1. Introduction
The Sub-Saharan Africa Drug Prevention and Treatment Summit 2027 (“SSA-DPTS 2027”, “we”, “us”, or “our”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, and disclose your personal information when you interact with our website, register for the Summit, or otherwise participate in Summit-related activities.
This Policy is designed to comply with Rwanda’s Law No. 058/2021 of 13 October 2021 Relating to the Protection of Personal Data and Privacy (the “Rwandan Data Protection Law”), as well as other applicable data protection laws and best practices. By registering for or participating in SSA-DPTS 2027, you consent to the collection and processing of your personal data as described in this Policy.
2. Data Controller and Contact Information
For any questions, concerns, or requests regarding your personal data, please contact our Data Protection Officer (DPO) at: info@africandrugsumit.org.
3. Personal Data We Collect
We collect personal data that you voluntarily provide to us, as well as certain data automatically collected through your use of our website and services.
3.1 Data You Provide to Us
When you register for the Summit, submit an abstract, or otherwise interact with us, we may collect:
| Category | Examples |
|---|---|
| Identity Data | Title, first name, last name, preferred name, pronouns, date of birth |
| Contact Data | Email address, phone number, country of citizenship, country of residence/work |
| Professional Data | Organisation/institution, job title, department, organisational website, professional affiliations (e.g., ISSUP membership) |
| Registration Data | Registration category, primary and secondary thematic tracks, role at Summit, abstract submission details |
| Payment Data | Billing address, payment method, purchase order number (processed by our secure payment processor; we do not store full credit card details) |
| Special Requirements | Dietary preferences, accessibility/mobility requirements |
| Consent Records | Records of your consent to this Privacy Policy, media release, and communication preferences |
3.2 Data We Collect Automatically
When you visit our website, we may automatically collect:
| Category | Examples |
|---|---|
| Technical Data | IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform |
| Usage Data | Pages visited, time spent on pages, clickstream data, referral source |
| Cookies | We use cookies to enhance your experience and analyse website traffic. You can manage your cookie preferences through your browser settings |
4. Legal Basis for Processing
Under the Rwandan Data Protection Law, we process your personal data only where we have a lawful basis to do so. The legal bases we rely on include:
| Legal Basis | Examples |
|---|---|
| Consent | You have given clear consent for us to process your personal data for a specific purpose |
| Contractual Necessity | Processing is necessary for the performance of a contract (e.g., your registration for the Summit) |
| Legal Obligation | Processing is necessary for compliance with a legal obligation to which we are subject |
| Legitimate Interests | Processing is necessary for our legitimate interests (e.g., improving our services, ensuring event security), provided these are not overridden by your rights |
5. How We Use Your Personal Data
We use your personal data for the following purposes:
| Purpose | Data Used |
|---|---|
| Summit Registration and Administration | Identity, Contact, Professional, Registration Data |
| Abstract Submission and Peer Review | Identity, Professional, Abstract Data |
| Summit Communications | Contact Data (to send confirmation, logistical information, programme updates, and post-Summit materials) |
| Scientific Programme Organisation | Professional Data, Thematic Track Preferences |
| Payment Processing | Payment Data, Contact Data |
| Youth Programme Coordination | Date of Birth, Youth Participant Status |
| Accommodation and Logistics | Special Requirements, Dietary Preferences, Accessibility Needs |
| Delegate Networking | Name, Organisation, Professional Data (in the delegate list shared with participants) |
| Media and Promotional Purposes | Photographs and recordings from the Summit |
| Compliance and Security | All data as necessary to comply with legal obligations and ensure the security of the event |
6. Data Sharing and Disclosure
We do not sell your personal data. We may share your personal data with the following categories of recipients:
6.1 Summit Partners and Co-Organisers
We may share your data with co-convening organisations, including:
-
Host Government of Rwanda (Steering Committee)
-
National drug control authorities
-
Regional Economic Communities (EAC, SADC, ECOWAS, AU)
-
United Nations Office on Drugs and Crime (UNODC)
-
World Health Organization (WHO)
-
International Society of Substance Use Professionals (ISSUP)
-
Colombo Plan
-
East Africa Youth Forum Alumni Network
These partners use your data for Summit-related purposes consistent with this Policy.
6.2 Service Providers
We may share your data with trusted third-party service providers who assist us in operating the Summit, including:
-
Event registration and ticketing platforms
-
Payment processors
-
Email communication platforms
-
Abstract management systems
-
Venue and accommodation providers
-
Interpretation and translation services
These providers are contractually obligated to protect your data and may only use it for the specific services they provide.
6.3 Delegate List
With your consent, we may include your name, organisation, and job title in a delegate list shared with Summit participants for networking purposes.
6.4 Legal Requirements
We may disclose your personal data if required to do so by law, regulation, or legal process, or in response to lawful requests by public authorities.
7. International Data Transfers
As a regional Summit, your personal data may be transferred to, and processed in, countries outside Rwanda. We ensure that appropriate safeguards are in place for such transfers, including:
-
Transfers to countries with adequate data protection laws
-
Standard contractual clauses approved by relevant authorities
-
Other lawful transfer mechanisms
8. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements.
| Data Category | Retention Period |
|---|---|
| Registration Data | 3 years after the Summit (for follow-up, evaluation, and reporting) |
| Abstract Submission Data | 5 years (for publication and scientific record purposes) |
| Payment Records | 7 years (for accounting and tax compliance) |
| Photographs and Recordings | Indefinitely (for promotional and archival purposes) |
| Contact and Communication Data | 2 years after the Summit (for post-event follow-up) |
After the retention period expires, we will securely delete or anonymise your personal data.
9. Your Rights
Under the Rwandan Data Protection Law, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Right to Access | You have the right to request a copy of the personal data we hold about you |
| Right to Rectification | You have the right to request correction of inaccurate or incomplete personal data |
| Right to Erasure | You have the right to request deletion of your personal data, subject to certain exceptions |
| Right to Restriction | You have the right to request restriction of processing of your personal data |
| Right to Object | You have the right to object to processing of your personal data |
| Right to Data Portability | You have the right to request transfer of your personal data to another organisation |
| Right to Withdraw Consent | You have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal |
| Right to Lodge a Complaint | You have the right to lodge a complaint with the National Cyber Security Authority (NCSA) or other competent supervisory authority |
To exercise any of these rights, please contact us at info@africandrugsumit.org. We will respond to your request within a reasonable timeframe, in accordance with applicable law.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:
-
Encryption of data in transit and at rest
-
Access controls and authentication mechanisms
-
Regular security assessments and audits
-
Staff training on data protection
-
Incident response procedures for data breaches
In the event of a personal data breach, we will notify you and the relevant supervisory authority as required by law.
11. Children’s Data
We do not knowingly collect personal data from children under the age of 16 without the consent of a holder of parental responsibility. If you are a parent or guardian and believe we have collected personal data from your child without appropriate consent, please contact us.
12. Cookies
We use cookies and similar tracking technologies to enhance your experience on our website. You can control cookie preferences through your browser settings.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this Policy periodically.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact:
Data Protection Officer
SSA-DPTS 2027 Organising Committee
Email: info@africandrugsumit.org
+254 725 794820
You also have the right to lodge a complaint with the National Cyber Security Authority (NCSA) of Rwanda, the supervisory authority responsible for data protection.