Data Protection and Privacy Notice

1Introduction

CapSha is committed to processing data fairly, with integrity, responsibility, security, and transparency. We process personal data in accordance with CapSha’s Data Protection Policy (DPP) and related internal procedures. Where applicable, we also take into consideration relevant legal, regulatory, and contractual obligations. This means we handle information in line with CapSha’s own Data Protection Policy (DPP) and not under any national, regional jurisdiction. We process data only for legitimate purposes related to the mandate of the initiative, and we apply the highest standards to safeguard your privacy. CapSha may provide this Notice in different formats. In situations where data is collected offline or verbally (for instance, via phone or in person during field projects), we will inform you of the key points of this Notice and let you know how to access the full text for more details. Regardless of how we collect your data, we handle it according to the principles in this Notice.

2Scope

This Notice applies to all personal data that CapSha collects in the below contexts. It covers the data of:

1. Website Users: individuals visiting CapSha websites and users who interact with CapSha’s official social media pages.
2. Event Participants: individuals registering for or attending CapSha events, conferences, webinars, workshops, or training sessions.
3. Visitors to CapSha Premises: personnel and guests entering CapSha premises, offices, or facilities.
4. Newsletter Subscribers: individuals subscribing to CapSha newsletters, email updates, or mailing lists.
5. Platform/Database Users: individuals creating accounts for CapSha repositories, databases, forums, or managed online systems.
6. Contest or Survey Respondents: individuals participating in contests, competitions, surveys, and questionnaires.
7. Media Subjects: individuals whose images, video, audio, or voice are captured during CapSha activities.
8. Project Beneficiaries: individuals whose personal data is collected in CapSha field projects or programmes.
9. Project Partners: where a partner processes data on CapSha’s behalf under an agreement with data-processing terms, this Notice and CapSha’s instructions apply.

This Notice also applies when CapSha obtains personal data about individuals from third-party sources. Specific platforms may present additional terms or privacy information. Third-party websites linked from CapSha are governed by their own privacy policies. This Notice concerns personal data about identifiable individuals.

3What data we collect and how

The type of information we collect depends on your interaction with CapSha. We only ask for information relevant and necessary for the stated purpose. This may include your full name, title, affiliation, postal address, email address, telephone number, and country.

• When you contact CapSha, we collect details needed to respond.
• When you subscribe, we collect your email address and possibly your name.
• When you register for an event or training, we collect information needed to manage participation.

Account information

If you create an account, we collect credentials and information needed to establish and maintain it.

Survey or contest responses

We collect responses, submissions, feedback, and any personal data you voluntarily provide.

Media

With your consent, we may collect photographs, video, audio, or voice and may request a Consent & Release Form.

Professional or background information

We may request professional qualifications, a CV, expertise, or publications when relevant.

Project beneficiaries

We may collect information needed to establish eligibility, deliver assistance, monitor a project, or obtain feedback.

Automatically collected data

Our websites and platforms may collect IP address, browser type, operating system, referring website, pages accessed, dates and times, cookies, and similar technical information.

Users may manage cookie preferences through their browser settings. Certain website functions may be affected if cookies are disabled.

Data from other sources

CapSha may receive data from partners or other authorized sources and will handle it according to this Notice.

4Why we collect your data

CapSha collects and uses data only for purposes aligned with our mandate and the service provided.

1. Responding to inquiries and requests.
2. Facilitating participation in events and activities.
3. Providing access to platforms and services.
4. Sending requested newsletters and announcements.
5. Delivering assistance and managing projects.
6. Conducting surveys, contests, and feedback activities.
7. Sharing impact stories with consent.
8. Analysing and improving websites and services.
9. Other mission-related purposes disclosed at collection.
10. Ensuring security of premises and systems.

CapSha processes personal data based on consent, contractual necessity, legitimate organizational interests, fulfillment of its mandate, or other grounds permitted under its Data Protection Policy.

5Who has access to your data and how we share it

Within CapSha

Access is restricted to authorized personnel who need the information for the purposes described. Personnel and collaborators are subject to confidentiality obligations and access controls.

Third-party partners and service providers

CapSha may share the minimum necessary information with trusted implementing partners.

• Partners receive only information necessary for their assigned task.
• Partners must handle information confidentially and securely.
• CapSha does not sell, rent, or trade personal information.

6How long we keep your data

CapSha retains personal data only for as long as necessary for the purpose for which it was collected and according to internal retention rules.

• One-time event or inquiry data may be deleted or anonymized after follow-up is complete.
• Subscriber and account information is retained while the subscription or account remains active.
• CapSha periodically reviews, securely erases, destroys, or anonymizes data no longer required.

Data may be retained longer for compliance, auditing, archiving, research, statistics, or protection of CapSha’s rights, with appropriate safeguards. It will not be kept indefinitely.

7How we protect your data

CapSha uses technical, physical, and organizational measures to prevent unauthorized access, disclosure, alteration, or destruction.

• Secure infrastructure, encryption where applicable, firewalls, and monitoring.
• Need-to-know access controls.
• Training, policies, and confidentiality requirements.
• Incident and data-breach response procedures.

Controls are reviewed and updated in line with CapSha rules, industry practices, and applicable international standards.

Where appropriate, CapSha may notify affected individuals of significant data-security incidents in accordance with its internal procedures.

8Requests related to your data

Under CapSha’s DPP, you may submit requests concerning personal data held about you.

1. Access: request confirmation and a copy of your personal data.
2. Correction: request correction of inaccurate or incomplete data.
3. Deletion: request erasure where there is no overriding reason to retain the data.
4. Objection or withdrawal of consent: object to processing or withdraw consent where applicable.

Requests may be subject to limitations under CapSha’s rules. CapSha will respond and explain any refusal or limitation.

Personal data may be accessed or processed in multiple countries where CapSha, CGIAR centers, or authorized service providers operate. Appropriate safeguards are applied to protect personal data.

9How to submit a request or contact us

To submit a request, question, concern, or complaint about personal data, use the CapSha Contact Support page at Contact Us Page and select the appropriate option. CapSha may need to verify your identity before fulfilling certain requests. We will respond within a reasonable timeframe in accordance with our internal procedures.

10Changes to this data protection and privacy notice

CapSha may update this Notice to reflect legal requirements, improvements in data-protection practices, or operational changes. Significant changes may be communicated prominently. The latest revision date appears at the top of the Notice.

11Privileges and immunities & applicable law

Nothing in this Notice shall be construed as a waiver of CapSha’s privileges or immunities or as acceptance of the jurisdiction of national courts. CapSha is a CGIAR initiative governed by its own internal legal framework, including its Data Protection Policy and related procedures, together with general principles of international law.