Privacy Policy & Data Protection Statement

MacPhini Foundation is committed to respecting the privacy, dignity and rights of the people and communities with whom we engage.

This Privacy Policy & Data Protection Statement explains how personal information is collected, used, stored, shared and protected through the MacPhini Foundation website, programmes, applications, events, partnerships and related activities.

For purposes of this Policy, “MacPhini Foundation”, “we”, “us” and “our” refer to MacPhini Foundation, once incorporated, or the legal entity expressly identified as responsible for the relevant programme or processing activity.

The Foundation is committed to responsible data practices based on transparency, fairness, purpose limitation, data minimisation, appropriate security and respect for individual rights.

This Policy may apply to information relating to:

• website visitors;
• programme and scholarship applicants;
• beneficiaries;
• students;
• alumni;
• parents or guardians where applicable;
• referees;
• mentors;
• volunteers;
• event participants;
• donors and supporters;
• partners and institutional representatives;
• vendors and service providers;
• newsletter subscribers; and
• individuals otherwise engaging with the Foundation.

Certain programmes may involve additional privacy requirements. Where appropriate, a Programme Privacy Notice will be provided alongside this Policy.

The information collected depends on the nature of an individual's relationship with the Foundation.

A. Identity and Contact Information

This may include:

• full name;
• email address;
• telephone number;
• state, province or country;
• State of Origin or State of Residence where relevant to programme reporting;
• organisation or institution;
• professional role; and
• other appropriate contact information.

B. Programme and Application Information

For scholarships, grants, educational initiatives and other programmes, this may include:

• student or applicant identification information;
• institution, department, course or programme;
• matriculation or student number;
• academic level;
• academic results or records;
• qualifications;
• application responses;
• personal statements;
• professional or extracurricular activities;
• references;
• supporting documents;
• programme eligibility information; and
• application and selection status.

C. Financial-Need and Socioeconomic Information

Certain programmes may require applicants to explain financial circumstances or barriers affecting their education or participation.

This may include:

• sources of educational support;
• scholarship or bursary information;
• financial-need narratives; and
• other information reasonably required to assess eligibility or programme need.

The Foundation will seek to avoid collecting unnecessarily intrusive financial information and may request additional evidence only where reasonably required.

D. Reference and Third-Party Information

Applicants may be asked to provide information about an academic, professional or other appropriate referee.

Applicants should ensure that the referee is aware that their information is being supplied to the Foundation.

Referee information will be used primarily for programme verification and assessment.

E. Programme Participation and Impact Information

We may collect information concerning:

• programme participation;
• awards or support received;
• programme outcomes;
• attendance;
• mentorship or engagement;
• feedback;
• surveys;
• career or educational progression; and
• other information reasonably required to understand programme effectiveness and impact.

F. Media and Storytelling Information

Subject to appropriate permissions, this may include:

• photographs;
• video;
• audio;
• interviews;
• testimonials;
• biographies;
• beneficiary stories; and
• programme experiences.

G. Website and Technical Information

This may include:

• IP address;
• device and browser information;
• operating system;
• website usage;
• referral information;
• cookies;
• approximate location derived from technical information; and
• interactions with website functionality.

Personal information may be processed to:

• administer scholarship, educational and social-impact programmes;
• assess programme eligibility;
• review and score applications;
• verify information supplied by applicants;
• select and communicate with beneficiaries;
• administer awards, scholarships and programme support;
• make programme payments or disbursements;
• facilitate mentorship, events and opportunities;
• communicate with applicants, beneficiaries, partners and stakeholders;
• manage volunteers and programme personnel;
• measure programme reach, outcomes and impact;
• conduct internal analysis and reporting;
• improve programme design and delivery;
• manage partnerships and institutional relationships;
• provide appropriate donor or stakeholder reporting;
• maintain programme integrity and prevent misuse or fraud;
• comply with legal, regulatory, accounting and governance requirements;
• establish, exercise or defend legal rights; and
• undertake other purposes appropriately disclosed at the point of collection.

The Foundation will seek to collect only information reasonably required for a defined programme, operational or legal purpose.

Where demographic or geographic information is collected solely for reporting and impact measurement, it will not be used to determine programme eligibility or selection unless the programme's published eligibility requirements expressly provide otherwise.

For example, where a scholarship application collects State of Origin and State of Residence solely for internal reporting, geographic analysis and impact measurement, those fields will not be used to qualify, disqualify, rank or score applicants.

Programme-specific notices may provide further information about how particular fields will be used.

Depending on the circumstances and applicable law, the Foundation may process personal information on the basis of:

• consent;
• steps taken at the request of an applicant or participant;
• performance of an agreement;
• legitimate interests that do not improperly override individual rights;
• compliance with legal obligations;
• protection of vital interests;
• public-interest grounds where legally applicable; or
• another lawful basis recognised under applicable law.

Consent will not be used to justify unnecessary collection.

Where processing is optional, individuals should be given a genuine choice wherever required.

Information submitted through a programme application will be used primarily to:

• establish eligibility;
• administer the application;
• assess the applicant against published criteria;
• undertake appropriate verification;
• communicate with the applicant;
• document programme decisions;
• administer awards or benefits; and
• measure and report programme outcomes.

Submitting an application does not guarantee selection.

Reviewer scores, internal notes, moderation discussions and confidential selection deliberations may form part of internal programme administration and may be subject to applicable legal limitations on disclosure.

Where third parties, including universities or programme partners, assist with verification, they should receive only the information reasonably required for that purpose.

Technology may be used to support programme administration, data organisation, communications, analytics or other Foundation operations.

The Foundation does not intend to make scholarship or programme decisions producing significant effects on applicants solely through automated decision-making.

Where automated tools assist with administrative processing, substantive programme decisions should remain subject to appropriate human oversight.

If future programmes materially use automated profiling or decision-making, applicants will receive appropriate information about that processing and available rights.

Consent to participate in publicity, photography, testimonials, interviews or storytelling should be treated separately from the information required to administer a programme.

An applicant should not be disadvantaged in a scholarship or programme-selection process because they decline optional publicity permission.

Similarly, consent to receive general newsletters, fundraising messages or future programme communications should be separated from consent or other lawful processing required to administer a current application.

Where appropriate, individuals may withdraw optional consent by contacting the Foundation.

Some Foundation programmes may involve children or young people.

Where this occurs, the Foundation will implement additional safeguards appropriate to:

• the participant's age and maturity;
• the nature and sensitivity of the information;
• the programme activity;
• applicable parental or guardian consent requirements;
• photography and media permissions; and
• applicable privacy and child-protection requirements.

Information about children will not knowingly be collected through a programme intended only for adults unless necessary and appropriately authorised.

We do not sell beneficiary, applicant or donor personal information.

Information may be shared where reasonably necessary with:

• authorised Foundation personnel;
• programme administrators;
• appropriately authorised reviewers;
• verification personnel;
• educational institutions and programme partners;
• payment and financial-service providers;
• website and application hosting providers;
• email and communications platforms;
• cloud-storage providers;
• CRM or programme-management systems;
• professional advisers;
• analytics and technology providers;
• auditors or governance advisers;
• regulators, courts or public authorities where legally required; and
• other service providers required to administer Foundation activities.

Access should be limited according to role and purpose.

Institutional partners should not automatically receive unrestricted access to an applicant's complete personal, financial or narrative information merely because they participate in a programme.

The Foundation may prepare reports describing programme reach, outcomes and impact.

Where individual identification is unnecessary, information should be reported in aggregated, anonymised or appropriately de-identified form.

Personally identifiable applicant or beneficiary information should not be included in public or routine donor reporting unless:

• it is necessary and lawful;
• appropriate permission has been obtained where required; or
• another applicable lawful basis permits the disclosure.

The Foundation may work across jurisdictions and may use service providers whose systems or personnel are located outside the country in which information was collected.

Personal information may therefore be stored, accessed or processed in another country.

Where information is transferred internationally, the Foundation will seek to comply with applicable cross-border data-transfer requirements and use appropriate safeguards.

Where a particular programme involves material cross-border processing, further information may be provided through the relevant Programme Privacy Notice.

Personal information will not be retained indefinitely merely because it was collected.

Retention periods will reflect:

• the purpose for which information was collected;
• the programme lifecycle;
• verification and selection requirements;
• scholarship or grant administration;
• financial and accounting obligations;
• donor or governance requirements;
• safeguarding considerations;
• legal limitation periods; and
• applicable regulatory obligations.

Unsuccessful application information should be retained only for an appropriate period consistent with programme administration, audit, dispute-resolution and legal requirements.

Where information is no longer required, it will be securely deleted, destroyed, anonymised or otherwise appropriately disposed of.

The Foundation will seek to maintain administrative, organisational and technical safeguards proportionate to the sensitivity of the information processed.

These may include:

• role-based permissions;
• restricted reviewer access;
• secure account authentication;
• encryption or secure transmission where appropriate;
• controlled document storage;
• staff and contractor confidentiality obligations;
• service-provider controls;
• backup and recovery measures;
• monitoring and security maintenance; and
• secure deletion/disposal processes.

Particularly sensitive programme information, including academic records and financial-need narratives, should receive appropriately heightened protection.

Subject to applicable law and relevant exceptions, individuals may have rights to:

• receive information about how their personal information is processed;
• request access to personal information held about them;
• request correction of inaccurate or incomplete information;
• withdraw consent where consent is the basis of processing;
• object to certain processing;
• request restriction of certain processing;
• request deletion where applicable;
• request portability where applicable;
• receive information about certain recipients or disclosures;
• opt out of optional marketing communications;
• seek human intervention where applicable automated decision-making rights arise; and
• raise a complaint concerning the handling of personal information.

The Foundation may require reasonable identity verification before processing a request.

Certain rights are subject to legal exceptions and do not necessarily require the Foundation to delete or disclose every record upon request.

Privacy questions, requests and complaints may be directed to:

Privacy Contact: [Data Protection/Privacy Officer] Organisation: [Full Incorporated Legal Name / Current Operating Entity] Email: [Privacy Email Address] Address: [Registered/Business Address]

We will seek to investigate and respond to legitimate concerns appropriately. The Office of the Information and Privacy Commissioner of Alberta oversees the administration and enforcement of Alberta’s privacy legislation. You may visit their website at: https://www.oipc.ab.ca/.

Individuals in Nigeria may also have the right to lodge a complaint with the Nigeria Data Protection Commission, subject to the Nigeria Data Protection Act 2023.

The website may use cookies and similar technologies for:

• essential website functionality;
• security;
• preferences;
• website analytics;
• performance measurement; and
• other permitted purposes.

Non-essential cookies will be managed in accordance with applicable consent requirements.

Further details will be provided through the Foundation's Cookie Policy and cookie-management interface.

Foundation websites and programme communications may contain links to external websites, application platforms or partner services.

Third parties operate under their own privacy practices and terms. Individuals should review the relevant privacy information before submitting information directly to an external service.

This Policy may be updated as the Foundation's programmes, technologies, partnerships or legal obligations evolve.

The latest version will be made available through the Foundation website and will state the effective or last-updated date.

Where a material change affects previously collected personal information, additional notice or consent will be provided where required.

For questions about this Privacy Policy & Data Protection Statement or the Foundation's data practices:

[Data Protection/Privacy Officer] MacPhini Foundation [Privacy Email Address] www.macphinifoundation.com