Privacy Policy
The EPMA Web Application (the “Platform”)
This Privacy Policy explains how Ethiopia Performance Monitoring for Action(“EPMA”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal data when you access or use the EPMA web application (the “Platform”). The Platform serves as a resource for news and updates, publications, a data-access portal, and a data-visualization tool. We are committed to protecting your privacy and handling your personal data lawfully, fairly, and transparently.
Because users of the Platform may be located anywhere in the world, this Policy is drafted to align with the Federal Democratic Republic of Ethiopia’s Personal Data Protection Proclamation No. 1321/2024 and with international frameworks such as the EU General Data Protection Regulation (GDPR). The specific rights available to you depend on the laws applicable in your jurisdiction.
1.Who We Are (Data Controller)
EPMA is the data controller responsible for your personal data processed through the Platform. If you have any questions about this Policy or how we handle your personal data, you can contact us using the details below:
Controller: Ethiopia Performance Monitoring for Action (EPMA)
Institutional Host: School of Public Health, College of Health Sciences
Address: Addis Ababa University, School of Public Health, Addis Ababa, Ethiopia
Data protection / privacy contact: contact@e-pma.org.et
2.Scope of This Policy
This Policy applies to personal data we process about visitors to and registered users of the Platform, including individuals who browse public content, create an account, or request access to EPMA data. It does not apply to third-party websites or services that may be linked from the Platform, which are governed by their own privacy policies.
3.Personal Data We Collect
We collect the following categories of personal data:
3.1 Account registration data
When you create an account to request access to EPMA data, we collect information such as your full name, email address, password (stored in encrypted form), organization or institutional affiliation, professional role, and country of residence.
3.2 Data-access request information
When you submit a request to access EPMA data, we collect the information needed to evaluate your request, which may include the datasets or resources requested, the stated purpose and intended use of the data, your project or research description, and any supporting documentation you choose to provide.
3.3 Technical and usage data
When you use the Platform, we automatically collect technical information such as your IP address, device and browser type, operating system, referring pages, the pages and resources you view, dataset queries and downloads, and the dates and times of your activity. This information is collected through server logs and similar technologies.
3.4 Cookies and analytics data
We use cookies and similar technologies to operate the Platform, remember your preferences, maintain your session, and understand how the Platform is used. See Section 6 for details.
3.5 Communications
If you contact us for support, subscribe to news or updates, or otherwise communicate with us, we collect the content of your messages and your contact details.
4.How We Collect Personal Data
- Directly from you: when you register, submit a data-access request, subscribe to updates, or contact us.
- Automatically: when you interact with the Platform, through server logs, cookies, and analytics tools.
- From third parties: where applicable, from identity or authentication providers you use to sign in, or from your institution where it sponsors your access.
5.Purposes and Legal Bases for Processing
We process your personal data for the following purposes and on the following legal bases:
- To create and manage your account and authenticate you: necessary for the performance of the Terms of Use (contract) and our legitimate interests in operating the Platform.
- To evaluate, grant, manage, and monitor data-access requests: necessary for the performance of our agreement with you and for the performance of a task carried out in the public interest / exercise of EPMA’s official authority.
- To communicate with you, respond to enquiries, and send service or news updates you have requested: based on your consent and/or our legitimate interests.
- To secure the Platform, prevent misuse, and enforce our Terms of Use: based on our legitimate interests and legal obligations.
- To analyze and improve the Platform and understand usage: based on your consent (for non-essential cookies) and our legitimate interests.
- To comply with legal obligations and respond to lawful requests from authorities: based on compliance with a legal obligation.
Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
6.Cookies and Similar Technologies
The Platform uses strictly necessary cookies required for it to function (for example, to keep you logged in and to secure your session) and, where you consent, analytics and preference cookies that help us measure usage and remember your settings. You can control non-essential cookies through your browser settings or any cookie banner we provide. Disabling strictly necessary cookies may prevent parts of the Platform from working.
7.How We Share and Disclose Personal Data
We do not sell your personal data. We may share it only as described below:
- Service providers: with trusted vendors who host, maintain, secure, or support the Platform, under contracts that require them to protect your data and use it only on our instructions.
- Within EPMA: with authorized EPMA personnel who need the data to review data-access requests, provide support, or administer the Platform.
- Legal and regulatory: where required by law, court order, or a lawful request from a competent authority, or to protect the rights, safety, and property of EPMA, our users, or the public.
- Successors: in connection with a reorganization or transfer of EPMA functions, subject to appropriate safeguards.
8.International Data Transfers
EPMA is based in Ethiopia, and your personal data may be stored and processed in Ethiopia and in other countries where our service providers operate. Because our users may be located anywhere, your data may be transferred across borders. Where personal data is transferred internationally, we take steps to ensure it is protected by appropriate safeguards consistent with applicable data-protection law.
9.Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy, including to maintain your account while it is active, to administer data-access approvals, to comply with legal, accounting, or reporting obligations, and to resolve disputes. When personal data is no longer needed, we delete or anonymize it. Retention periods may vary depending on the type of data and the applicable legal requirements.
10.How We Protect Your Data
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, and destruction. These include encryption of credentials, access controls, secure hosting, and monitoring. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.
11.Your Rights
Depending on your jurisdiction and applicable law, you may have some or all of the following rights in relation to your personal data:
- Access: to obtain confirmation of whether we process your data and a copy of it.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to request deletion of your data in certain circumstances.
- Restriction and objection: to restrict or object to certain processing.
- Portability: to receive certain data in a structured, commonly used, machine-readable format.
- Withdraw consent: where processing is based on consent.
- Lodge a complaint: with the competent data-protection authority in your jurisdiction.
To exercise any of these rights, contact us using the details in Section 15. We may need to verify your identity before responding, and we will respond within the timeframes required by applicable law.
12.Children’s Privacy
The Platform is intended for use by adults and by professionals, researchers, and institutions. It is not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.
13.Third-Party Links and Content
The Platform may contain links to external websites, datasets, or services not operated by EPMA. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing them with your data.
14.Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated version on the Platform and revise the “Last updated” date above. Where required by law, we will notify you of material changes. Your continued use of the Platform after an update constitutes acceptance of the revised Policy.
15.How to Contact Us
If you have questions, concerns, or requests regarding this Policy or your personal data, please contact:
Ethiopia Performance Monitoring for Action (EPMA)
Attn: Data Protection / Privacy Officer
Addis Ababa University, School of Public Health
Addis Ababa, Ethiopia