Introduction
This notice describes how information is handled by the UGF website as currently implemented. The organisation should review it against its actual practices before publication. The anticipated jurisdiction is Zimbabwe, subject to confirmation by UGF and legal review.
Organisation responsible for the website
United Generation Foundation (UGF) is identified as the organisation responsible for the website. Its legal name, registration status, physical address, privacy contact and any Data Protection Officer details have not been confirmed in this project and must be supplied by UGF.
Information collected from donors, contacts and volunteers
The donation checkout requests first and last name, email, optional message, anonymous-display preference, campaign choice and amount. An EcoCash mobile number is requested only when needed to initiate authorization through the approved gateway. UGF does not request wallet PINs, one-time codes or raw card details. The local development simulator records a DEMO transaction only and does not transfer funds.
Contact and volunteer forms request the fields shown on those forms so UGF can consider or respond to the submission. Do not submit sensitive personal information that the form does not request.
Automatically collected technical information
The application may process a network address transiently for rate limiting of sensitive form endpoints. The project does not implement an analytics service or a public advertising tracker. UGF should confirm hosting logs and infrastructure-level collection with its hosting operator.
Cookies and browser storage
The public site does not intentionally set tracking cookies. The UGF Assistant stores its recent conversation in this browser tab's sessionStorage; it is not sent to an AI service and is not stored as a server-side chat transcript. Browser session restoration can affect when session storage is cleared.
Administrator sign-in uses a session cookie to protect administrative pages. It is HTTP-only, SameSite=Lax, and marked Secure in production. Administrators should sign out on shared devices.
Why information is used
Submitted information is used to respond to enquiries, review volunteer applications, record donation-form DEMO submissions, administer published campaigns, prevent abuse, and maintain financial and security audit trails where applicable. The site does not use chatbot conversation text to train or query a paid AI service.
Legal grounds for processing
The lawful basis for each activity depends on UGF's actual relationship with the individual and applicable law. UGF must determine and document the appropriate basis, notices and consent language for each form before production use. A checkbox on the development simulator is not a substitute for that review.
Donation records and verification
Financial amounts are stored in integer minor units and carry a currency code. Development transactions are explicitly marked DEMO and excluded from public confirmed totals. A browser return does not prove payment: only a signed provider update confirmed through the provider status service may mark a donation successful.
Storage and protection
The application uses PostgreSQL through Prisma. Administrator passwords are hashed, and administrator sessions are stored as hashes. These implementation measures do not guarantee that every environment, backup, operator account or network is secure. UGF must confirm hosting controls, backups, encryption in transit and at rest, operator access and incident procedures with its providers.
Data retention
No organisation-approved retention schedule has been supplied. UGF must set retention periods for donor, contact, volunteer, audit and administrative records, and configure deletion or archival procedures accordingly. This policy does not invent a fixed retention period.
Service providers and cross-border processing
The application is configured to use a PostgreSQL database reachable through a local SSH tunnel in development. That local tunnel is not a production hosting design. The production database host, hosting provider, processing locations, subprocessors and any cross-border transfers must be confirmed by UGF before deployment. No provider list or processing location is asserted here.
Your information rights and requests
Applicable rights and procedures depend on the law and UGF's role. To request access, correction or deletion, use the official Contact page and identify the information concerned. UGF must publish an approved privacy contact and response procedure before launch.
Children's personal information
The site is not intended to collect personal information directly from children. Do not submit a child's personal information through a public form unless UGF has established an appropriate lawful process and guardian involvement where required. Identifiable children must not be shown in photographs without appropriate authorization and consent.
Security incidents
UGF should assess suspected incidents promptly, preserve relevant records and notify affected people or authorities where required by applicable law. The organisation must approve a response contact and incident process; this notice does not promise that an incident can always be prevented.
External websites and legal references
Links to other websites are provided for reference. Their privacy practices are governed by their own notices.
Cyber and Data Protection Act [Zimbabwe Legal Information Institute]
Data Controller and DPO Licensing Regulations, SI 155/2024 [Veritas]
Changes to this notice
UGF may update this notice when its services or practices change. The date at the top should be updated after an authorised review. Material changes should be communicated as required by applicable law.
Privacy enquiries
Use the Contact page for privacy enquiries until UGF supplies and approves a dedicated privacy contact. No phone number or email address is invented here.