PABRA Seed Actors Registry Privacy Policy

Who is Responsible for the Registry?

The Registry is operated by:

CIAT Tanzania

Address:

c/o Selian Agricultural Research Institute, Dodoma Road, P.O. Box 2704, Arusha, Tanzania

Email:

S.Kalemera@cgiar.org

For purposes of the Registry, this entity acts as the organization responsible for the collection, use, storage, publication, and management of information submitted through the platform.

Authorized members of CIAT’s Nairobi-based IT team may access information stored in the Registry where necessary to provide technical maintenance, security, troubleshooting, and operational support. Such access is limited to personnel who require it for these purposes and is subject to appropriate confidentiality, security, and data protection requirements. This technical support arrangement does not change the role of CIAT’s Tanzania office as the entity responsible for the operation of the Registry and the management of information submitted through the platform.

Information We Collect

Depending on the information provided, the Registry may collect:

• Organization or partner name;
• Organization type;
• Contact person name;
• Position or role;
• Sex;
• Region and district;
• Main and other crops;
• Annual average capacity in tonnes;
• Telephone number;
• Email address;
• GPS coordinates and other location information;
• Information submitted through communications with Registry administrators;
• Technical information generated through use of the platform.

Not all information is necessarily personal data. However, certain information may identify an individual directly or indirectly and will therefore be treated as personal data where applicable.

How We Collect Information

Information may be collected through:

Why We Use Information

Information is collected and used to:

• Operate and maintain the Registry;
• Publish actor profiles within the Registry;
• Facilitate business and professional connections;
• Increase visibility of participating actors;
• Respond to requests submitted by Registry participants;
• Improve the performance, functionality, and security of the platform;
• Comply with legal, regulatory, audit, and compliance requirements.

We will not use information for purposes materially different from those described in this Privacy Policy without an appropriate legal basis or additional consent where required.

Public Nature of the Registry

A core purpose of the Registry is to make participating actors visible to users.

Accordingly, information included in approved profiles may be publicly available through the internet.

Information published through the Registry may:

• Be viewed worldwide;
• Be accessed without registration or login requirements;
• Be copied, downloaded, shared, referenced, or indexed by third parties or internet search engines.

Users should only provide information that they are willing to make publicly available. While CIAT may remove information from the Registry upon request where appropriate, CIAT cannot guarantee the removal of information that has already been copied, shared, archived, or otherwise retained by third parties.

Business Information and Location Data

The Registry may include information that could be commercially sensitive, including:

• Contact information;
• Business capacity information;
• Operational information;
• Location information;
• GPS coordinates where provided.

Participants are responsible for determining what information they wish to provide and publish through the Registry.

Publication of such information occurs only on the basis of the applicable consent provided by the participant or authorized representative.

International Storage and Access

The Registry is hosted on cloud infrastructure located in Ireland.

As a result:

• Information may be stored and processed outside Africa;
• Information published through the Registry may be accessed internationally;
• Data may be transferred and processed across jurisdictions as necessary for operation of the Registry.

By participating in the Registry, individuals acknowledge that information may be stored, processed, and accessed outside Africa in accordance with applicable legal requirements.

Legal Basis for Processing

The Registry primarily relies on the consent provided by participants.

Where applicable, information may also be processed when necessary for:

• Operation and administration of the Registry;
• Compliance with legal obligations;
• Audit, compliance, security, and fraud prevention purposes;
• Protection of the legitimate interests of CIAT and Registry users, where permitted by law.

Accuracy and Authority

Individuals submitting information are responsible for ensuring that:

• The information provided is accurate;
• They are authorized to submit information on behalf of an organization;
• They have the necessary authority to provide personal information relating to other individuals where applicable;
• Appropriate permissions have been obtained before providing information relating to third parties.

CIAT may request reasonable evidence supporting such representations where necessary. CIAT does not independently verify the accuracy, completeness, or authority underlying all information submitted to the Registry and relies on the representations made by the submitting party.

Sharing of Information

Information may be shared:

• Through public publication on the Registry;
• With service providers supporting operation of the Registry who process information only on behalf of and under the instructions of CIAT, and who are subject to appropriate confidentiality and data protection obligations;
• With contractors acting on behalf of CIAT and subject to appropriate confidentiality obligations;
• Where required by law, regulation, judicial order, or lawful governmental request;
• As necessary to protect the rights, safety, security, or legitimate interests of CIAT or others.

CIAT does not sell personal data.

Data Retention

Information will be retained only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy.

Published profile information may remain in the Registry until:

• The participant requests removal;
• The information is no longer required for Registry purposes; or
• CIAT decides to remove the profile.

Consent records and related documentation may be retained after profile removal for legal, audit, compliance, and recordkeeping purposes.

Your Rights

Subject to applicable law, including the Tanzania Personal Data Protection Act, 2022, where applicable, you have the right to:

• Request access to information relating to you;
• Request correction of inaccurate or incomplete information;
• Request updates to your profile;
• Request deletion of your profile and associated information;
• Withdraw consent previously provided;
• Object to or request restriction of certain processing activities;
• Request information regarding how your data is being used;
• Submit a complaint to a competent authority.

Withdrawal of consent will not affect processing carried out before such withdrawal.

Please note that information previously copied, downloaded, shared, archived, or indexed by third parties may remain available outside the control of CIAT after removal from the Registry.

Security

CIAT implements reasonable administrative, technical, and organizational measures designed to protect information against unauthorized access, alteration, disclosure, misuse, or destruction.

However, no internet-based service or electronic storage system can guarantee absolute security.

Cookies and Analytics

Cookies are small text files that are stored on a user’s device when visiting a website.

The Registry uses them for one purpose: to generate aggregated and non-identifiable statistics regarding the use of the Registry, and only where the user has consented. The Registry does not require cookies to operate, and stores none for authentication, security, fraud prevention or performance purposes. A user’s cookie preference, and for administrators the sign-in session tokens, are held in the browser’s local storage rather than in cookies, and no response from the Registry’s servers sets a cookie of any kind.

• Cookies stored: two cookies set by Google Analytics. They allow a returning browser to be recognised as the same one, without identifying the person using it. Their exact names are listed in the Cookie Notice.
• Information collected: pages viewed; sessions, meaning the number of separate visits; approximate geographic origin at country, region and city level, derived from the user’s IP address; and device and browser category.
• Recipient: Google, which may process this information outside Africa in accordance with its own terms.
• Retention: Google retains event-level data for 2 months and user-level data for 14 months. The user-level period restarts each time the same user visits again, so it runs from a user’s most recent activity rather than from their first.

The Registry transmits no custom events, identifiers or parameters to Google. No organisation record, profile identifier or search term is sent.

For additional information regarding the technologies used by the Registry, users may contact CIAT using the contact details provided in this Privacy Policy.

For the cookies this site sets and to manage your preferences, see the Cookie Notice.

Messages sent through the contact form

This section describes how this site handles the contact form specifically. It is engineering-authored and is not part of Legal’s approved Privacy Policy text.

Contact Us

If you have questions regarding this Privacy Policy, wish to exercise your rights, or would like to request access, correction, update, or removal of information, please contact:

Contact person:

Sylvia Kalemera

Email:

S.Kalemera@cgiar.org

Address:

Tanzania Agricultural Research Institute (TARI), Selian Centre, Dodoma Road, Arusha, Tanzania

Telephone:

+255 768 508 976

Changes to this Privacy Policy

CIAT may update this Privacy Policy from time to time to reflect changes in the Registry, legal requirements, operational practices, or technological developments.

The most current version will be made available through the Registry. Continued participation in the Registry after any update becomes effective constitutes acknowledgment of the revised Privacy Policy.