Privacy policy
Digital Safe Space is committed to protecting your personal data with the utmost care. This document clearly explains what data we collect, why, and how we use it.
Data controller
The controller of the personal data collected through the Digital Safe Space platform is Women EdTech, the organisation leading the FEA 2 programme (Féministes en Action 2), implemented in partnership with CARE Benin-Togo and funded by the French Development Agency (AFD).
Personal data collected
We only collect the data strictly necessary for the mission of Digital Safe Space. What we collect depends on the services used and is always proportionate to the purpose.
| Service | Data collected | Status |
|---|---|---|
| Reporting form | First name, town, email, WhatsApp (all optional), description of the incident, type of evidence available and a link to evidence if you wish (the form does not allow you to upload files) | Entirely optional — anonymity possible |
| Browsing the website | Anonymised IP, browser type, pages visited, session length | Automatic, via analytics cookies |
| Webinar registration | Last name, first name, email, organisation (optional), town | Required to take part |
| Downloading resources | Email (optional, to receive updates) | Optional |
| Direct contact | Name, email or phone number provided voluntarily | Provided voluntarily |
Anonymous reporting: you can use our reporting form without providing any personal information. Your case will be handled with the same priority and care as a named report.
Purposes of processing
Your data is collected and used exclusively for the missions of Digital Safe Space. We make no commercial use of your data and have no advertising partners.
Handling reports: analysing reported cases, directing victims to suitable resources and support services (CNIN, CRIET, partner NGOs), and contributing to the anonymised documentation of TF-GBV in West Africa.
Improving our services: understanding users’ needs to enrich the educational content (capsules, fact sheets, webinars) and improve the experience on the platform.
Institutional communication: sending information about new resources, webinars or DSS events, only to people who have agreed to receive these communications.
Programme reporting: producing aggregated, anonymised statistics for our funders (AFD, CARE) to report on the impact of the FEA 2 programme. No identifiable individual data is shared.
Platform security: detecting and preventing fraudulent access, abuse and attempts to compromise the system.
Legal basis for processing
Each data processing activity relies on a clear legal basis, in line with the general principles of personal data protection applicable in West Africa and international standards (with the GDPR as a reference).
| Purpose | Legal basis |
|---|---|
| Handling reports and directing victims | Legitimate interest — mission to protect women’s digital rights |
| Sending communications (newsletter, webinars) | Consent — obtained explicitly at registration |
| Anonymised statistical analysis for reporting | Legitimate interest — accountability to institutional funders |
| Analytics cookies | Consent — accepted via the cookie banner |
| Platform security | Legitimate interest — protecting the platform and its users |
Data retention period
We apply the principle of data minimisation: your data is kept only as long as necessary for the purpose for which it was collected, then deleted or irreversibly anonymised.
| Type of data | Retention period |
|---|---|
| Reports (with contact details) | 24 months from processing, then fully anonymised |
| Anonymous reports | 36 months in aggregated form for research purposes |
| Webinar registration data | 12 months after the last event you attended |
| Browsing data (logs) | 13 months (standard analytics practice) |
| Links to evidence provided in a report | 6 months after the report has been handled, unless expressly requested |
| Direct contact data | 3 years from the last exchange, then deleted |
When the periods above expire, your data is automatically deleted from our systems or permanently anonymised. No identifiable data is archived beyond these periods without your explicit consent.
Data sharing and transfer
Digital Safe Space never sells your data and does not share it with any commercial or advertising partner. Any sharing is subject to strict safeguards and always in your interest.
Operational partners (CARE Benin-Togo, local support services): with your explicit consent, some reports may be passed on to authorised partner organisations to provide you with support. This never happens without you being informed.
Technical service providers: our hosting provider (Hostinger) and our analytics tools (Google Analytics, configured in anonymisation mode) process technical data under subcontracting agreements that meet international standards.
Institutional funders (AFD, CARE International): only aggregated, anonymised statistics are shared for FEA 2 programme reporting. No identifiable individual data is disclosed.
Legal obligations: in the event of a court order or a binding legal obligation, some data may be disclosed to the competent authorities. We will inform you whenever possible.
No transfer of identifiable personal data outside the framework above can take place without your prior, explicit and informed consent.
Data security
Protecting your data is an absolute priority, especially given the sensitive nature of the information you entrust to us. We implement appropriate technical and organisational measures.
Encryption in transit: all communications between your browser and our servers are encrypted using the TLS 1.3 protocol (HTTPS). No data travels unencrypted over the network.
Encryption at rest: sensitive data (incident descriptions, links to evidence) is encrypted on our servers. Encryption keys are managed separately from the data.
Restricted access: only authorised DSS team members trained in TF-GBV confidentiality can access reports. This access is logged and regularly audited.
Pseudonymisation: report data is pseudonymised as soon as its immediate processing is complete. The link between identity and file is kept separately and deleted at the end of the retention period.
Secure hosting: our platform is hosted on certified servers, with encrypted daily backups and a documented business continuity plan.
Incident management: in the event of a data breach likely to affect your rights, we undertake to notify you within 72 hours of detection, in line with international best practice.
Your rights over your data
You have extensive rights over your personal data. You can exercise them at any time by contacting us at the address given in article 12. We undertake to reply within a maximum of 30 days.
Obtain a copy of all the personal data we hold about you, as well as information about how it is processed.
Have any inaccurate or incomplete data about you corrected without undue delay.
Request the deletion of your personal data, subject to the legal retention obligations that apply to us.
Object at any time to the processing of your data, in particular for communication or profiling purposes.
Request the temporary suspension of the processing of your data, in particular while its accuracy is being contested.
Receive your data in a structured, machine-readable format to pass it on to another service if you wish.
For reports made anonymously, some rights may be limited because it is technically impossible to identify you. We recommend keeping your DSS reference number (format DSS-XXXXX) to make any later exchange easier.
Cookies and trackers
Our website uses a limited number of cookies that are strictly necessary for it to work properly or subject to your prior consent. We do not use any advertising or behavioural targeting cookies.
| Cookie | Purpose | Duration | Consent |
|---|---|---|---|
| WordPress session | Keeping the session active and securing forms (nonce) | Session | Required |
| Cookie preferences | Remembering your choice about optional cookies | 12 months | Required |
| Google Analytics (_ga) | Anonymised audience measurement (masked IP, no cross-tracking) | 13 months | Optional |
| Google Analytics (_gid) | Distinguishing between consecutive sessions for analysis | 24 hours | Optional |
You can change your cookie preferences at any time via the “Manage cookies” link at the bottom of each page, or by setting your browser to refuse all cookies.
Protection of minors
Digital Safe Space pays particular attention to protecting minors. The platform is open to everyone affected by digital violence, including young girls and teenagers.
If you are under 16, we recommend making your report with the help of a trusted adult (parent, guardian, social worker, teacher). For reports involving minors, our team applies reinforced protection protocols and can refer you to organisations specialising in child protection.
If you are a minor and in immediate danger, call 114 (CRIET) or write to the CNIN at plaintes@cnin.bj rather than using this form. 114 is free and available 24/7.
Updates to this policy
This privacy policy may be updated to reflect changes to our services, regulatory changes or new requirements from our institutional partners. The date of the last update appears at the top of this document.
If there is a substantial change affecting your rights or the way we process your data, we will inform you by email (if you have given us an address) and by a visible notice on the platform, at least 14 days before they take effect .
Continuing to use Digital Safe Space after being notified of an update means you accept the new version of this policy. If you do not accept the changes, you can exercise your right to erasure by contacting us.
The version history of this policy is available on request at contact@womenedtech.com. We keep previous versions for 5 years.
Contact us
For any question about this policy, to exercise your rights or to raise a concern about the processing of your data, you can contact us through the following channels. We undertake to acknowledge receipt within 48 hours and to reply within 30 calendar days.
If you believe that the processing of your data does not comply with the applicable rules, you have the right to lodge a complaint with the competent national data protection authority in your country of residence.