Comprehensive Privacy Policy & Data Protection Notice

2. CATEGORIES OF PERSONAL DATA COLLECTED

• Basic Identification & Contact: Full legal name, primary telephone number, alternate phone, email address, and residential address/district.
• Special Category (Religious & Sacramental) Data: Parish unit of affiliation, Diocesan council (ADEC, BODEC, MADEC, KENDEC), Parish of Baptism, date of Confirmation, church society affiliations, and fellowship ministries.
• Biometric & Photographic Likeness: Frontal facial photograph captured via live camera or verified upload, processed for official CR80 Identity Cards and verification views.
• Demographic & Emergency Data: Exact date of birth (used for constitutional age validation), gender, marital status, emergency contacts, academic qualifications, and profession.
• System Telemetry & Audit Metadata: Role assignments, permission scopes, administrative review logs, suspension histories, IP connection timestamps, and action logs.

3. LEGAL BASIS FOR PROCESSING

We process your personal and sensitive data under explicit legal grounds:

1. Explicit Consent granted during registration and account creation.
2. Legitimate Ecclesiastical Activity of a recognized not-for-profit Catholic youth apostolate with religious aims.
3. Contractual / Constitutional Necessity to administer fellowship membership, maintain voter rolls, issue authenticated credentials, and record financial dues.

4. HOW WE USE AND DISCLOSE YOUR DATA

• Internal Administration: Data is partitioned using strict Role-Based Access Controls (RBAC) and Row-Level Security (RLS). Parish Officers only see local parish members; Diocesan Officers see diocesan scope; National Executives oversee national rolls; Finance Officers see financial dues only.
• Public Verification Disclosure: Scanning a member card's QR code directs to a public URL (/verify/[token]). This publicly displays: Photo, Full Legal Name, Parish Unit, Council, Membership Status (Active, Passive, Probation, Suspended), and Card Expiry.
• Strictly Shielded Data: Personal telephone numbers, home addresses, email addresses, emergency contacts, financial dues history, and exact date of birth are NEVER exposed via public verification.
• Absolute Prohibition on Sale: CYAF never sells, rents, or commercially trades member data or photographic records to any third party.

5. DATA RETENTION, SECURITY SAFEGUARDS & STATUTORY DELETION

• Section 5.01 — Security & General Retention: All web traffic is encrypted via TLS 1.3/HTTPS. Photos are stored in protected object storage buckets accessed via short-lived signed URLs. Database rows are isolated via Postgres Row-Level Security. Active & Passive member records are retained for historical diocesan roll continuity. Rejected applications are purged within 12 months.
• Section 5.02 — Statutory Account Deletion & 14-Day Verification Window: In accordance with the Sierra Leone Right to Access Information Act (2013) and the ECOWAS Supplementary Act on Personal Data Protection (A/SA.1/01/10), members retain the right to request erasure of their personal profile. Upon submission via the Member Portal, account deletion requests enter a mandatory fourteen (14) day statutory verification window administered by the Super Administrator to confirm absence of unfulfilled asset custody, pending disciplinary actions, or ecclesiastical audit discrepancies. During this period, account access is suspended. Following final confirmation, biometric facial photographs, contact details, emergency contacts, and authentication credentials are permanently and irreversibly purged from our systems.
• Section 5.03 — Financial Audit Retention Exception: In compliance with legal audit requirements and canonical accounting standards, all historical dues payments, dues card transactions, and official receipts (CYAF-REC-YYYY-XXXX) are retained permanently in the financial ledger under anonymized identifiers (Former Member [Record Expunged]). Personal identifying details are detached from the transaction ledger.

6. YOUR RIGHTS AS A DATA SUBJECT

• Right of Access: View your full profile anytime within the Member Portal (/portal).
• Right to Rectification: Request corrections to contact or personal information through your Parish Unit Secretary.
• Right to Withdraw / Archival: Submit written notice to your Parish Unit Executive and National Secretariat for record archival.
• Right to Complain: File formal grievances before the CYAF National Executive Council or relevant Sierra Leone statutory regulatory authorities.