Members Business Directory privacy notice

Private application records and public business listings

1. Controller and scope

Think Africa ry, Business ID 2656503-4. Contact: info@thinkafrica.fi. Postal address stated in its published notice: Kauppamiehentie 6, Kansalaisuus Toiminnankeskus Building, 2nd floor, 02100 Espoo, Finland

This notice explains personal-data processing for the Members Business Directory, also called the Members Service Directory. It supplements Think Africa’s Privacy Notice [approved version and effective date]. It is not the Afara Expert Privacy Notice and does not authorise expert matching or a paid assignment.

Information about a company is not always personal data, but information about an owner, sole trader, representative or other identifiable person can be. Commercial confidentiality and personal-data protection are separate obligations.

2. What we collect and why

For an application, we use the member/account link, business and service details, owner or representative information, contact preference, categories, descriptions, location, markets, languages, website and social links, and relevant supporting material. We keep necessary submission, review, correction, publication-choice and complaint records.

Information normally comes from the submitter. Relevant membership records, an authorised representative, a reporting person or a source used to check a claim may supply additional information. Where personal data is collected indirectly, we identify its source and provide the required notice unless a lawful exception applies.

3. Purposes and proposed legal bases

The controller must approve the following allocations before this notice is issued. Required form fields must have their necessity assessed; a field being mandatory in software does not establish a lawful basis.

Activity

Proposed basis and limit

Private eligibility and listing administration

Article 6(1)(f): administering the requested member directory and reliable listings, supported by a balancing assessment. Article 6(1)(b) only where the person is individually party to a relevant service contract and the use is necessary for it.

Public personal information

Separate Article 6(1)(a) publication consent covering the identified information and individual.

Corrections, reporting, moderation and security

Article 6(1)(f): preventing misuse, protecting rights and maintaining accurate listings, subject to necessity and proportionality.

Data-rights requests and applicable legal records

Article 6(1)(c), limited to the relevant legal obligation.

Optional newsletters or separate publicity

Separate consent where required; directory participation does not provide it.

4. Public listing fields

The public field list for approval is: business name; owner name; business type; short and full descriptions; location; categories; services; countries served; African markets; languages; website; LinkedIn and other social links; and contact preference. Only completed or displayed fields within the approved public list are covered.

This list reflects the 8 September 2026 implementation evidence. It must be checked against the current public listing and publication choice before release. Remove this editorial sentence after the approved field list is recorded.

Private evidence, membership records, payment details, identity documents and non-public correspondence are not covered by the public-listing permission. Do not put sensitive information or a private home address into a public narrative or link unless it is deliberately intended for publication and the required lawful basis exists.

An authorised business representative must have permission to submit business content. Where consent is the basis for publishing an owner’s or another individual’s personal data, obtain that person’s informed consent. Authority to represent a company is not automatically authority to give someone else’s personal consent.

5. Who can see the information

Authorised Think Africa personnel and supervised support volunteers can access the information necessary for their role. Relevant technical providers support storage, website operation and communications. Professional advisers and authorities receive records only where justified or legally required. Directory visitors can see the authorised public fields.

A visitor who contacts a listed business may create a separate relationship with that business. The business must explain its own personal-data use. Neither the visitor nor the business receives unrestricted access to Think Africa’s private member or application records. Think Africa does not sell personal data.

6. Publication withdrawal and corrections

You can request correction or withdraw your consent to public personal-data publication through the verified listing controls or by contacting info@thinkafrica.fi. Withdrawal must be as easy as giving consent. The operational route must actually work before publication is offered.

We stop future publication of the affected information and assess whether the listing can remain without it. A withdrawal does not automatically cancel membership or erase records required for a specific lawful purpose. Where erasure duties apply, we take reasonable steps concerning recipients and copies. Search engines and independent third-party copies may not disappear immediately when our listing is removed.

7. Providers and transfers

The main Privacy Notice must identify the current relevant provider categories, actual non-EEA recipients or access countries, and the applicable adequacy decision or other safeguard: [insert approved section/version]. Information about safeguards can be requested at info@thinkafrica.fi. No claim that all processing stays in Finland or the EEA is made without the supporting inventory.

8. Retention

Record

Rule to complete before release

Incomplete or rejected listing applications

[Approved duration and trigger under R03, including separate treatment of supporting evidence.]

Active private directory records

For the approved listing administration period; [review cycle and closure-based deletion rule under R03].

Public listing

Until publication permission is withdrawn, eligibility ceases under the applicable rules, or publication otherwise ends.

Reports, restrictions and review records

[Approved period after resolution, purpose and any lawful retention exception.]

Publication consent and withdrawal evidence

[Approved minimal evidence period under R06/R10.]

Technical security and backup records

[Approved main-notice schedule reference, periods and deletion or backup-expiry rules.]

Retention must be limited to the specific purpose. Retaining minimal evidence of a complaint or consent does not authorise indefinite retention of all business evidence or continued public display. Where a legal hold applies, restrict the records and their use to the documented reason.

9. Information needed and automated processing

Information genuinely required to establish eligibility and describe the requested listing is needed to process it. Optional promotional choices and public publication remain separate. No solely automated decision producing legal or similarly significant effects is authorised by this notice. The actual filtering, ordering and moderation processes must be checked and described accurately before release.

10. Your rights and contact

You can request access, correction, erasure, restriction or portability where the legal conditions apply. You can object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time without giving a reason. You can withdraw consent at any time without making earlier lawful processing unlawful.

Contact info@thinkafrica.fi. A website account, membership payment or acceptance of service terms is not required to exercise data rights. We may request proportionate information to resolve reasonable doubts about identity. We respond without undue delay and within one month. A necessary extension of up to two further months will be explained within the first month. Requests are normally free; any lawful refusal or permitted charge will be explained.

You may complain directly to Finland’s Office of the Data Protection Ombudsman or the competent supervisory authority where you live or work in the EU, or where the alleged infringement occurred. You do not have to complete our complaints process first. Your judicial remedies remain available.

11. Notice changes

We identify the effective version and explain material changes before new processing begins. A revised notice does not itself create new consent. The activity-specific notice and main Privacy Notice must be kept consistent; this draft must not be published alongside conflicting retention, visibility or consent statements.