Privacy Policy

Effective Date: 1 January 2025 | Last Updated: 12 July 2026

The African Center for Governance, Asset Recovery, and Sustainable Development ("the African Center", "we", "us", or "our") operates the Open Asset Recovery Database ("OARD"). This Privacy Policy explains what personal information we collect when you use the Platform, how we use it, and your rights regarding that information. By using OARD, you consent to the practices described in this Policy.

1. Information We Collect

1.1 Information You Provide

Account registration: name, email address, password (stored as a secure hash), user type (student, professional, or organisation).
Profile information: organisation name, country, profession, and profile photo (optional).
Communications: messages or enquiries you send to us via the contact form or by email.
Subscription and payment: subscription plan selections and payment records (payment processing is handled by third-party providers; we do not store full card details).

1.2 Information Collected Automatically

Usage data: pages visited, searches performed, documents downloaded, and session timestamps.
Device and browser data: IP address, browser type, operating system, and referring URLs, collected for security and analytics purposes.
Cookies and sessions: we use server-side sessions to keep you logged in. We do not currently use third-party tracking cookies.

2. How We Use Your Information

We use the information we collect to:

Create and manage your user account and provide access to the Platform.
Process subscription payments and maintain billing records.
Personalise your experience and remember your preferences.
Send transactional emails (e.g. email verification, password resets, subscription confirmations).
Monitor Platform usage to improve content quality, performance, and security.
Respond to your enquiries and provide user support.
Comply with applicable legal obligations.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

3. Legal Basis for Processing

Where applicable data protection law requires a legal basis, we process your personal data on the following grounds:

Contract performance: to create your account and deliver the services you have subscribed to.
Legitimate interests: to secure and improve the Platform, and to prevent fraud or abuse.
Consent: for optional profile information and non-essential communications where you have opted in.
Legal obligation: to comply with applicable laws and regulatory requirements.

4. Data Sharing and Disclosure

We may share your information with:

Service providers: hosting, email delivery, and payment processing partners who act on our behalf and are bound by confidentiality obligations.
Law enforcement or regulatory authorities: when required by law or in response to valid legal process.
Successors: in the event of a merger, acquisition, or transfer of organisational assets, subject to equivalent privacy protections.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Platform services. Usage logs and search history are retained for up to 12 months for security and analytics purposes. When your account is deleted, personal data is removed from active systems within 30 days, subject to any legal retention obligations.

6. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These include encrypted password storage, HTTPS transmission, database access controls, and token-based session management. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

7. Cookies

OARD uses a single server-side session cookie to authenticate logged-in users. This cookie is essential for Platform functionality and does not track you across other websites. It expires automatically after 8 hours of inactivity or when you sign out. We do not use advertising, analytics, or social-media cookies.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete personal data via your profile settings.
Delete your account and associated personal data.
Object to or restrict certain processing activities.
Data portability — receive a copy of your data in a structured, machine-readable format.
Withdraw consent at any time for processing based on consent, without affecting prior processing.

To exercise any of these rights, please contact us at info@openassetrecovery.org. We will respond within 30 days.

9. Children's Privacy

OARD is not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal data, please contact us and we will take prompt steps to delete it.

10. International Transfers

Your data may be processed and stored on servers located outside your country of residence. Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with applicable data protection law.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users of material changes by email or by a prominent notice on the Platform. The updated Policy will indicate the revised effective date at the top of this page. Continued use of the Platform after changes take effect constitutes acceptance of the revised Policy.

12. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or our data practices:
African Center for Governance, Asset Recovery, and Sustainable Development
Email: info@openassetrecovery.org
Website: openassetrecovery.org