can improve it
• Your consent: our newsletter and other marketing email, the optional profile fields you choose to complete, and appearing in the public member directory

Where we rely on consent you may withdraw it at any time, and withdrawing it does not affect processing already carried out or processing that rests on another ground. Unsubscribing from our newsletter, for example, does not cancel your membership or stop the receipts and tickets you have asked us for.

5. How We Use Your Information (POPI Principle: Processing Limitation)

We use your personal information only for the purposes specified in section 3 above. Specifically:

• We process your information only for legitimate, specified purposes
• We do not sell, rent, or trade your personal information to third parties for commercial purposes
• We use your information internally to operate and improve our platform
• We communicate with you about your account, membership, tickets, orders, and other ARS-related matters
• We administer events, courses, and programmes
• We conduct research and analytics using anonymised and aggregated data where possible
• We ensure that processing is adequate, relevant, and not excessive in relation to the purpose

6. Sharing and Disclosure

We may share your personal information in the following circumstances:

We do not sell, rent, or trade your personal information to third parties for commercial purposes without your explicit consent.

7. Data Security (POPI Principle: Security Safeguards)

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. Our security measures include:

• Encryption: Data is encrypted in transit using HTTPS/TLS protocols and encrypted at rest in our databases
• Secure Authentication: We use Supabase Auth for secure user authentication and password management
• No Card Data: Card numbers are never transmitted to or stored on our systems; they are handled by Yoco (see section 2.2)
• Access Controls: Access to personal information is limited to the small number of people who need it to run the Society, and we review that access when roles change
• Incident Response: We have procedures in place to detect, respond to, and mitigate security incidents
• Data Backup: Regular backups are performed to prevent data loss

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to maintaining the highest standards of data protection.

8. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Active Accounts: We retain your information while your account is active and you are using our services
• Inactive Accounts: If your account is inactive for 3 years, we will anonymise or delete your personal information, subject to legal requirements
• Payment, Order, and Donation Records: Financial records are retained for the period South African law requires, even if you close your account, because we are obliged to keep them
• Legal Requirements: We may retain certain information longer if required by law, regulation, or to resolve disputes
• Deletion Requests: We will process requests for deletion within 30 days, subject to legal obligations
• Backup Data: Information in backups may be retained according to our backup retention policy, but will not be actively used

9. Your Rights Under POPI Act (POPI Principle: Data Subject Participation)

Under the POPI Act, you have the following rights regarding your personal information:

• Right to Access: You may request a copy of the personal information we hold about you
• Right to Correction: You may request that we correct or update inaccurate or incomplete information
• Right to Deletion: You may request that we delete your personal information, subject to our legal obligations to retain certain data
• Right to Object: You may object, on reasonable grounds, to the processing of your information — and at any time where it is processed for direct marketing purposes
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw your consent at any time (see section 4)
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Information Regulator of South Africa if you believe we have violated your privacy rights

To exercise any of these rights, please contact our Information Officer at coo@africanresearchsociety.org. We will respond to your request within 30 days.

10. Newsletter and Marketing Communications

We send two different kinds of email, and they work differently:

• Service email: account and sign-in messages, membership receipts and renewal reminders, event tickets, order and delivery updates, and donation confirmations. These relate to something you have asked for or bought, so they are not marketing and do not carry an unsubscribe link
• Newsletter and marketing email: ARS news, opportunities, and announcements. We send these only to people who have subscribed

Every newsletter includes an unsubscribe link, and the message also carries a List-Unsubscribe header so that your email client can offer its own opt-out. The link opens our unsubscribe page, where confirming removes your address from the mailing list — you do not need to sign in, and your account, membership, and orders are unaffected. You can also unsubscribe by emailing npo@africanresearchsociety.org with the subject "Unsubscribe", or by contacting our Information Officer at coo@africanresearchsociety.org.

Unsubscribing removes you from the marketing list held by our email provider, Resend, as well as from our own subscriber records. You will still receive service email for anything you hold or have bought.

11. Cross-Border Data Transfers

Some of our operators, including Supabase, Vercel, Resend, and Google, may store and process your personal information on servers located outside of South Africa. Yoco is a South African company, and card payments are processed under South African payment rules. When we transfer your information across borders, we ensure that:

• Appropriate safeguards are in place, including contractual clauses and data processing agreements
• Service providers are bound by data protection obligations equivalent to those under the POPI Act
• The transfer meets one of the grounds in section 72 of the POPI Act — usually that the recipient is subject to comparable protection by law or binding agreement, or that the transfer is necessary to perform a contract with you
• We comply with notification requirements to the Information Regulator where applicable

12. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform. Types of cookies we use include:

• Essential Cookies: Required for authentication, security, and basic platform functionality. These cookies cannot be disabled as they are necessary for the platform to function.
• Preference Cookies: Remember your settings and preferences to provide a personalised experience.

13. Children's Privacy

Our platform is intended for users who are 18 years of age or older. If you are under 18, you may use our platform only with the consent and supervision of a parent or guardian.

We do not knowingly collect personal information from children under the age of 13. If we become aware that we have collected information from a child under 13 without parental consent, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at coo@africanresearchsociety.org.

14. Third-Party Services

Our platform integrates with third-party services that may collect or process your information. We share information with these services only as necessary to provide our platform functionality:

We encourage you to review the privacy policies of these third-party services to understand how they handle your information. We are not responsible for the privacy practices of third-party services.

15. Changes to Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification to registered users for material changes
• Displaying a notice on our platform

Your continued use of our platform after such changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

16. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

17. Complaints Procedure

If you believe we have violated your privacy rights or failed to comply with the POPI Act, you have the right to lodge a complaint: