AHDRC is committed to protecting the privacy of visitors and members of its archive. We comply with the EU General Data Protection Regulation (GDPR) and with Belgian data protection law. This page sets out how we handle personal data, in language we hope is plain enough to be useful.
1. Who we are
The African Heritage Documentation & Research Centre (AHDRC) is a non-profit organisation registered in Brussels, Belgium. References to "we", "us" and "our" in this policy refer to AHDRC. We act as the data controller for personal information processed through this website.
2. Scope
This Privacy Policy explains how we collect, use, share and safeguard personal data when you visit ahdrc.org, register for an account, contact us, or otherwise interact with our services. It applies to all visitors, members, sponsors and research partners.
3. Information we collect
Account data: email address, name, professional category, password hash and, where enabled, two-factor authentication credentials.
Usage data: limited first-party server logs needed to operate and secure the public website. AHDRC does not currently set analytics, advertising or profiling cookies.
Communications: messages you send via the contact form, support enquiries and correspondence with our team.
Contact-form messages are transmitted directly to AHDRC by email. The website application does not store contact submissions in its database, files, session, cookies or browser storage; the resulting email is retained according to AHDRC's correspondence practices.
Payment data: handled exclusively by our payment processor; we never store full card numbers on our servers.
4. How we use your data
To operate the archive, authenticate members, provide search functionality and personalise features such as Recently Viewed.
To respond to enquiries, process subscriptions, fulfil sponsorship arrangements and send transactional emails.
To maintain the security of the platform, detect abuse and meet our legal obligations.
To produce aggregate, non-identifying statistics about how the archive is used by the scholarly community.
5. Legal bases (GDPR)
Performance of a contract: providing access to the archive and processing your subscription.
Legitimate interest: maintaining platform security, preventing fraud, improving the quality of our service.
Consent: optional newsletter subscription where offered. Optional analytics or other non-essential cookies are not currently set and would require prior consent before introduction.
Legal obligation: retaining accounting records, responding to lawful requests.
6. Sharing and transfers
We do not sell or rent personal data. We share data only with vetted processors strictly necessary to operate the service (hosting, email delivery, payments, error monitoring), under written data processing agreements.
Where data is transferred outside the European Economic Area, we rely on Standard Contractual Clauses or equivalent safeguards approved by the European Commission.
7. Retention
Account data is kept for as long as your account is active and for up to 24 months after closure to allow reactivation and to comply with legal obligations. Server logs are kept for a maximum of 12 months. Invoicing data is kept for the period required by Belgian tax law.
8. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your personal data, as well as to lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).
To exercise these rights, write to legal@ahdrc.org. We respond within one month.
9. Cookies and local storage
We use first-party necessary cookies for member authentication, session security and two-factor authentication. The authentication cookie is a browser-session cookie unless the user explicitly selects “Remember me”, in which case it may persist for up to 14 days with security-stamp validation. Pending 2FA challenge cookies last 5 minutes, and remembered 2FA-device cookies last up to 14 days after a successful authenticator challenge.
Antiforgery security cookies protect forms for the browser session. The language preference cookie stores the selected language for a maximum of 6 months. The theme preference is stored in local storage, not a cookie, until changed or browser storage is cleared.
AHDRC currently does not set optional analytics, advertising or profiling cookies. Optional cookies or similar browser storage will require prior consent before being introduced. See the Cookie and Local Storage Policy for the exact names, purposes and durations.
10. Security
We protect personal data with encryption in transit (TLS 1.2+), encryption at rest for sensitive fields, hashed passwords, role-based access control, audit logs and regular dependency review. Two-factor authentication is strongly recommended for all members.
11. Changes to this policy
We may update this policy to reflect changes in our practices or in applicable law. The date of the last revision is shown at the top of this page. Material changes will be communicated by email or by a banner on the website.
12. Contact
AHDRC NPO, Brussels, Belgium. For any privacy-related question, contact legal@ahdrc.org.