Privacy Policy

Effective Date: 19 December 2025

Website: https://grassrootsdigital.org

Grassroots Digital Impact Africa (GDIA) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you visit our website, use our services, create an account, subscribe to our tools, make a donation, purchase a digital product, or otherwise interact with us online.

1. Who We Are

Grassroots Digital Impact Africa (GDIA) is a nonprofit digital platform focused on helping nonprofits, social enterprises, community-based organizations, and mission-driven institutions access digital tools, funding opportunities, knowledge resources, and capacity-building support.

Website: https://grassrootsdigital.org
Email: info@grassrootsdigital.org

2. Scope of This Policy

This Privacy Policy applies to personal data collected through:

• our website and landing pages;
• user registration and login areas;
• newsletter and email sign-up forms;
• comments, forms, and support requests;
• digital products, subscriptions, templates, tools, and downloads;
• donation, payment, and checkout pages; and
• embedded third-party services, plugins, and integrations used on our platform.

3. Information We Collect

3.1 Information You Provide Directly

• Full name
• Email address
• Phone number
• Organization name
• Country and location details
• Account login details
• Billing, payment, donation, or subscription details
• Messages, comments, support requests, and form submissions
• Any documents, media, or other content you upload or submit

3.2 Information Collected Automatically

• IP address
• Browser type and version
• Operating system and device information
• Referral source
• Pages visited and time spent on pages
• Clicks, navigation paths, and interaction data
• Cookie identifiers and similar online identifiers

3.3 Information from Third Parties

We may receive information from third-party providers that support our operations, such as website hosting providers, analytics services, email delivery providers, payment processors, spam detection tools, CRM systems, and embedded content platforms.

4. How We Use Your Information

We use personal data for legitimate organizational and operational purposes, including to:

• operate, maintain, and improve our website and services;
• create and manage user accounts;
• process subscriptions, purchases, donations, and related transactions;
• deliver templates, tools, newsletters, grant alerts, and other requested resources;
• respond to inquiries, support requests, and feedback;
• moderate comments and protect the website from spam, fraud, abuse, and unauthorized access;
• analyze website performance, engagement, and service usage;
• comply with legal, tax, accounting, and regulatory obligations; and
• enforce our terms, protect our rights, and maintain platform security.

5. Legal Bases for Processing

Where applicable under relevant privacy laws, we process personal data on one or more of the following grounds:

• your consent;
• performance of a contract or steps taken before entering into a contract;
• compliance with legal obligations;
• our legitimate interests, where those interests are not overridden by your rights and freedoms; and
• other lawful bases recognized under applicable data protection laws.

6. Comments

When visitors leave comments on the site, we collect the data shown in the comments form, along with the visitor’s IP address and browser user agent string to assist with spam detection and site security.

An anonymized string created from your email address may be provided to the Gravatar service to determine whether you are using it. The Gravatar privacy policy is available at https://automattic.com/privacy/. After approval of your comment, your profile picture may be visible publicly in the context of your comment.

7. Media Uploads

If you upload images or files to the website, you should avoid uploading files containing embedded location data or other sensitive metadata. Visitors to the website may be able to download and extract metadata from publicly accessible files.

8. Cookies and Similar Technologies

We use cookies and similar technologies to make our website function properly, remember user preferences, maintain secure sessions, understand traffic patterns, and improve user experience.

8.1 Types of Cookies We May Use

• Strictly Necessary Cookies: Required for core website functionality, security, and user authentication.
• Functional Cookies: Used to remember settings and preferences.
• Analytics Cookies: Used to understand website usage and improve performance.
• Marketing or Tracking Cookies: Used only where applicable and appropriate for campaign measurement, retargeting, or similar purposes.

8.2 WordPress-Related Cookies

If you leave a comment on our site, you may opt in to saving your name, email address, and website in cookies for convenience. These cookies may last for up to one year.

If you visit our login page, a temporary cookie may be set to determine whether your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we may set cookies to save your login information and display preferences. Login cookies may last for up to two days, or up to two weeks if you select “Remember Me.” Display preference cookies may last for up to one year. If you log out, login cookies are removed.

If you edit or publish content, an additional cookie may be saved in your browser indicating the post ID of the content you edited. This cookie expires after one day.

8.3 Consent

Where required by applicable law, we will request your consent before placing non-essential cookies or similar tracking technologies on your device. You can manage cookies through your browser settings and, where available, through our cookie preferences tools.

9. Email Communications and Marketing

If you subscribe to our newsletter, download a resource, register for an account, join a waitlist, or otherwise opt in to communications, we may send you service-related emails, educational content, updates, and promotional messages relevant to GDIA’s mission and offerings.

You may unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting us directly. We may still send essential service, transactional, legal, or account-related messages where necessary.

10. Payments, Donations, and Subscription Services

If you make a payment, donation, or subscription purchase through our website, your payment information may be processed by third-party payment processors. We do not intentionally store full payment card details on our servers unless expressly stated and lawfully secured.

We may retain transaction-related information such as payer name, email address, payment reference, amount, currency, subscription status, billing history, and associated account details for accounting, fraud prevention, audit, customer support, legal compliance, and service administration purposes.

11. Embedded Content and Third-Party Services

Articles, pages, and resources on this site may include embedded content or integrated services such as videos, forms, maps, social media content, analytics tools, payment gateways, spam filters, cloud hosting, and other third-party plugins or widgets.

Embedded content from other websites behaves in much the same way as if you visited those websites directly. Those third parties may collect data about you, use cookies, log your IP address, and monitor your interaction with their content, especially if you are logged into their services.

We encourage you to review the privacy policies of third-party services you interact with through our website.

12. How We Share Personal Data

We do not sell your personal data.

We may share personal data only where necessary and appropriate with:

• website hosting and infrastructure providers;
• payment processors and billing providers;
• email delivery, CRM, and newsletter service providers;
• analytics, security, spam prevention, and fraud detection providers;
• professional advisers such as lawyers, accountants, auditors, or insurers;
• regulators, law enforcement, courts, or competent authorities where required by law; and
• successors or counterparties in the event of a lawful restructuring, merger, transfer, or reorganization of services.

13. International Data Transfers

Your personal data may be stored, processed, or accessed in countries other than your own, including where our service providers or technical infrastructure are located. Where required by applicable law, we will take reasonable steps to ensure that appropriate safeguards are in place for international data transfers and that your information receives a level of protection consistent with applicable legal standards.

14. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services, maintain records, comply with legal obligations, resolve disputes, enforce agreements, and protect our legitimate interests.

Examples include:

• Comments and metadata: may be retained indefinitely for moderation, security, and continuity purposes;
• User account data: retained while your account remains active and for a reasonable period afterward where necessary;
• Transaction and subscription records: retained as required for finance, tax, accounting, audit, fraud prevention, and compliance purposes;
• Support communications: retained for recordkeeping, quality assurance, and dispute resolution.

15. Data Security

We implement reasonable technical, administrative, and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption where appropriate, software updates, hosting security, account protections, and monitoring tools.

However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

16. Your Privacy Rights

Depending on your location and the laws that apply to you, you may have rights regarding your personal data, including the right to:

• be informed about how your personal data is used;
• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of personal data, subject to legal and operational exceptions;
• object to certain processing activities;
• request restriction of processing in certain circumstances;
• request portability of certain personal data where applicable;
• withdraw consent where processing is based on consent; and
• lodge a complaint with an appropriate supervisory or regulatory authority.

To exercise any of these rights, please contact us at info@grassrootsdigital.org. We may need to verify your identity before processing your request.

17. California Privacy Notice

If you are a California resident and applicable law applies, you may have additional rights relating to access, deletion, correction, and greater transparency about the categories of personal information collected, disclosed, or used. You may also have the right not to be discriminated against for exercising applicable privacy rights.

We do not sell personal information in the ordinary meaning of that term. If our practices change, we will update this Privacy Policy and provide any notices required by law.

18. Children’s Privacy

Our website and services are not directed to children under the age of 13, or any higher minimum age required by applicable law in a specific jurisdiction, unless expressly stated for a lawful educational or youth-support purpose with appropriate safeguards. We do not knowingly collect personal data from children in violation of applicable law.

If you believe a child has provided personal data to us unlawfully, please contact us so we can review and take appropriate action.

19. Password Resets and Security Emails

If you request a password reset, certain technical information, such as your IP address, may be included in the reset process or related security logs for fraud prevention and account protection.

20. Automated Spam Detection

Visitor comments, form submissions, and other website interactions may be checked through automated spam detection, abuse prevention, or security monitoring services.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect legal, technical, operational, or service-related changes. When we do, we will revise the effective date at the top of this page. Material changes may also be highlighted on the website where appropriate.

22. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of personal data, please contact:

Grassroots Digital Impact Africa (GDIA)
Email: info@grassrootsdigital.org
Website: https://grassrootsdigital.org