What this tool holds, and for how long

AfricaNenda Foundation decides what this tool collects and why, and is accountable for it. It is established in Mauritius, at the address below, so Mauritian data protection law applies to it.

This notice is governed by the Mauritius Data Protection Act 2017 and, where applicable, the EU General Data Protection Regulation. Depending on where you are, other data protection laws may also give you rights in relation to your data.

AfricaNenda Foundation C1-402, 4th Floor, Block C Grand Baie La Croisette Grand Baie, Mauritius

Still to confirm: whether AfricaNenda Foundation is solely accountable for this data, or jointly with another organization. We would rather leave the question visibly open than assert sole accountability nobody has checked.

For anything on this page – a question, a correction, or a request to delete your submission – write to info@africanenda.org. We aim to respond within 21 working days.

What to include in your request

If your question is about how personal data is handled rather than about your own submission, or you are not satisfied with the answer you were given, write to our data protection officer at Dpo@africanenda.org.

Your answers are stored in your own browser, on your own device. They are not sent anywhere while you work, which is why you can close the tab and come back to them, and also why they will not appear if you switch to a different browser or a different machine.

A saved assessment is deleted from your browser automatically after 90 days. You can erase it sooner at any time using the Clear my data from this device link on the results page. That is worth knowing if you are using a shared workstation.

Generating the PDF sends your answers to our server, because that is where the document is rendered. They are used for that request and discarded. The report is not stored, not logged, and not sent anywhere else.

Sharing is optional and never automatic. Nothing is recorded unless you press the button on the results page, and the page tells you what would be stored before you do.

We rely on your consent, given by pressing that button. You can withdraw it at any time by asking us to delete your submission, and withdrawing it costs you nothing: the assessment and the report are yours either way.

If you share, we keep:

• Your institution’s name and country, if you gave them
• Your scores, your gender maturity judgments and the calculated results
• Any evidence text you wrote, which is the only free text in the assessment
• A short reference code, so we can find your submission if you ask us to delete it
• The version of this notice that was in force when you shared

We do not collect:

• Your name or job title. There is no field for either, anywhere
• Your email address. We stopped collecting it once reports became download-only, because there was no longer a purpose to hold one for
• Your IP address. There is no column for it in our database

Submitting an assessment requires an invite code that AfricaNenda issues to a named institution, and the institution name on a stored assessment is fixed to the one that invite was issued for; it cannot be typed differently at submission. That confirms a valid invite was redeemed; it does not confirm that the named institution’s own staff personally completed it, so every stored assessment is still marked self-reported and unverified wherever we display it.

Submitting requires an invite code issued by AfricaNenda to a named institution. Issuing one creates an invite record – the institution name, and whatever contact email and name the issuing administrator entered for you – separately from any assessment. It is never joined onto or stored on the assessment row itself, so if you are both the named contact and the person who fills in the form, we hold your name and email in this separate record regardless of which table it technically sits in.

The contact email and name in an invite record are anonymized (removed) automatically 30 days after the invite is used, expires, or is revoked. The institution name and the record of when it was issued and used are kept indefinitely, as an audit trail.

The evidence fields are free text, and free text is where names end up: a colleague who ran a pilot, a customer who complained, someone involved in an internal incident. Please describe the practice rather than the people: “covered by the 2025 scheme rules” rather than anything that identifies an individual.

We ask because we would rather not hold it than have to protect it. Evidence text is visible only to AfricaNenda Foundation administrators, and is erased before the rest of the submission.

• Evidence text: 30 days. Erased automatically by a daily sweep. Your scores survive it, so the research value is kept without keeping the words.
• Everything else: 30 days. The submission is then deleted outright.
• An anonymous summary: kept indefinitely. Before a submission is deleted it is counted into a set of totals: how many assessments, how they scored, how many judged each principle. Those totals carry no institution name, no country and no free text, so they are not personal data and there is no reason to delete them. They are what the research is built from, and they are why the submission itself does not need to be kept.

Both deletions are enforced by a scheduled job rather than by intention. A retention period nothing acts on is not a retention period. The job will not delete a submission until the summary has counted it, so a failure delays deletion rather than losing the record.

We use three suppliers, and none of them uses this data for anything of their own:

• Supabase hosts the database where a shared assessment is stored.
• Vercel runs the site and the servers that render your report.
• Clerk handles sign-in for AfricaNenda Foundation’s own administrators. It holds no respondent data.

Still to confirm: where the database runs. The servers that run this site and render your report are in Frankfurt, Germany. The region of the database that holds a shared assessment has not been confirmed, and we would rather say so than name the wrong one. If you are outside it, sharing an assessment involves an international transfer, and you are entitled to be told where to. We will state it here.

We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or disclosure.

In the event of a breach affecting this tool’s data, we will assess whether any personal data was involved and, where it was, notify the Mauritius Data Protection Office without undue delay and affected individuals directly where the breach is likely to result in a high risk to their rights.

Quote the reference code shown when you shared it. Without it we cannot reliably identify your submission, because we do not hold anything else that connects it to you, which is a consequence of collecting so little, not an excuse.

Send it to info@africanenda.org. We will confirm when it is done.

The Mauritius Data Protection Act 2017 and, where applicable, the EU General Data Protection Regulation give you the right to ask what we hold about you, to have it corrected, and to have it deleted. Assessment data describes an institution rather than a person, so most of it is unlikely to be personal data at all, but anything identifying that ends up in an evidence box is, and those rights apply to it.

If you are not satisfied with how we handle a request, you can complain to the Data Protection Office in Mauritius, where AfricaNenda Foundation is established. If you are in the European Union, you may complain to your local supervisory authority instead.