Privacy Policy Legal Notice

Blessed to Impact (hereinafter "BTI," "the Organisation," "we," "us," or "our") is a non-profit association ("Association Sans But Lucratif" or "ASBL") duly incorporated and existing under the laws of the Republic of Burundi. BTI operates exclusively for charitable, educational, and community development purposes consistent with its stated mission and the provisions of Burundian law governing non-profit entities.

This Privacy Policy and Legal Notice ("Policy") constitutes a binding legal document governing the collection, processing, storage, and disclosure of personal data by BTI in connection with its programs, fundraising activities, website operations, and communications with donors, partners, beneficiaries, volunteers, and other stakeholders.

This Policy applies to all natural persons whose personal data is processed by BTI, including without limitation: (a) individual and institutional donors; (b) corporate and philanthropic partners; (c) program applicants and participants, including beneficiaries of the BTI Academy, Sponsorship Fund, and Youth Entrepreneurship Support Program; (d) volunteer mentors and pro bono contributors; (e) media and research contacts; (f) website visitors; and (g) any other persons who provide personal data to BTI through any channel.

Where BTI processes personal data relating to minors or vulnerable individuals — including program beneficiaries who are school-aged children or marginalised youth — heightened data protection standards apply as set out in Section 10 of this Policy.

BTI collects personal data directly provided by data subjects through the following channels: online and offline contact forms; program application processes; donation transactions; newsletter subscription; email and telephone correspondence; in-person interactions at events and outreach activities; and referrals from third parties (e.g., teachers, community leaders, partner organisations).

Categories of personal data collected include: identification data (full name, date of birth where required); contact data (email address, telephone number, postal address); professional and organisational data; financial data relating to donations (transaction reference, amount, payment method — but not payment credentials, which BTI does not store); socioeconomic and household data collected solely for program eligibility assessment; and correspondence and communication records.

BTI's website may automatically collect technical data including: IP address; browser type and version; operating system; referral URL; pages visited and time spent; and device type. Such data is processed on the basis of legitimate interest for website security and performance optimisation, and does not constitute profiling of individual users.

BTI processes personal data only for the following specified, explicit, and legitimate purposes: (a) administration of donor relationships, including processing contributions, issuing receipts, and providing impact reporting; (b) delivery of program activities, including eligibility assessment, participant matching, and progress monitoring; (c) fulfilment of communications obligations to newsletter subscribers and registered stakeholders; (d) organisational administration, including financial audit, legal compliance, and board reporting; (e) improvement of program design and website functionality through aggregated, anonymised analysis; and (f) compliance with applicable legal and regulatory obligations.

BTI does not engage in automated decision-making, algorithmic profiling, or any processing of personal data for commercial, advertising, or non-mission-related purposes. The legal basis for processing is, as applicable: consent; contract performance; legitimate interests; or compliance with a legal obligation.

BTI does not sell, rent, lease, or otherwise transfer personal data to third parties for commercial purposes. Disclosure of personal data is limited strictly to: (a) BTI staff and board members with a legitimate operational need; (b) data processors engaged by BTI under written data processing agreements (e.g., email service providers, payment platforms, cloud storage providers) who act solely on BTI's documented instructions; (c) program participants and donors where explicit prior informed consent has been obtained by both parties for the purpose of facilitated introduction; and (d) competent authorities, courts, or regulatory bodies where disclosure is required by applicable law, court order, or regulatory obligation.

No personal data is transferred to third-party marketing platforms, advertising networks, data brokers, or any entity whose processing is unrelated to BTI's charitable purposes.

Personal data is retained by BTI for no longer than is necessary for the purposes for which it was collected, subject to the following minimum retention periods required by law or legitimate organisational need: (a) donor financial records — seven (7) years from the date of the transaction, in accordance with applicable financial record-keeping obligations; (b) program participant records — duration of program participation plus three (3) years post-completion for alumni follow-up and longitudinal impact assessment; (c) email marketing subscriber data — until unsubscription, subject to periodic re-consent review every twenty-four (24) months; (d) general correspondence — twelve (12) months from last contact unless an ongoing relationship exists. Upon expiry of applicable retention periods, personal data is securely deleted or anonymised.

Notwithstanding that BTI is established in the Republic of Burundi and is not directly subject to the European Union's General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR") or the United Kingdom General Data Protection Regulation ("UK GDPR"), BTI voluntarily adopts GDPR-equivalent data protection standards as a matter of policy and organisational commitment to best practice.

Data subjects located in the EU/EEA or UK may exercise the following rights as provided under Articles 15–22 GDPR: (a) Right of Access (Art. 15); (b) Right to Rectification (Art. 16); (c) Right to Erasure (Art. 17); (d) Right to Restriction of Processing (Art. 18); (e) Right to Data Portability (Art. 20); (f) Right to Object (Art. 21); and (g) Rights related to Automated Decision-Making (Art. 22, though BTI does not engage in such processing). BTI shall respond to all rights requests within thirty (30) calendar days. Where requests cannot be fulfilled, BTI shall provide a reasoned explanation.

Where international data transfers occur (e.g., use of cloud-based service providers), BTI implements appropriate safeguards consistent with Chapter V GDPR, including Standard Contractual Clauses where applicable.

All data subjects whose personal data is processed by BTI retain the following rights, exercisable at any time without charge and without detriment to any existing relationship with BTI: (a) the right to request confirmation of whether BTI processes personal data relating to them and, if so, to obtain a copy thereof; (b) the right to request correction of inaccurate or incomplete personal data; (c) the right to request deletion of personal data where the basis for processing no longer applies, subject to retention obligations mandated by law; (d) the right to withdraw consent at any time, without affecting the lawfulness of processing conducted prior to withdrawal; (e) the right to opt out of donor communications and marketing correspondence; and (f) the right to lodge a complaint with a competent data protection supervisory authority.

BTI's website utilises only technically necessary cookies essential to the delivery of core website functionality. No third-party advertising cookies, behavioural tracking cookies, or persistent cross-site tracking mechanisms are deployed. Where analytics tools are used, data is processed in aggregated, anonymised form and does not permit identification of individual users. Consent for non-essential cookies, should they be introduced in future, will be obtained through a compliant consent management mechanism prior to deployment.

Users retain the right to refuse, delete, or limit cookies at any time through their browser settings. BTI accepts no liability for diminished website functionality resulting from such cookie restrictions.

BTI communicates with donors, subscribers, and stakeholders on a consent-based or legitimate interest basis. Transactional communications (e.g., donation receipts, program enrollment confirmations) do not require separate consent and will be issued as necessary. Marketing and informational communications (e.g., the BTI Chronicle newsletter, impact reports, event notifications) are sent only to individuals who have affirmatively opted in to such communications.

All marketing communications include a conspicuous unsubscribe mechanism. Requests to unsubscribe will be processed within five (5) business days. BTI does not engage in unsolicited commercial communications and does not share subscriber lists with third parties for marketing purposes.

Given the nature of BTI's beneficiary population — which includes minors and socioeconomically vulnerable youth — BTI applies heightened data protection standards to all personal data relating to program participants below the age of 18. Processing of personal data of minors is conducted only with the prior informed consent of a parent or legal guardian, and is limited strictly to data necessary for program delivery and support.

Photographic, video, or testimonial content featuring minor participants or identifiable vulnerable adults is collected and published only under a separate, specific written consent framework, including clear explanation of intended use, distribution channels, and the right to withdraw consent at any time. Identifying information relating to beneficiaries is not disclosed in public-facing materials without explicit individual or guardian consent.

BTI reserves the right to modify this Policy at any time. Material changes — defined as changes that substantively affect the rights of data subjects or the nature of data processing — will be communicated to registered donors and subscribers via email no fewer than fourteen (14) calendar days prior to their effective date. Non-material updates (e.g., editorial clarifications) may be implemented without prior notice. The version number and effective date at the head of this document will be updated upon revision. Continued engagement with BTI following notification of material changes constitutes acceptance of the revised Policy.

All enquiries, rights requests, and complaints relating to the processing of personal data by BTI should be directed in the first instance to BTI's designated Privacy Officer. BTI is committed to resolving data protection complaints promptly and in good faith. Where a complaint cannot be resolved to the satisfaction of the data subject, they retain the right to escalate the matter to the appropriate data protection supervisory authority in their jurisdiction of residence.