Privacy Policy

 COMPREHENSIVE PRIVACY POLICY

Website: ShimelesaberaFoundation.org
Effective Date: August 31, 2026
Last Updated: August 31, 2026
Version: 1.0

TABLE OF CONTENTS

1. Introduction

2. Information We Collect

3. How We Use Your Information

4. How We Share Your Information

5. Data Security Measures

6. Data Retention and Deletion

7. Your Rights and Choices

8. Special Provisions for Sensitive Data

9. Specific Provisions for Field Operations ("On Duty")

10. Cookies and Tracking Technologies (Website)

11. Third-Party Links and Social Media

12. International Data Transfers

13. Updates to This Privacy Policy

14. Contact Us

15. Acknowledgment

 1. INTRODUCTION 

1.1 Who We Are

The Shimeles Abera Foundation (referred to as "the Foundation," "we," "us," or "our") is a non-profit organization registered in Ethiopia. Our mission is to improve lives through education, mental health support, and community development.

1.2 Purpose of This Policy

We are committed to protecting the privacy and security of all individuals who interact with us. This Privacy Policy explains:

· What personal information we collect

· How we collect, use, store, and protect that information

· Your rights regarding your personal data

· How we handle information both online (via our website) and offline (during our daily operations, field visits, and events) 

1.3 Scope

This policy applies to:

· Visitors to our website (www.shimelesabera.org – if applicable)

· Donors, sponsors, and partners

· Beneficiaries (students, mental health program participants, community members)

· Volunteers, staff, and job applicants

· Anyone who contacts us via email, phone, social media, or in person

1.4 Legal Framework

We operate in accordance with:

· Ethiopian Personal Data Protection Proclamation No. 1221/2021

· Internationally recognized best practices, including the EU General Data Protection Regulation (GDPR) principles where applicable

2. INFORMATION WE COLLECT 

2.1 Information You Provide Voluntarily

 Category Examples

Identity Data Full name, gender, date of birth (if relevant), nationality

Contact Data Email address, phone number, postal address, social media handles

Donation Data Payment method, donation amount, frequency, bank details (processed securely via third-party gateways – we do not store full payment card numbers)

Beneficiary Data Health information (for mental health programs), educational background, family details, and any other information you share during assessments or surveys

Employment/Volunteer Data CV/resume, educational certificates, work history, references, identification documents

Communication Data Records of emails, messages, feedback forms, and call logs

2.2 Information We Collect Automatically (Website)

When you visit our website, we may automatically collect:

 Data Type Purpose

IP Address To understand general location (country/city) and prevent fraud

Browser Type & Version To ensure our website displays correctly on your device

Pages Visited & Time Spent To analyze which content interests our visitors and improve user experience

Referring Website To understand how you found us (e.g., Google, social media, or a partner site)

Device Information Operating system, screen resolution, and mobile device model

We use cookies and similar tracking technologies for these purposes. You can manage or disable cookies through your browser settings, though this may affect website functionality.

2.3 Information from Third Parties

We may receive information about you from:

· Social media platforms (if you interact with our pages)

· Payment processors (for donation confirmations)

· Partner organizations (with your consent)

3. HOW WE USE YOUR INFORMATION

3.1 Lawful Bases for Processing

We process your personal data only when we have a valid legal reason, including:

· Consent: You have given us clear permission (e.g., signing up for newsletters)

· Contractual Necessity: To process a donation, grant, or service agreement

· Legal Obligation: To comply with Ethiopian tax laws or regulatory reporting

· Legitimate Interest: To improve our services, prevent fraud, or communicate important updates (we always balance this against your privacy rights)

3.2 Specific Uses 

Activity Data Used Purpose

Processing Donations Name, contact details, payment data To receive, acknowledge, and issue tax receipts for contributions

Communicating with You Email, phone number To send thank-you notes, project updates, and respond to inquiries

Program Enrollment Identity, health, educational data To assess eligibility, provide tailored support, and measure program impact

Volunteer & Staff Management CV, ID, references To recruit, onboard, assign tasks, and pay salaries/stipends

Website Improvement IP address, pages visited To analyze traffic patterns, fix errors, and enhance content

Compliance & Reporting All relevant data To meet government reporting requirements and donor accountability standards

Security & Fraud Prevention IP address, login records To protect our systems, donors, and beneficiaries from unauthorized access

3.3 Newsletters and Email Communications

3.3.1 What We Send

We may send you periodic email communications, including:

· Newsletters: Updates on our projects, success stories, upcoming events, and impact reports (typically monthly or quarterly)

· Fundraising Appeals: Campaigns to support specific initiatives (e.g., boarding school construction, mental health program expansion)

· Event Invitations: Webinars, community gatherings, fundraising galas, or volunteer recruitment drives

· Acknowledgments: Thank-you messages following donations or program participation

· Impact Updates: Reports showing how your contribution made a difference

3.3.2 How We Obtain Your Email

We collect email addresses through:

· Direct Sign-up: You voluntarily subscribe via our website, social media, or paper forms

· Donation Process: When you make a donation, we include an opt-in option for future communications

· Program Enrollment: Beneficiaries, partners, and volunteers may provide emails during registration

· Business Cards/Events: When you share your contact details with us at meetings or conferences

3.3.3 Consent and Opt-in

We follow the Ethiopian Personal Data Protection Proclamation and international best practices regarding consent:

· Explicit Consent: We will only send you newsletters and marketing emails if you have actively opted in (e.g., checking a box that says "I would like to receive updates from Shimeles Abera Foundation").

· No Pre-checked Boxes: Consent is never assumed. You must voluntarily check the box yourself.

· Separate Consent: Signing up for one service (e.g., a donation) does not automatically enroll you in newsletters – we ask separately.

3.3.4 Your Right to Unsubscribe

You can stop receiving our emails at any time through:

· Unsubscribe Link: Every promotional email contains a clear "unsubscribe" or "opt-out" link at the bottom.

· Direct Request: You can email us at [email protected] with "UNSUBSCRIBE" in the subject line.

· Reply Option: You may also reply to any email with "STOP" or "REMOVE" and we will process your request.

Processing Time: We will honor your opt-out request within 5 business days. During this brief period, you may still receive emails already scheduled – we apologize in advance and confirm that your preference will be fully applied afterward.

3.3.5 What Happens After You Unsubscribe

· We will immediately cease sending you marketing or promotional emails.

· Transactional Emails Only: You may still receive essential communications related to:

 · Donation receipts and tax acknowledgments

 · Program-specific updates if you are an active beneficiary or partner

 · Security alerts or policy changes affecting your interaction with us

· Re-subscription: If you later wish to rejoin our mailing list, you will need to opt in again through our website or a new sign-up form.

3.3.6 Email Analytics and Tracking 

To improve our communications, we may use tracking technologies in emails, such as:

· Open Rate Tracking: A small invisible image helps us know if you opened the email

· Click-through Tracking: We monitor which links you click to understand what content interests you most

· Bounce Reports: We track undelivered emails to keep our list clean and accurate

Your Control: You can disable image loading in your email client to prevent open tracking. Click-through tracking cannot be disabled per email, but it only shows that a link was clicked – not what you did after clicking.

3.3.7 Frequency and Volume 

We respect your inbox. Our commitments:

· Newsletters: Maximum of one per month, unless there are urgent updates or emergencies

· Fundraising Appeals: Maximum of two per quarter, and only for campaigns where your support is particularly relevant

· Event Invitations: As needed, but we will not send more than two invitations per event (initial and reminder)

· Special Announcements: Occasional urgent messages (e.g., emergency response or critical policy changes) – these are not marketing and may be sent outside regular schedules

3.3.8 Data Security for Email Lists

· Storage: Our email subscriber lists are stored on secure, password-protected platforms (e.g., Mailchimp, Sendinblue, or similar). We choose providers that comply with international data protection standards.

· Access: Only authorized communications staff have access to subscriber lists.

· No Sharing: We never share, sell, or rent our email subscriber lists to any third party for their own marketing purposes.

3.3.9 Children and Email Communications

We do not knowingly send newsletters or marketing emails to individuals under the age of 13 without verifiable parental consent. If a parent/guardian informs us that their child has subscribed, we will immediately remove that email address from all marketing lists.

3.3.10 Sample Email Footer (to be added to all newsletters)

You are receiving this email because you subscribed to updates from the Shimeles Abera Foundation.

If you no longer wish to receive these emails, you can unsubscribe at any time by clicking here or replying with "UNSUBSCRIBE."

Shimelesabera Foundation
Kirkos, Addis Ababa, Ethiopia
Email: [email protected]
Phone: +251 91 1 68 57 23
Website: ShimelesaberaFoundation.org

Data Privacy: We take your privacy seriously. Read our full Privacy Policy here.

4. HOW WE SHARE YOUR INFORMATION

4.1 We Do Not Sell or Rent Your Data

 We never sell, rent, or trade your personal information to third parties for marketing or commercial purposes.

4.2 Trusted Third-Party Service Providers

We may share data with organizations that help us operate, including:

 Provider Type Examples Data Shared

Payment Processors Chapa, Telebirr, bank gateways Donation amount, name, email (not full card numbers)

IT & Hosting Services Web hosting, cloud storage, email platforms Usage data, contact lists, documents

Professional Advisors Lawyers, auditors, consultants As needed for compliance or advice

Partner NGOs/Government Ministry of Women and Social Affairs, local health offices Program-related data (with strict confidentiality agreements) 

All our third-party providers are contractually bound to protect your data and use it only for the specific services

they perform for us.

4.3 Legal and Regulatory Disclosures

We may disclose your information if:

· Required by Ethiopian law, court order, or government authority

· Necessary to protect the safety, rights, or property of the Foundation, our staff, or beneficiaries

· In connection with a merger, acquisition, or restructuring (we will notify you beforehand)

4.4 Anonymized Data

We may use aggregated, anonymized data (where individuals cannot be identified) for research, reporting, or public advocacy without restriction.

5. DATA SECURITY MEASURES

5.1 Technical Safeguards

We implement industry-standard protections, including:

· Encryption: All data transmitted via our website uses SSL/TLS encryption (HTTPS). Sensitive stored data is also encrypted.

· Access Controls: Only authorized staff have access to personal data, based on their specific job roles.

· Firewalls & Antivirus: Our servers are protected against unauthorized access and malware.

· Secure Storage: Physical documents are kept in locked cabinets; digital files are on password-protected systems with multi-factor authentication where possible.

5.2 Organizational Safeguards

 · Staff Training: All employees, volunteers, and board members receive annual privacy and data protection training.

· Confidentiality Agreements: Every person handling your data signs a binding confidentiality clause.

· Incident Response Plan: We have a

clear procedure to detect, contain, and report any data breach.

5.3 Data Breach Notification

In the unlikely event of a data breach that poses a high risk to your rights and freedoms, we will notify you and the relevant Ethiopian authorities within 72 hours of becoming aware of it, as required by law.

6. DATA RETENTION AND DELETION 

6.1 Retention Periods

We keep your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer period is required by law (e.g., financial records for tax audits – typically 5–7 years in Ethiopia).

Data Type Typical Retention Period

Donor Records 7 years after last donation (for tax and audit purposes)

Beneficiary Program Data 5 years after program completion (for impact evaluation and follow-up)

Employment Applications 1 year (if unsuccessful) or duration of employment + 5 years (if hired)

Website Analytics 26 months (aggregated, anonymized)

Newsletter Subscriptions Until you unsubscribe or we stop the newsletter

6.2 Your Right to Deletion

You may request that we delete your personal data at any time, unless we are legally required to keep it. Upon verified request, we will erase or anonymize your data within 30 business days.

7. YOUR RIGHTS AND CHOICES 

Under Ethiopian law and international best practices, you have the following rights:

Right What It Means

Right to Access You can request a copy of all personal data we hold about you.

Right to Rectification You can correct inaccurate or incomplete data.

Right to Erasure ("Right to be Forgotten") You can ask us to delete your data, subject to legal obligations.

Right to Restrict Processing You can ask us to limit how we use your data while a complaint is being resolved.

Right to Data Portability You can request your data in a machine-readable format to transfer to another organization.

Right to Object You can object to processing based on legitimate interests or direct marketing.

Right to Withdraw Consent If we rely on your consent (e.g., for newsletters), you can withdraw it anytime.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days and may ask for proof of identity to prevent unauthorized access.

8. SPECIAL PROVISIONS FOR SENSITIVE DATA

8.1 Health and Mental Health Information

Given our mental health programs, we may collect sensitive data about your physical or psychological well-being. We handle this with extra care: 

· Explicit Consent: We will always ask for your specific, written consent before collecting health data.

· Minimal Collection: We only collect what is strictly necessary for the program.

· Restricted Access: Only licensed mental health professionals and designated program coordinators can view this data.

· Strict Confidentiality: This data is never shared outside the program team without your explicit permission, except where required by law (e.g., risk of self-harm).

8.2 Data About Children

If we collect data from children under 13 (or under 16 in certain jurisdictions), we require verifiable parental or guardian consent. We do not knowingly collect such data without this consent. Parents/guardians have full rights to review, correct, or delete their child's information.

9. SPECIFIC PROVISIONS FOR FIELD OPERATIONS ("ON DUTY")

This section applies to how we handle personal data during in-person activities, such as community visits, school programs, mental health counseling sessions, and office-based work.

9.1 Collection in the Field

 · Paper Forms: When we collect data on paper (e.g., intake forms), these are immediately stored in secure, lockable folders and transported in sealed bags.

· Digital Recording: If we use tablets or phones to collect data, devices are password-protected and encrypted. Data is uploaded to secure servers within 24 hours, and local copies are deleted.

· Photography & Video: We may take

photos or videos for program documentation or promotional purposes. We always obtain explicit written consent from the individual (or parent/guardian for minors) before capturing or publishing such media.

9.2 Verbal Communication

· Public Settings: Avoid discussing personal details of beneficiaries or donors in public places (e.g., restaurants, shared transport) where others can overhear.

· Phone Calls: When calling beneficiaries, we identify ourselves and confirm their identity before discussing sensitive matters.

9.3 Staff and Volunteer Conduct

· Confidentiality Pledge: All staff and volunteers handling personal data must sign an annual confidentiality pledge.

· Need-to-Know Basis: Access to beneficiary or donor information is granted only to team members directly involved in the activity.

· Reporting Breaches: Any accidental disclosure, loss of records, or suspected breach must be reported immediately to the Privacy Officer.

9.4 Offline Data Disposal

· Paper documents containing personal data are shredded or incinerated when no longer needed.

· Old electronic devices (phones, laptops, external drives) are wiped clean using certified data destruction software before disposal or reuse.

10. COOKIES AND TRACKING TECHNOLOGIES (WEBSITE)

10.1 What Are Cookies?

Cookies are small text files stored on your browser when you visit our website. They help us remember your preferences and understand how you interact with our site.

10.2 Types of Cookies We Use

 Cookie Type Purpose Duration

Essential Cookies Enable core functionality (e.g., page navigation, form submissions) Session (deleted when you close your browser)

Analytics Cookies Track page visits, bounce rates, and referral sources (e.g., via Google Analytics) Up to 2 years

Preference Cookies Remember your language or font size preferences Persistent (until you clear them)

10.3 Your Cookie Choices

You can accept or decline cookies via our cookie banner when you first visit. You can also manage cookies through your browser settings:

· Google Chrome: Settings → Privacy and Security → Site Settings → Cookies

· Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data

· Safari: Preferences → Privacy → Manage Website Data

Declining non-essential cookies will not affect website functionality for basic browsing.

11. THIRD-PARTY LINKS AND SOCIAL MEDIA

Our website may contain links to external sites (e.g., partner organizations, social media platforms). This Privacy Policy does not apply to those sites. We encourage you to read their privacy policies before sharing any personal data.

When you engage with us on social media (Facebook, Telegram, YouTube, etc.), please note that those platforms have their own data handling practices. We are not responsible for their data collection.

12. INTERNATIONAL DATA TRANSFERS

If we transfer your data outside Ethiopia (e.g., to cloud servers located in other countries), we ensure:

· The receiving country has an adequate level of data protection as recognized by Ethiopian law, OR

· We implement appropriate safeguards, such as Standard Contractual Clauses or binding corporate rules, to ensure your data remains protected.

13. UPDATES TO THIS PRIVACY POLICY

We may revise this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

· Notification: We will post the updated version on our website with a new "Effective Date."

· Significant Changes: For material changes that affect your rights, we will notify you via email or a prominent website banner at least 15 days in advance.

· Your Continued Use: By continuing to interact with us after changes take effect, you acknowledge the updated policy.

We encourage you to review this page periodically.

14. CONTACT US

14.1 Privacy Officer

 For any questions, concerns, requests, or complaints about this policy or how we handle your data, please contact our designated Privacy Officer:

Shimelesabera Foundation
Kirkos, Addis Ababa, Ethiopia
Email: [email protected]
Phone: +251 91 1 68 57 23
Website: ShimelesaberaFoundation.org 

14.2 How to Make a Complaint

 If you are not satisfied with our response, you have the right to lodge a complaint with the Ethiopian Data Protection Authority (once fully operational) or the Ministry of Innovation and Technology.

15. ACKNOWLEDGMENT

By using our website, donating, enrolling in our programs, volunteering, or otherwise providing us with your personal data, you acknowledge that you have read and understood this Privacy Policy and agree to its terms.

°°°°°°°°°°°

End of Privacy Policy