The Institute
Data Protection
What we know about you, why, and what you can demand we erase.
A doctrine that places dignity and reciprocal responsibility at its centre cannot treat its readers' data any differently from the way it treats its Companions. This page states exactly what Tuzafrika collects, what it has never collected, and what you can ask it to erase.
It is written in application of the General Data Protection Regulation — Regulation (EU) 2016/679, known as the GDPR — and of the Belgian law of 30 July 2018.
What this site does not do
No tracking. No advertising cookies.
This point deserves to be stated before all the rest, because it is rare:
- This site installs no advertising tracker: no Google Analytics, no Facebook pixel, no Matomo, no audience measurement tool of any kind.
- It places no tracking cookie on your device. That is why you saw no consent banner on arriving: there is nothing to consent to.
- Your browsing is neither profiled, nor sold, nor passed on to advertising networks.
- No automated decision is taken about you.
- The site's fonts are hosted on our own servers: your browser contacts neither Google Fonts nor any other service to display our pages.
Should this ever change — if, for example, the Institute decided to measure its audience — this page would be amended before that came into service, not after.
Article 1
Who is responsible for your data
- TUZAFRIKA ASBL
- Non-profit association under Belgian law, incorporated on 25 May 2025.
Rue du Trône 1, 1000 Brussels, Belgium.
Company number: 1032.367.634
Contact: contact@tuzafrika.org
The Institute has not appointed a data protection officer: the law does not require it to, given the nature and volume of the processing described below. Your requests are handled by the administrative body.
Article 2
What we collect, and only that
What you write to us
When you write to contact@, plainte@ or alerte@tuzafrika.org, we receive your email address, your name if you give it, and the content of your message.
Legal basis: your approach constitutes consent for ordinary correspondence. For complaints and whistleblowing reports, the processing also answers the obligations the Institute has set itself in its Internal Rules of Procedure.
Retention: ordinary correspondence is kept for three years. Complaints and reports are kept for five years after the file is closed — that is the record proving the Institute did acknowledge receipt and examine the request.
Your subscription to the Letter
If you subscribe to the Tuzafrika Letter, we keep your email address and, if you give it, your first name.
Legal basis: your explicit consent, given by ticking the box on the form.
Retention: until you unsubscribe. Every mailing contains an unsubscribe link; one click is enough, with no justification required.
Your address serves only to send you the Letter. It is neither sold, nor rented, nor passed on to third parties for marketing purposes.
The server's technical logs
Like any website, the server automatically records the IP address, the date, the page requested and the browser type. These logs serve security and fault diagnosis — nothing else. They are not cross-referenced with the other data.
Legal basis: the Institute's legitimate interest in keeping its site in working order and defending it against attacks.
Retention: a few weeks, according to the host's automatic rotation.
Article 3
The whistleblowing channel
The alerte@tuzafrika.org channel calls for a clarification, because it exposes more than the others.
It is managed by the College of Founders. The content of a report, and the identity of whoever makes it, are disclosed to no other body of the Institute without the author's agreement, save where the law requires it. In accordance with the Internal Rules of Procedure, no sanction or reprisal may be taken against a person who reports in good faith.
You may write without giving your name. An anonymous report is examined like any other — the Institute will simply be unable to keep you informed of what follows.
One reservation, in honesty: email is not a secret channel. It passes through several servers and carries your sending address. If your safety depends on your anonymity, do not rely on it alone — ask for an oral relay through one of our field mediators, provided for in the Internal Rules of Procedure, which requires no written formality.
Article 4
Who else sees your data
No data is sold or exchanged. Three technical providers necessarily have knowledge of it, because they keep the infrastructure running:
The host of the site and of the mailboxes
Namecheap, Inc. hosts the Institute's website and email accounts. Its servers are located in the United States (Atlanta, Georgia).
Your messages and the server logs are therefore processed outside the European Union. This transfer is governed by the standard contractual clauses adopted by the European Commission, which the host applies to its European customers.
The Institute is examining the possibility of European hosting. This page will be updated if that transfer changes.
The service that sends the Letter
When the Letter becomes active, subscribers' addresses will be managed by Brevo, a French company whose servers are located in the European Union. Brevo acts as a processor: it does not use these addresses on its own account.
As long as subscription is not open, no address is collected by this route.
The interactive map's base layer
Only the Maps page calls on an outside service: its base map is loaded from OpenFreeMap, a free and open service operated by Hyperknot Software Kft., a company established in Hungary, in the European Union. To display the map, your browser necessarily passes your IP address to it.
According to its privacy policy, OpenFreeMap uses no cookies and no trackers, and does not log IP addresses, except during a security incident, for 30 days at most. It may rely on a content delivery network (Cloudflare).
If you do not visit the Maps page, no data is passed to it.
Beyond these three providers, your data is passed on only where the law requires it — under a judicial order, in particular.
Article 5
Your rights
The GDPR grants you rights that the Institute undertakes to honour without demanding any justification:
- Access — to know what data we hold about you, and to obtain a copy of it.
- Rectification — to have inaccurate information corrected.
- Erasure — to request the deletion of your data.
- Restriction — to request that a processing operation be frozen while it is contested.
- Objection — to refuse processing based on legitimate interest.
- Portability — to retrieve your data in a machine-readable format.
- Withdrawal of consent — at any time, without calling into question what was done before.
One honest limit: the Institute cannot erase a complaint or a whistleblowing report while the file is open, nor before the five-year retention period has elapsed. This is not a refusal of your right — it is the counterpart of the commitment made to the other parties to the file.
To exercise one of these rights, write to contact@tuzafrika.org. The Institute replies within one month.
Article 6
If you are not satisfied
Write to us first: most difficulties are settled through speech, and that is the path our doctrine recommends.
But this recourse replaces no other. You may at any time refer the matter to the Belgian supervisory authority, without informing us:
- Data Protection Authority
- Rue de la Presse 35, 1000 Brussels
www.dataprotectionauthority.be
contact@apd-gba.be
This policy faithfully describes the state of the site and of its processing operations at the date indicated. It will be amended if the processing changes, and the date below will be the one that counts.
Last updated: 27 September 2026.
This English text is provided for information. In the event of any discrepancy, the French version is the authoritative one.