[ 01 ]
Who is accountable for the processing
The Digital Transformation Project Management Unit (UGPTN), the implementing unit of the Democratic Republic of the Congo Digital Transformation Project (PTN-RDC, P180495) under the authority of the Ministry of Posts, Telecommunications and Digital Affairs, determines the purposes and means of the processing carried out on this site. It is accountable for that processing as data controller.
This processing is governed by Ordinance-Law No. 23/010 of 13 March 2023 enacting the Digital Code, by article 31 of the Constitution, which guarantees respect for private life and the confidentiality of communications, and by the undertakings given to the project's technical and financial partners — the International Development Association of the World Bank Group and the Agence française de développement.
- Data controller
- Digital Transformation Project Management Unit (UGPTN)
- Registered office
- 15 Avenue Pumbu — Immeuble H, Building B, 4th floor, Gombe, Kinshasa, Democratic Republic of the Congo
- Contacting the data controller
- info@ugptn.cd — with “data protection” in the subject line
[ 02 ]
What is collected, service by service
No data is requested in order to read this site. Each collection corresponds to a step initiated by the user and is limited to what that step requires in order to reach an outcome.
- Grievance redress mechanism (GRM)
- Identity where the complainant chooses to give it, contact details, province, subject and account of the grievance, attachments. Anonymous grievances are admissible: identification is never a condition for a case to be examined. The data is used to examine the case, refer it to the competent body and notify the outcome.
- Tracking a grievance
- The reference number issued at filing, and nothing else. It does not disclose the complainant's identity and does not allow it to be reconstructed.
- Tenders portal
- Identity of the firm and of its representative, contact details, administrative and tax documents, questions raised on a notice. The data is used to register bidders, to keep an auditable record of exchanges during bid preparation, and to evaluate offers.
- Contact form
- Name, contact details and subject of the request, for the sole purpose of replying to it.
- Newsletter
- Email address and reading language, kept until unsubscription.
- Technical logs
- IP address, timestamp, page requested and device type, generated automatically by the servers. They serve the security and availability of the service, not the analysis of visitor behaviour.
[ 03 ]
On what basis
Each processing operation rests on one of the following three bases, and on one only:
- The performance of a public-interest task — the grievance mechanism, the publication of procurement notices and the processing of applications arise from the project's implementation obligations and from the procurement rules applicable to World Bank financing.
- Consent — subscribing to the newsletter and using the contact form are voluntary steps, revocable at any time, without justification and without consequence for access to the other services.
- The security obligation — technical logs and information-system protection measures answer the requirements of the Digital Code on system security and service continuity.
[ 04 ]
The reinforced regime for SEA/SH reports
Reports concerning sexual exploitation and abuse or sexual harassment (SEA/SH) follow a distinct regime, stricter than the one applied to other grievances. It implements the survivor-centred approach set out in the World Bank Environmental and Social Framework, under Environmental and Social Standards 1 and 10.
The reporting channel records four items only: the nature of the incident as the person describes it in their own words, whether to their knowledge the alleged perpetrator is associated with the project, the age and sex of the survivor, and whether a referral to support services was made. No question is asked about the circumstances of the incident and no evidence is requested.
The survivor's identity is neither sought, nor retained, nor disclosed to the Unit, to the supervising ministry or to the funders. Case files are held separately from all other grievances, under named access restricted to the social safeguards specialist, and may not ground any disciplinary or contractual proceedings without the free and informed consent of the person concerned.
A referral to medical, psychosocial and legal services is offered in every case, whatever the outcome of the report and without the person having to enter into any proceedings.
[ 05 ]
Who has access to the data
Data is neither sold, nor rented, nor transferred for commercial or advertising purposes. Access is granted case by case, only to those whose handling of the file requires it.
- Unit staff
- Access limited to the relevant cluster: safeguards for grievances, procurement for tenders, communications for the newsletter. Authorisations are personal and reviewed whenever a staff member changes post.
- Supervising ministry and Steering Committee
- Aggregate statistics and the files on which they are called to decide. Under no circumstances SEA/SH reports.
- World Bank and Agence française de développement
- In the exercise of their supervision, audit and post-review functions over procurement, in accordance with the financing agreements. Grievance data is transmitted to them in aggregate form, save where the examination of a specific case requires otherwise.
- Technical service providers
- Hosting and email delivery, bound by confidentiality undertakings and holding no right of their own to use the data.
- Judicial authorities
- Upon a duly issued request, in the forms prescribed by law and within the limits of its subject matter.
[ 06 ]
Hosting and transfers outside the country
The site is hosted by Netlify, Inc. (San Francisco, United States of America) on a distributed infrastructure. Part of the data therefore transits and is processed outside the national territory.
These transfers are limited to what the operation of the service requires and are framed by the contractual undertakings entered into with the providers. Where public processing takes place is not a matter of detail: data sovereignty is one of the objectives of the digital foundations component, and the migration of public services to national hosting infrastructure is part of the project's investment programme. This policy will be revised as that migration proceeds.
[ 07 ]
How long data is kept
- Grievances handled by the GRM
- Three years from the closure of the case, then transfer to the project archives in anonymised form for monitoring and evaluation purposes.
- Procurement files and bidder accounts
- Throughout project implementation and for at least two years after the closing date of the financing, in accordance with the record-keeping obligations attached to World Bank financing and with audit requirements.
- Requests sent through the contact form
- Twelve months after the last reply given.
- Newsletter
- Until unsubscription, which takes effect immediately and unconditionally.
- Technical logs
- Six months, unless a security incident is under investigation.
- SEA/SH reports
- In accordance with the project's safeguards protocol, under the sole responsibility of the dedicated specialist and separately from any other file.
[ 08 ]
Security
The site is served exclusively over HTTPS. Forms are protected against automated submission, access to case files is personal and logged, and attachments are scanned before being stored.
No measure makes a system impregnable. In the event of a data breach liable to affect the rights of the persons concerned, the Unit will inform, as soon as possible, the competent public authority designated under the Digital Code and, where the risk warrants it, the persons concerned themselves.
[ 09 ]
Your rights, and how to exercise them
Any person whose data is processed by the Unit may, free of charge:
- obtain confirmation that their data is being processed, be told the purpose, and receive a copy of it;
- have inaccurate, incomplete or outdated data corrected;
- obtain the erasure of data whose retention is no longer justified;
- object to a processing operation on grounds relating to their particular situation;
- withdraw a consent previously given, without that withdrawal affecting what was done before it.
Requests are made in writing to the address given at the head of this policy, together with an element allowing the requester's identity to be established. A reply is provided within thirty days of receipt. Any refusal is reasoned and states the available avenues of recourse.
The right to erasure does not extend to records whose retention is required by public procurement archiving rules, by an audit obligation or by ongoing proceedings.
[ 10 ]
Cookies and trackers
This site sets no advertising cookies, uses no third-party audience measurement tool and carries out no profiling. It belongs to no advertising network and shares no browsing data for commercial purposes.
A single item is stored in the browser: the fact that the usage notice shown on first access has been read, so that it is not displayed again on every page. It remains on the device, is never transmitted to the server and disappears with the browser's data. The display language is carried in the page address and is not recorded at all.
[ 11 ]
Avenues of recourse
A disagreement about the processing of data is first settled with the Unit. The following avenues remain open, none of them conditional on another:
- The project's grievance redress mechanism
- A formalised internal route: acknowledgement of receipt, examination by the relevant cluster, and a reasoned reply within the stated deadline.
- The competent public data protection authority
- Designated under the Digital Code, it may receive any complaint, as may the Congolese courts.
- The World Bank's Grievance Redress Service
- Open to persons who consider themselves adversely affected by a Bank-financed project. The Inspection Panel may in addition be seized where the Bank's own policies are at issue.
[ 12 ]
Revision of this policy
This policy is revised whenever the site's services, the applicable legal framework or the funders' requirements change. The date of last revision appears at the head of the page. Any substantial amendment is announced on the home page for thirty days before taking effect.
