Privacy Policy - AFAP Partnership

Data Privacy, Protection and Confidentiality Policy

Organisation-wide policy for responsible collection, use, storage, sharing and protection of personal, sensitive and confidential information.

Policy statement

AFAP is committed to protecting the privacy, dignity and confidentiality of employees, farmers, beneficiaries, agrodealers, partners and other stakeholders whose information it processes. Personal data must be handled lawfully, fairly, transparently and securely throughout its lifecycle.

1. Purpose and policy objectives

This Policy establishes AFAP’s organisation-wide framework for collecting, creating, accessing, recording, using, analysing, storing, transferring, sharing, publishing, retaining and securely disposing of personal, sensitive and confidential information. It updates and strengthens AFAP’s existing approach to data governance across programme, finance, human resources, communications, research and corporate systems.

Protect the rights, dignity, safety and reasonable privacy expectations of data subjects.

Support lawful and ethical programme implementation, monitoring, evaluation, learning, research and communications.

Reduce legal, operational, cybersecurity, safeguarding and reputational risks arising from misuse, loss or unauthorised disclosure of information.

Define clear accountability for data protection across AFAP offices, systems, projects and partnerships.

Provide practical rules for consent, media use, data sharing, international transfers, incident response, retention and secure disposal.

2. Scope

This Policy applies to all AFAP entities, country offices, projects, programmes and functions, and to all Board members, employees, consultants, contractors, interns, volunteers, implementing partners, service providers and other authorised persons who process information for or on behalf of AFAP. It applies to electronic and physical records and to information processed through AFAP systems, including programme and MEL platforms, Trade Credit Guarantee monitoring systems, Microsoft 365/OneDrive environments, financial and HR systems, websites, email, mobile data-collection tools and approved third-party platforms.

3. Definitions

4. Legal and regulatory framework

AFAP will comply with the data protection, privacy, cybersecurity, electronic communications, employment, safeguarding and records-management laws applicable in each jurisdiction where it operates or processes data. Where more than one legal regime applies, AFAP will identify the relevant obligations and apply the appropriate lawful standard. Contractual and donor requirements may supplement, but do not replace, applicable law.

General Data Protection Regulation (EU) 2016/679 (GDPR), where its territorial scope or contractual requirements apply.

African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), as a continental reference framework and where binding or otherwise applicable.

Applicable national legislation in AFAP countries of operation, including South Africa’s Protection of Personal Information Act (POPIA) and other country-specific privacy/data-protection laws.

Donor, funder and international-agency privacy, safeguarding, research and information-security requirements where incorporated into AFAP agreements.

Legal register

General Data Protection Regulation (EU) 2016/679 (GDPR), where its territorial scope or contractual requirements apply.

African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), as a continental reference framework and where binding or otherwise applicable.

Applicable national legislation in AFAP countries of operation, including South Africa’s Protection of Personal Information Act (POPIA) and other country-specific privacy/data-protection laws.

Donor, funder and international-agency privacy, safeguarding, research and information-security requirements where incorporated into AFAP agreements.

5. Governance, accountability and responsibilities

6. Data protection principles

Lawfulness, fairness and transparency: Process data on a valid legal basis, fairly and in a way data subjects can reasonably understand.

Purpose limitation: Collect data for specific, explicit and legitimate purposes and do not use it incompatibly without an appropriate basis.

Data minimisation: Collect only what is adequate, relevant and necessary.

Accuracy: Take reasonable steps to keep information accurate and correct or delete inaccurate information without undue delay.

Storage limitation: Retain identifiable data only for as long as justified by legal, contractual, programme, audit or operational requirements.

Integrity and confidentiality: Protect information against unauthorised or unlawful processing and accidental loss, destruction or damage.

Accountability and privacy by design: Build privacy controls into projects, systems, tools, procurement and communications from the outset and maintain evidence of compliance.

7. Lawful basis, notice and consent

Before collecting personal data, AFAP must identify and document an appropriate lawful basis under the applicable law. Consent is one possible basis, but it is not the only basis. Depending on the context, processing may also be necessary for a contract, legal obligation, legitimate organisational interests, vital interests, public-interest functions or another lawful basis recognised by local law.

Privacy information must be provided in clear and accessible language before or at the point of collection, including the purpose, intended uses, recipients, retention approach and available rights where required.

Where consent is relied upon, it must be informed, specific, freely given and capable of being evidenced. Individuals must be able to withdraw consent for future processing where the law provides that right.

AFAP must take particular care where a power imbalance exists, including employees, beneficiaries and programme participants, so that consent is not presented as a condition for receiving assistance unless genuinely necessary for the service.

For children or persons requiring additional protection, consent and safeguarding procedures must follow applicable law and AFAP safeguarding requirements.

8. Categories of information AFAP may process

Depending on the relationship, programme and lawful purpose, AFAP may process the following categories:

Contact and identity information, including name, email, telephone number, address, age, sex/gender, occupation, education and other identifiers necessary for the activity.

Programme and monitoring information relating to participation in projects, training, surveys, demonstrations, assessments, market-development activities and impact measurement.

Business and organisational information relating to agrodealers, suppliers, SMEs, partners and institutions.

Financial and credit-related information necessary for programmes such as trade-credit guarantees, including business performance, credit exposure, payment information and relevant financial records.

Employment, consultant and HR information required for workforce administration.

Photographs, video, audio, quotations, testimonials, case studies and event participation information used for documentation, reporting or communications where an appropriate basis exists.

Technical and website information such as account identifiers, audit logs, device or browser information and cookies where applicable.

9. Data collection and processing controls

AFAP data-collection tools and workflows must be designed to capture only the information required for the stated purpose. Project teams must identify data sources, collection methods, responsible custodians, storage locations, access groups, sharing requirements and retention expectations before large-scale or sensitive collection begins.

Use approved data-collection tools, systems and templates.

Include privacy notices or confidentiality messages on relevant forms and tools.

Avoid collecting sensitive data merely because it may be useful later.

Validate data quality and correct material inaccuracies.

Where feasible, separate direct identifiers from analytical datasets and use aggregation, pseudonymisation or anonymisation.

Undertake a privacy/data-protection impact assessment before processing likely to create high risk to individuals, including new technologies, systematic monitoring, large-scale sensitive data or extensive profiling, where required or appropriate.

10. Programme systems, accounts and access management

Access to AFAP systems and records is granted on a least-privilege, need-to-know basis. Users must receive individual credentials and may access only the data and functions necessary for their authorised responsibilities.

Password or credential sharing is prohibited and may result in disciplinary action.

Multi-factor authentication should be enabled on systems that support it, particularly for administrative, financial, HR and cloud accounts.

Access rights must be reviewed periodically and promptly removed or changed when a user changes role, leaves AFAP or no longer requires access.

Temporary external access must be time-limited, approved and restricted to the minimum information required.

Raw-data downloads and exports must be restricted, logged where feasible and stored only in approved locations.

System architecture, schemas, source code, security configurations and administrative credentials are confidential and are not disclosed unless authorised for a legitimate purpose.

11. Records and physical information

AFAP holds records in electronic and physical formats. Access to records must be legitimate, authorised and connected to the user’s duties. Physical files containing personal or confidential information must be stored securely, protected from casual viewing and removed from open work areas when not in use. Records must be disposed of securely when their approved retention period expires.

12. Secure communication, sharing and disclosure

Information may be shared internally or externally only where there is a legitimate purpose, appropriate authority and a secure method of transfer. Before disclosure, teams must consider whether the recipient needs identifiable data or whether aggregated, anonymised or pseudonymised information will meet the purpose.

Use AFAP-approved collaboration and file-transfer channels. Avoid personal email, unapproved cloud storage and consumer messaging services for sensitive datasets unless specifically approved and protected.

Encrypt sensitive or identifiable information in transit and at rest where appropriate to the risk and supported by the system.

Apply password protection, restricted links, expiry dates and recipient controls where available.

Use NDAs, data-sharing agreements, data-processing agreements or contractual privacy clauses where the nature of the relationship requires them.

Before sharing with donors or partners, confirm the agreed reporting purpose and remove unnecessary personal or precise location identifiers.

13. Photographs, video, names, quotations and storytelling

AFAP communications must protect the dignity, safety and agency of the people represented. Identifiable photographs, video, audio, quotations, names and personal stories may constitute personal data and must be collected and used under an appropriate lawful basis and in accordance with applicable consent and safeguarding requirements.

Where individuals are clearly identifiable and are principal subjects of a photograph, interview, testimonial or case study, AFAP should obtain and retain appropriate documented permission or consent where required or reasonably practicable.

Explain the intended use in accessible language, including possible use on websites, social media, reports, donor materials, presentations, print publications and media channels.

Participation in photography or storytelling should not ordinarily be a condition of receiving programme support.

For children and vulnerable persons, apply enhanced consent, safeguarding and risk assessment, including parent/guardian authorisation where required.

Avoid publishing unnecessary personal contact details, identity numbers, precise home locations, financial details or other information that could expose a person to harm.

Where appropriate, use first names only, pseudonyms, non-identifying images or aggregated stories to reduce risk.

Opt-out and removal requests

A person who appears in AFAP-controlled communications may request review, correction, anonymisation or removal of their name, image, video, quotation or personal story. AFAP will assess and respond promptly and, where appropriate and technically possible, amend or remove the material from platforms under its control. Withdrawal or removal does not necessarily affect processing already lawfully completed, printed materials already distributed, or independent copies held by third parties.

14. Data subject rights and requests

AFAP will facilitate data-subject rights available under applicable law. Depending on the jurisdiction and circumstances, these may include rights to be informed, access personal data, request correction, request deletion or restriction, object to certain processing, withdraw consent, request data portability, challenge certain automated decisions and complain to a competent regulator.

Requests must be forwarded promptly to the designated privacy lead / Corporate Services and identity should be verified proportionately before disclosing personal data.

AFAP must keep an auditable record of requests, decisions, actions and statutory response deadlines.

No person should be disadvantaged for making a legitimate privacy request or declining optional communications consent.

15. International and cross-border data transfers

Because AFAP operates across multiple countries and uses regional and cloud-based systems, personal data may be accessed or transferred across borders. Cross-border transfers must comply with applicable national law and any donor or contractual requirements. AFAP must assess the destination, recipient, purpose, security controls and required transfer mechanism before transferring personal or sensitive information internationally.

Use approved contractual safeguards or data-transfer agreements where required.

Limit transfers to the minimum data necessary and apply encryption, access controls and pseudonymisation where appropriate.

Confirm where cloud service providers store or process information where this is material to legal compliance or risk.

16. Retention, archiving and secure disposal

AFAP will maintain a records-retention schedule covering major categories of programme, financial, HR, contractual, governance, research, communications and system data. Retention periods must reflect applicable law, donor and contractual obligations, audit requirements, legitimate organisational needs and the risks of retaining identifiable information longer than necessary.

At the end of the retention period, information must be securely deleted, destroyed, anonymised or transferred to an authorised archive.

Legal holds, investigations, audits or disputes may require temporary suspension of normal deletion.

Physical records must be shredded or destroyed securely; electronic data must be deleted using methods appropriate to the system and media.

17. Information security and controlled access to offices

AFAP applies proportionate technical, organisational and physical safeguards to protect information. Controls should reflect the sensitivity, volume and risk of the information and the nature of the system or facility.

Restricted entry to offices, records rooms, server/network areas and other secure zones based on authorised need.

Visitor sign-in, staff escort and visitor identification where appropriate.

Electronic access cards, access codes or other controls where feasible; biometric access only where lawful, necessary and proportionate.

CCTV or other monitoring only where lawful, transparently notified and access to recordings is restricted.

Secure cabinets and clean-desk practices for sensitive physical records.

Endpoint protection, software updates, backups, logging, encryption, MFA and secure configuration for relevant information systems.

Emergency access procedures that preserve safety while maintaining accountability and security.

18. Personal data breaches and security incidents

All suspected or confirmed loss, unauthorised disclosure, misdirected email, stolen device, compromised account, malware incident, improper access or other security compromise involving AFAP information must be reported immediately through AFAP’s incident escalation channel to the relevant supervisor, IT/security function, Corporate Services and designated privacy lead.

Do not conceal, independently investigate beyond your authority, delete evidence or contact affected persons or regulators without coordination.

AFAP will contain the incident, preserve evidence, assess affected data and individuals, document the event, determine notification obligations and implement corrective actions.

Where applicable law requires notification to a regulator, data subjects, donor or partner, AFAP will do so within the required timeframe and through the responsible authorised function.

Minimum incident record

Date/time discovered; reporter; systems and data affected; categories and approximate number of people affected; likely consequences; containment measures; notifications made; root cause; corrective actions; closure approval.

19. Third parties, procurement and partners

Before engaging a service provider or partner that will process personal or confidential information, AFAP must conduct proportionate due diligence on privacy and security risks and include appropriate contractual protections. Agreements should address authorised purpose, confidentiality, security measures, sub-processors, breach notification, retention/deletion, audit or assurance rights, cross-border transfers and return or destruction of information at the end of the engagement.

20. Confidentiality and acceptable use

Unauthorised access to files, deliberate misuse of data, credential sharing, disclosure to unauthorised persons, or use of AFAP information for personal advantage is prohibited. Staff concerns or grievances must be raised through appropriate AFAP channels and must not be used as a justification for disclosing confidential or personal information externally.

21. Training and awareness

AFAP personnel with access to personal or confidential information must receive appropriate privacy, confidentiality and information-security awareness. Additional role-based training should be provided to staff handling HR, finance, credit, MEL, research, communications, IT administration, safeguarding and high-risk datasets. Refresher training should be provided periodically and following material policy or system changes.

22. Monitoring, assurance and compliance

Corporate Services, Legal & Compliance, MEL/ESRM, country management and relevant system owners will monitor implementation through periodic access reviews, compliance checks, incident analysis, data-quality reviews, partner due diligence and, where appropriate, internal or external audits. Material weaknesses must have documented corrective actions and responsible owners.

Failure to comply with this Policy may result in withdrawal of system access, disciplinary action, termination of contracts or partnerships, recovery of losses, reporting to regulators or law-enforcement authorities, or other action permitted by applicable law and AFAP procedures.

23. Exceptions

Any exception to this Policy must be justified, documented, risk-assessed, time-limited and approved by the appropriate authorised AFAP function. No exception may override a mandatory legal requirement.

24. Policy review and approval

This Policy should be reviewed at least every two years, and earlier where there is a material change in law, AFAP operations, technology, systems, donor requirements or risk exposure. Country-specific procedures or annexes may supplement this Policy where necessary, provided they do not weaken the minimum standards established here.

Annex A — Minimum privacy notice / consent information

Where AFAP collects personal information directly, the collection tool or accompanying notice should, as appropriate, explain:

Who AFAP is and how to contact the responsible office or privacy lead.

What information is being collected and whether any fields are optional.

Why the information is needed and the lawful basis relied upon.

Who may receive or access the information, including donors, partners or service providers where relevant.

Whether the information may be transferred internationally or processed in cloud systems.

How long the information is expected to be retained or how retention is determined.

The individual’s applicable privacy rights and how to exercise them.

For media/storytelling consent, the types of channels and materials in which names, images, video, audio or quotations may appear.

How to withdraw consent or request future non-use where consent is the applicable basis.

Annex B — Media and storytelling opt-out process

Requests concerning photographs, video, names, quotations or personal stories should be sent to AFAP through the published contact channel or relevant country office. AFAP should record the request, verify the material and requester where appropriate, assess legal/contractual considerations, and implement an appropriate action on AFAP-controlled platforms. Communications teams should maintain a suppression or do-not-use record where necessary to prevent future republication of withdrawn material.