Privacy Policy

Last updated: 1 November 2026

1. Who we are

Africa Recovery OÜ (“ARI”, “we”, “us”) is a company registered in the Republic of Estonia and is the data controller for personal data processed through this website.

• Controller: Africa Recovery OÜ
• Registered address: Sakala tn 7-2, 10141, Tallinn, Estonia
• Registry code: 17605799
• Email for privacy requests: info@africari.org

Because we are established in the European Union, our processing is governed by the EU General Data Protection Regulation (GDPR) and Estonian data protection law.

2. Scope of this policy

This policy covers the website africari.org in both its English and Arabic versions, our contact and volunteer forms, and our online shop. It does not cover third-party websites we link to, or offline programme activities governed by separate agreements with our partners.

3. What we collect and why

3.1 When you contact us

Our contact form collects your name, email address, subject and message, and the date and time of submission. We use this only to read and answer your message and to keep a record of the correspondence.

3.2 When you volunteer or offer a partnership

If you write to us about volunteering, partnership or research collaboration, we process the details you choose to send us — typically your name, contact details, professional background and areas of interest — in order to assess and respond to your offer.

3.3 When you place an order

When you buy a service from us we collect your first and last name, email address, billing address and country, the products and quantities ordered, the order total and currency, the payment method type, and the date and status of the order. Your order record is stored in our own database so that we can perform the service, issue your certificate, answer questions about the order and keep the accounting records the law requires.

We never receive or store your full card number, card expiry date or security code. Card data is captured directly by our payment processor, Stripe, in fields hosted by Stripe. We receive only a payment reference, the result of the transaction, and limited details such as the card brand and last four digits.

3.4 Technical data

Our hosting provider and caching layer record standard server log data: IP address, date and time of the request, the page requested, HTTP status, referring page and browser user-agent string. This is used to operate the site, investigate faults and defend against abuse and attacks.

3.5 Cookies

We use a small number of strictly necessary cookies and, beyond those, nothing without your consent. The details are in our Cookie Policy.

4. Legal bases for processing

• Consent (GDPR Art. 6(1)(a)) — when you send us a message, and for any non-essential cookies.
• Performance of a contract or steps prior to it (Art. 6(1)(b)) — to take and fulfil your order, issue your certificate and receipt, and handle refunds.
• Legal obligation (Art. 6(1)(c)) — to keep accounting and sales records, to meet consumer-law duties, and to comply with anti-money-laundering and sanctions obligations.
• Legitimate interests (Art. 6(1)(f)) — to keep the website secure and available, to prevent fraudulent payments, and to maintain internal records of our work. We balance these interests against your rights and you may object at any time.

5. Who we share data with

We do not sell personal data, and we do not rent, trade or share customer lists with other companies for their own purposes.

We use the following categories of service provider, each processing data on our instructions under a written agreement:

• Payment processing: Stripe and its European affiliates process payment data to complete your purchase, prevent fraud and meet financial-regulatory duties. Stripe acts as an independent controller for part of this processing; see the Stripe Privacy Policy.
• Hosting and infrastructure: our hosting provider stores the website, its database and its logs.
• Email delivery: the mail service that delivers receipts and replies from our domain.
• Web fonts: typography on this site is served by Google Fonts, which receives the IP address of a visitor’s browser in order to deliver the font files.

We may also disclose data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims.

6. International transfers

Some of our providers, including Stripe, process data outside the European Economic Area, including in the United States. Such transfers rely on the safeguards permitted by Chapter V of the GDPR — an adequacy decision of the European Commission, or Standard Contractual Clauses together with supplementary technical and organisational measures. You may ask us for details of the safeguards applied to a specific transfer.

7. How long we keep data

• Order, invoice and accounting records: seven years from the end of the financial year, as required by the Estonian Accounting Act.
• Contact and volunteer correspondence: up to 24 months after our last exchange, unless it becomes part of a programme or partnership record.
• Server logs: normally up to 12 months.
• Records of consent: for as long as the consent is relied upon, plus proof of consent and of its withdrawal.

When a retention period ends we delete the data or irreversibly anonymise it.

8. Your rights

Under the GDPR you have the right to request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability of data you provided to us, and to object to processing based on our legitimate interests. Where processing rests on consent, you may withdraw that consent at any time — withdrawal does not affect the lawfulness of processing already carried out.

To exercise any of these rights, write to info@africari.org. We answer within one month and may ask for information needed to verify your identity. There is no charge for a reasonable request.

If you believe we have handled your data unlawfully, you may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, info@aki.ee, or to the supervisory authority in your country of residence.

9. Children

This website is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us personal data, write to us and we will delete it.

10. Security

The site is served over HTTPS. Access to order records is restricted to the staff who need it and protected by individual accounts. Payment card data never reaches our servers. No system is perfectly secure; if a breach occurs that is likely to present a risk to your rights, we will notify the competent supervisory authority and, where required, you.

11. Changes to this policy

We may update this policy as our work, our systems or the law change. The date at the top of this page shows the current version, and material changes are announced here.

12. Contact

Questions about this policy or about how we handle your data: info@africari.org, or use our contact form.