Privacy Policy

The data controller is Passerelles Mauritanie, an independent, non-profit and non-partisan citizen association headquartered in Nouakchott, Islamic Republic of Mauritania.

For any question about your data: contact@passerellesmauritanie.com (subject “Personal data”). The General Secretariat answers on behalf of the Bureau.

Data you give us:

• identity and contact: first and last name, name in Arabic script, email, phone / WhatsApp, country and city of residence;
• professional profile: organisation, profession, field of expertise, skills, biography, photo;
• involvement: chosen Passerelles, types of contribution, ideas and proposals, mentoring application;
• association life: event registrations, attendance, votes and proxies at assemblies, comments, messages;
• payments: amount, date, method and reference of donations and dues (card numbers are handled only by our payment provider, never by us).

Data created automatically: sign-in and security data (sign-in time, IP address, browser type, failed attempts, two-step verification status), audit log of administrative actions, language and display preferences.

We collect no sensitive data (health, political opinions, religious beliefs, ethnic origin…) and ask you not to enter any in free-text fields.

• Managing your membership and association life (approval, dues, notices, votes, Passerelles) — performance of the membership agreement and the Statutes.
• Skills Bank and introductions (mentoring, projects, opportunities) — your consent, given when you join and withdrawable at any time from your profile.
• Communicating with you by email, WhatsApp, SMS or notification — the association’s legitimate interest, following the preferences you set under “Notifications”.
• Receiving and accounting for donations and dues — legal and accounting obligations.
• Securing the site and accounts (fraud and bot prevention, logging) — legitimate interest and security obligation.
• Publishing the leadership page and Passerelle leads — consent of the people concerned.

We never sell, rent or trade your data. We do no targeted advertising or profiling.

Access follows the principle of least privilege, with roles checked by the server on every action:

• other members see only what you make visible;
• the Secretariat manages memberships, events and communications;
• the Bureau additionally sees finances and the Skills Bank;
• administrators manage roles and security.

Every administrative action is recorded in an audit log.

We use providers (“processors”) that handle data on our behalf, under contract and only on our instructions:

• Vercel Inc. (website hosting, USA);
• Supabase Inc. (database, hosted in the USA — Oregon region);
• Zoho / ZeptoMail or Resend (email delivery);
• Stripe (online payment of donations and dues);
• Meta Platforms (WhatsApp Business) and Twilio (SMS), if you accept these channels;
• Cloudflare (bot protection), when enabled;
• Google Fonts (typefaces);
• Anthropic (Charter assistant and translation help; no member data is sent).

Some providers are outside Mauritania and the European Union. These transfers rely on appropriate safeguards (European Commission standard contractual clauses, the EU-US Data Privacy Framework where applicable) and, under Mauritanian law, the formalities required by the national data protection authority.

• Account and profile: during membership, then 3 years after leaving (unless you ask for earlier deletion);
• applications not completed: 12 months;
• donations, dues and accounting records: 10 years (accounting obligation), without your name if you delete your account;
• minutes, votes and assembly decisions: for the life of the association (archives);
• security and sign-in logs: 12 months;
• sign-in sessions: 14 days maximum;
• messages and notifications: 24 months.

• encrypted connections (HTTPS/TLS, HSTS) across the site and encryption at rest at our database provider;
• passwords never stored in clear (bcrypt hashing), password rules following NIST guidance and screening against breached passwords (your password is never transmitted);
• optional two-step verification (authenticator app and recovery codes);
• sign-in throttling, temporary lockout and bot checks;
• Content Security Policy, secure cookies and session-hijacking protections;
• private documents served only after the access level is checked;
• audit log and regular review of roles.

No system is infallible: if a data breach puts you at risk, we will inform you promptly and notify the competent authority.

You have the rights of access, rectification, erasure, restriction, objection, portability, and to withdraw consent at any time.

Most can be exercised online:

• My profile to correct your information;
• Notifications to choose your channels;
• My data to download a full copy of your data or delete your account;
• Security to manage your password, two-step verification and signed-in devices.

For anything else, write to contact@passerellesmauritanie.com; we reply within 30 days. You may also contact Mauritania’s personal data protection authority or, if you live in the EU/UK, your national authority.

Membership is reserved for adults. School-support activities involve pupils, but the site creates no accounts for them: only non-identifying information (class, numbers, sessions) is recorded.

The site uses only cookies needed for it to work and keep you safe, plus a language-preference cookie. It uses no advertising cookies and no audience-measurement tools. Details and settings: see the Cookie Policy.

We may update this policy as our activities or the law change. The date of the last update is shown at the top; members are told of significant changes by email or notification.

Passerelles Mauritanie — General Secretariat Nouakchott, Islamic Republic of Mauritania contact@passerellesmauritanie.com