SHESA crestSHESA

Legal · Privacy Policy

How SHESA collects and uses your data.

This Privacy Policy explains what personal information the Sacred Heart Ex-Students’ Association collects when you use our public website, register as a member, buy a ticket, or make a donation, and how we protect and share that information.

Effective

23 July 2026

Version

v1.0

Jurisdiction

Republic of Cameroon

1

Who is the data controller

The Sacred Heart Ex-Students’ Association (“SHESA”, “we”, “us”, “our”), an alumni association duly registered under the Cameroonian 1990 Law on Freedom of Association, is the data controller for personal data processed through our Services. The Services include the public website (shesaconnect.com), the members-only Connect platform, and the associated payment and event flows.

For any question about this Policy or your data, contact the SHESA Secretariat at hello@shesaconnect.com.

2

What personal information we collect

The categories of personal data we collect depend on how you interact with the Services:

  • Identity data, full name, matricule (if applicable), batch, house, and profile picture.
  • Contact data, email address, mobile number, and postal address of your branch chapter.
  • Account data, credentials, security tokens, and role/permission assignments within SHESA.
  • Payment data, amount, currency, method (MTN MoMo, Orange Money, card, bank transfer, cash), payer name or donor name for public flows, transaction identifiers, and receipt numbers. Full card numbers are handled by our payment processors, never stored by SHESA.
  • Event data, ticket quantity, attire measurements, guest list details, and any preferences you provide during AGM or event registration.
  • Communications, messages you send us, replies you post inside member channels, and email delivery events (opens, bounces).
  • Technical data, device type, browser, IP address, general location, and interaction events collected via our analytics tools.
3

How we use your data

We use personal data only for legitimate purposes connected to SHESA’s mandate as an alumni association:

  • To operate the Services and provide the features you request (registration, ticket purchase, donation receipts, member directory).
  • To manage your membership, dues, contributions, and welfare records.
  • To send you transactional notifications, receipts, event reminders, membership status updates.
  • To keep you informed of SHESA news, events, and initiatives (you can opt out at any time).
  • To improve the Services, diagnose technical issues, and secure the platform against abuse.
  • To comply with legal, tax, and audit obligations that apply to the Association.
5

Cookies and analytics

The public website uses a small number of cookies and similar technologies. Strictly necessary cookies keep sessions signed in and preserve preferences. Analytics cookies help us understand which sections are most useful, always in aggregated form. See our Cookie Policy for a full inventory.

6

How we share your data

SHESA does not sell your personal data. We share data only with the categories of recipients required to run the Services or to comply with the law:

  • Payment processors, MTN Mobile Money, Orange Money, card acquirers, and banking partners, to process payments, refunds, and reconciliation.
  • Cloud infrastructure providers, including Supabase and our VPS hosting partner, to store data and run the platform.
  • Email delivery and analytics providers, to send transactional messages and to understand aggregate usage of the Services.
  • Auditors, legal advisors, and regulators, where necessary to comply with legal obligations.
  • Other SHESA officers and executives, strictly limited to the officers whose role requires access (e.g. the Treasurer for financial data, the Membership Secretary for the member directory).

We enter written arrangements with third-party processors that require them to protect your data and use it only for the purposes we specify.

7

International data transfers

Some of our providers operate outside of Cameroon. Where personal data is transferred internationally, we take reasonable steps, including contractual safeguards, to ensure that the level of protection travels with the data.

8

How long we keep your data

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. In practice:

  • Membership and directory records are kept for as long as you remain an active member, and archived thereafter for historical continuity of the Association.
  • Payment and financial records are retained for at least ten (10) years to satisfy audit and tax requirements.
  • Event registration records are retained for the duration of the event cycle plus a reasonable archival period.
  • Analytics data is retained in aggregated form and is not tied to your individual account.
9

Your rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you.
  • Request correction of data that is inaccurate or incomplete.
  • Request deletion of your data, subject to legal, financial, and archival retention obligations.
  • Object to or restrict certain kinds of processing.
  • Withdraw consent where processing is based on consent.
  • Request a copy of your data in a portable format.

To exercise any of these rights, contact us at hello@shesaconnect.com. We will respond within a reasonable timeframe. If you consider that we have not addressed your concern, you may lodge a complaint with the competent data-protection authority in your jurisdiction.

10

Security

We implement reasonable technical and organisational measures to protect personal data against loss, misuse, and unauthorised access, including encryption in transit, access controls, and audit logging. No system can be guaranteed 100% secure; we therefore also rely on member vigilance (strong passwords, careful handling of credentials, prompt reporting of suspected incidents).

11

Children

The Services are not directed to children under the age of eighteen (18). We do not knowingly collect personal data from minors. If we learn that we have inadvertently collected such data, we will delete it.

12

Changes to this Policy

We may update this Policy from time to time to reflect changes in the Services, the law, or our practices. Updated Policies are effective as of the effective date shown at the top of this page. For material changes, we will notify members through the Services or by email prior to the effective date.

13

Contact

For any question, complaint, or notice under this Privacy Policy, contact the SHESA Secretariat at hello@shesaconnect.com or via the contact page.

Contact

Questions about this document? Reach the SHESA Secretariat at hello@shesaconnect.com or via our contact page.