Privacy Policy

This policy explains how AlumUnion [Legal entity name to be inserted], operating the Alumni Portal platform ("we", "us"), handles personal data when a school, university, or other institution ("Institution") uses the Platform to run an alumni network, and when their alumni, students, or staff ("Members") use that network. It is written to meet Ghana's Data Protection Act, 2012 (Act 843), and applies to every Institution portal hosted on the Platform.

In most cases, the Institution decides why and how Members' data is collected — for example, which fields are required at registration, or which fundraisers are run — which makes the Institution the data controller for its own Members' records. We act as the data processor that stores and runs that data on the Institution's behalf, and we are separately the controller for platform-level records like billing and security logs. If you are unsure which applies to a specific piece of data, contact us and we will clarify.

From Members, when you register or use a portal:

• Identity and contact details — full name, email address, mobile number, graduation year, student ID, department;
• Profile details you choose to add — company, job title, location, LinkedIn URL, bio, profile photo;
• Location, only if you turn on the Alumni Map — the city/country you entered, nothing more precise;
• Activity data — event RSVPs, forum and class-note posts, job applications, mentorship requests, community memberships;
• Payment records — the amount, date, fundraiser or membership dues item, and status of a contribution or payment. We do not receive or store your card number, CVV, or mobile money PIN; those go directly to Paystack, our payment processor;
• Notification preferences — whether you've opted in to SMS alerts, and the number they're sent to;
• Technical data — IP address, browser/device type, and basic usage logs, collected automatically for security and to keep the service running.

From Institution staff: name, work email, and role, used to manage staff access to the admin console.

From guest payers: if you pay a fundraiser or membership dues item without an account, we collect the payment amount, reference, and — only if you choose to provide one — an email address to receive a receipt.

Under Act 843, we rely on the following legal bases:

• Performance of a contract — creating and running your account, showing your directory listing to fellow Members, processing a payment you initiate, sending you the account emails needed to operate the service (like password resets and payment receipts);
• Consent — showing your location on the Alumni Map, sending you SMS notifications, and any marketing communications. You can withdraw this consent at any time from your profile settings, and we stop that specific use going forward;
• Legitimate interest — keeping the Platform secure (fraud prevention, abuse detection), improving reliability, and maintaining audit logs of staff actions on an Institution's portal;
• Legal obligation — retaining payment and transaction records for the period required under Ghanaian financial and tax record-keeping rules.

We share personal data only where it is needed to run the Platform, and always under a contract that requires the recipient to protect it:

• Paystack — processes online payments; they receive what is needed to complete a transaction (amount, email, payment method details you enter directly with them);
• Arkesel — delivers SMS notifications when you have opted in; they receive your phone number and the message content, nothing more. (We also integrate with a WhatsApp provider for a future release — it is not active during the current pilot, and this policy will be updated before it is turned on.)
• Cloud hosting and storage providers (including DigitalOcean) — store the Platform's database and uploaded files (like profile photos and fundraiser banners) securely;
• Your own Institution's staff — the staff of the Institution whose portal you registered on can see the profile and activity data needed to run that portal (for example, to approve your membership or confirm a manual payment). Staff at one Institution cannot see another Institution's Members;
• Other Members — your directory listing, and anything you post in forums, class notes, or communities, is visible to fellow Members of the same Institution, per the visibility settings that feature offers;
• Law enforcement or regulators — only where we are legally required to disclose it.

We do not sell personal data, and we do not share it with third parties for their own marketing.

Platform data is hosted with cloud infrastructure providers that may process data outside Ghana. Where that happens, we rely on our processors' contractual security commitments and, where required by Act 843, appropriate safeguards for the transfer.

We keep Member account data for as long as the account is active on an Institution's portal. If an Institution deletes a Member's account, we delete the associated personal data within a reasonable period, except where we are required to retain payment or transaction records for longer under Ghanaian financial record-keeping obligations, or where data has already been anonymised or aggregated in a way that no longer identifies you (for example, in overall giving statistics).

Under the Data Protection Act, 2012 (Act 843), you have the right to:

• Know what personal data we hold about you and how it is used;
• Access a copy of your personal data;
• Correct inaccurate or incomplete data — most profile fields can be edited directly from your account;
• Object to, or ask us to stop, a specific processing activity (for example, withdrawing your Alumni Map or notification consent);
• Ask for your account and associated personal data to be deleted, subject to the retention exceptions described above;
• Lodge a complaint with Ghana's Data Protection Commission if you believe your data has been mishandled.

To exercise any of these rights, start with your Institution's alumni office if the request relates to your Member account, since they control that data day to day. For anything platform-level, or if your Institution is unresponsive, contact us directly at privacy@alumunion.com.

We use industry-standard measures to protect personal data, including encrypted connections (HTTPS), hashed passwords (we never store your password in readable form), role-based access so staff only see what their role requires, and tenant isolation so one Institution cannot access another's data. No system is completely immune to risk, and we will notify affected Institutions and, where required by law, the Data Protection Commission, in the event of a data breach likely to affect your rights.

We use strictly necessary cookies/local storage to keep you signed in and remember basic preferences (like your institution workspace during development). We do not currently use third-party advertising or tracking cookies.

The Platform is built for alumni, students, and staff of participating Institutions and is not intended for children under 18. If we learn that we have collected personal data from a child without appropriate consent, we will delete it.

We may update this policy as the Platform changes. Material changes will be reflected in the effective date above, and where practical we will let Institutions and Members know in advance.

For any question about this policy or how your data is handled, email privacy@alumunion.com.