How we handle personal data.

What data we hold

In myLEAD (on behalf of partner organisations)

• Identity and contact details — name, role, organisation, contact information;

• Engagement status and unit or post;

• Training and certification records, qualifications and course history;

• Assessment outcomes, competency stage and eligibility status;

• Development-pathway and course-place allocations;

• Account and audit metadata — who changed a record, and when.

The platform is not designed to hold special categories of data (such as health or biometric data), and organisations are asked not to enter such data except where specifically agreed.

On our website and in our work as controller

• Contact details you give us when you email, enquire, partner or donate;

• Basic, privacy-respecting analytics about how the website is used.

Why we process it, and our lawful basis

We process personnel data to deliver the myLEAD services on the controller's behalf: to register people, allocate and track development pathways and course places, record assessments and certifications, coordinate training, and report on programme outcomes in aggregated, anonymised form that does not identify individuals.

Depending on the context, our lawful bases under the GDPR are the performance of a contract, our (or the controller's) legitimate interests in running a professional certification programme, compliance with a legal obligation, and — where required — consent. Where we rely on legitimate interests, we balance them against your rights and freedoms.

Who can see it

Access is tightly limited:

• Your own organisation sees only its own people. One partner can never see another's personnel.

• LEAD staff see what they need to run the programme and support you, on a least-privilege basis.

• Sub-processors — carefully selected service providers (such as our hosting and platform partner) — process data only under written contracts with the same protections set out here.

We do not sell personal data, and we do not share identifiable personnel data with funders, donors or other third parties. Funder and public reporting uses aggregated, anonymised figures only.

International transfers

Personal data in myLEAD is hosted within the European Economic Area (EEA). Because our partners operate across Africa, Asia and beyond, the data may be accessed by authorised users from outside the EEA. Where that happens, or where a service provider sits outside the EEA, we rely on an adequacy decision or on appropriate safeguards under the GDPR — such as the European Commission's Standard Contractual Clauses — to keep the protection with the data wherever it travels.

How long we keep it

We keep personnel data for as long as the partner organisation uses the services, and as long as needed to maintain a meaningful record of training and certification. When a partnership ends, we return or securely delete the organisation's data at their choice, keeping only what the law requires us to retain. Contact, donation and financial records are kept only as long as needed for their purpose or a legal obligation.

Little Guide feedback is anonymised one year after submission: we remove the email address, free-text feedback and technical visitor data, while retaining only the guide, rating, language and submission date for aggregated analysis. Metadata for successfully delivered emails is deleted after one year. LEAD’s own consent and optional visitor cookies expire after one year.

How we protect it

We hold personal data under appropriate technical and organisational measures, including encryption in transit and at rest, role-based access control, an audit trail that records who changed each record and when, regular backups, staff confidentiality undertakings, and a defined breach-response process. Our systems are built to the controls of recognised security standards (ISO/IEC 27001 and ISO/IEC 27701 / GDPR), hosted on certified infrastructure, with formal certification on our roadmap.