Privacy policy

1. Identity of the data controller

The controller of the personal data collected through the FONGI platform is:

• Name: Emilie Bernard
• Email: emilie.bernard337@gmail.com
• Context: Technical coordination of the Forum of International NGOs in Tunisia (FONGI), administratively hosted by the Danish Refugee Council (DRC) Tunisia

The platform is developed and maintained on a professional basis on behalf of FONGI, which brings together the international member organisations operating in Tunisia.

2. Legal bases for processing (GDPR Art. 6)

The processing carried out on the platform relies on the following legal bases:

Explicit consent (Art. 6.1.a)

When an account is created, each user gives explicit consent to this privacy policy and to the Terms of Use. This consent may be freely withdrawn at any time (see section 7).

Legitimate interest of the forum (Art. 6.1.f)

The processing of certain usage data (sign-ins, activity on the platform) is based on FONGI's legitimate interest in ensuring the proper functioning of its members' coordination platform, securing access and keeping track of changes to sensitive data.

Performance of an agreement (Art. 6.1.b)

Within the contractual relationship between the member organisations and FONGI (membership fees, participation commitments), certain data are processed for the performance of that agreement.

3. Categories of data collected

Identity and contact data

• First name, last name, professional email address
• Organisation of affiliation and role within FONGI
• Professional telephone number (optional)

Organisational data

• Information about the organisation (country, sectors of intervention, governorates covered)
• Funded projects and associated impact indicators
• Contributions to the work of the working groups and of the Council of Members
• Attendance at FONGI meetings and engagement scores

Technical data

• IP address at sign-in (access logs — limited retention)
• Audit trails of data changes (GDPR Art. 5.2 compliance)

Financial data (restricted)

• Annual membership fees (category, amount due, amount paid)
• Budget allocated to Tunisia (optional, restricted admin access)

4. Retention period

Personal data are retained for as long as the user account is active.

If the account is deactivated or deleted:

• Identification data (last name, first name, email) are anonymised within 12 months of the final deactivation of the account
• Audit trails (GDPR Art. 5.2 traceability) are retained for at least 5 years for evidential purposes (GDPR Art. 17 §3.e)
• Financial data (membership fees) are retained for 10 years in accordance with legal accounting obligations

Exercising the right to erasure (see section 7) results in the immediate anonymisation of identification data, without deletion of the audit trails.

5. Processors and hosting

The platform uses the following technical processors. Each transfer is governed by standard contractual clauses compliant with the GDPR:

• Hetzner Online GmbH (server hosting) — Industriestr. 25, 91710 Gunzenhausen, Germany — Server located in the EU. Hetzner privacy policy
• Mapbox, Inc. (interactive mapping) — United States. Used for the geographical visualisation of projects and interventions. The geographical coordinates of interventions are transmitted. Mapbox policy
• Anthropic, PBC (AI-assisted extraction of indicators) — United States. Excerpts from activity reports are processed by the Claude API to extract quantifiable indicators. No named personal data are transmitted.
• DeepL SE (automatic translations, future use) — Germany. DeepL policy

This list may change. Any change will be notified to users with 30 days' notice.

6. Recipients of the data

The personal data collected through the FONGI platform are under no circumstances passed on to third parties outside the forum, nor sold, nor rented.

Access to the data is limited to the following persons, strictly within the scope of their duties:

• The technical administrator of the platform (Emilie Bernard + DRC Tunisia IT team)
• Members of the same organisation, for shared organisational data
• All FONGI members, for the data published in the directory (organisation name, sectors, projects classified "public")

7. Rights of data subjects (GDPR Chapter III)

In accordance with the GDPR, you have the following rights:

• Right of access (Art. 15): you may request a copy of all the data concerning you
• Right to rectification (Art. 16): you may correct inaccurate data directly in your profile or through a request to the DPO
• Right to erasure / right to be forgotten (Art. 17): you may request the deletion of your identification data (subject to the legal exceptions of Art. 17 §3)
• Right to data portability (Art. 20): you may receive your data in a structured, machine-readable format
• Right to object (Art. 21): you may object to processing based on legitimate interest
• Withdrawal of consent: you may withdraw your consent at any time, without affecting the lawfulness of prior processing

To exercise these rights, contact the DPO at: theophile.renard@drc.ngo or use the contact form.

Any request will be handled within one month (a period that may be extended by two further months where the request is complex).

8. Data Protection Officer (DPO)

A data protection officer has been appointed for FONGI:

• DPO email: theophile.renard@drc.ngo

Note: this address is currently an alias being configured. It will be operational before the official launch of the platform.

9. Right to lodge a complaint with a supervisory authority

If you consider that your rights are not being respected, you have the right to lodge a complaint with the competent supervisory authority:

• In France: Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr
• In Tunisia: Instance Nationale de Protection des Données Personnelles (INPDP) — www.inpdp.nat.tn

The competent authority will be specified according to the residence of the data controller. This point is to be confirmed before launch.