How E-BRIDGE looks after your information

E-BRIDGE is the online platform of ERB (Empowering Response Burundi), based in Bujumbura, Burundi. Through the platform, ERB and UNDP Burundi train young people and women in the Entrepreneurship with Zero External Capital (EZCE) approach, verify their ventures and connect them with sponsors, mentors and partners.

ERB decides how the personal information on E-BRIDGE is used and is responsible for protecting it. In this policy, "we" and "us" mean ERB, and "you" means anyone who visits the website or holds an account.

This policy applies to everyone who uses E-BRIDGE:

• Visitors who browse the public website without an account.
• Founders (entrepreneurs) who register a business, whether they sign up themselves or are registered by ERB staff with their agreement.
• Sponsors: investors, banks, donors, development partners, foundations, government bodies and other organisations that support the programme.
• Mentors who hold sessions with founders.
• ERB staff (verification officers and administrators) who run the programme.

We only ask for what the programme needs. What we hold depends on how you use E-BRIDGE.

• To create and secure your account, and sign you in.
• To verify that a business is real and eligible for the programme.
• To track training and work out a venture's readiness for funding.
• To suggest suitable businesses to sponsors, by comparing each sponsor's focus with verified businesses.
• To arrange mentoring sessions, document sharing, pitch meetings and deals.
• To follow up with founders every 90 days on how their business is doing.
• To publish verified ventures and success stories on the public website, as described in section 6.
• To report the programme's results to ERB, UNDP Burundi and other partners as anonymous totals, such as the number of women-led ventures or jobs created per province.
• To keep the platform secure, prevent misuse and keep a reliable record of what happened on it.
• To send you emails about your account and the programme: sign-in codes, invitations, password resets, verification and certificate decisions, sponsor requests, mentoring bookings, deal updates and follow-up reminders. We do not send marketing emails.

We do not sell or rent your personal information, and we do not use it for advertising.

• Your consent: founders and sponsors accept our data protection notice when they sign up, and we record the date. When ERB staff register a founder, the staff member confirms that the founder agreed, and their name is recorded with that confirmation.
• Running the programme you joined: we cannot verify, train, mentor or match you without the information listed above.
• Our legitimate interest in keeping the platform secure and keeping honest, verifiable records for the programme and its funders.
• Legal obligations that apply to ERB in Burundi.

A business appears on the public website only once ERB has verified it, and only while the founder's account is active. ERB can take a listing down at any time, including at the founder's request. A listing can show:

• The business name, sector, province, stage, description, number of employees, jobs expected and funding need.
• The founder's first name only, and whether the venture counts as women-led or youth-led.
• Its readiness, the courses completed and which kinds of documents are on file (never the documents themselves).
• The founder's photo or logo and photos of the business, if added.
• A success story written by ERB, if one is published.
• Public contact details, only if the founder or ERB, with the founder's agreement, has switched them on.

The public website never shows a founder's full name, exact age, private phone number or email, questionnaire answers, uploaded documents or ERB's internal notes. The headline figures on the home page and the impact dashboard are totals that do not identify anyone.

We use a small number of trusted providers to run E-BRIDGE. They handle your information only to provide their service to us, under our instructions:

• Cloudflare, which delivers the website, protects it against attacks and stores uploaded documents and photos in private storage.
• MongoDB Atlas, which hosts the database.
• A cloud hosting provider that runs the E-BRIDGE application server.
• An email provider that delivers the emails we send you.
• A temporary data service that queues emails and counts sign-in attempts. It does not keep your profile.

These providers may store or handle data on servers outside Burundi. We choose providers with strong security standards and limit what each one can access.

E-BRIDGE uses only what it needs to work:

• erb_session: keeps you signed in. Scripts on the page cannot read it, and it stops working after 8 hours without activity, 72 hours at most, or when you sign out.
• erbbridge-locale: remembers whether you chose English or French, for up to one year.
• Application draft: while a founder fills in the application, the answers (never the password) are saved in the browser on that device, so the form can be resumed. The draft is removed when the application is submitted or discarded.

We do not use advertising, analytics or third-party tracking cookies. The website's fonts are served from our own site, so loading a page does not contact other companies.

• All traffic to E-BRIDGE is encrypted (HTTPS).
• Passwords are stored only in scrambled form. After 5 wrong passwords, an account is locked for 15 minutes.
• ERB staff must enter a one-time code sent by email each time they sign in.
• Documents are kept in private storage and are only sent after a permission check. Each file gets a digital fingerprint, so anyone can check that a copy matches the original.
• Photos are reduced in size and stripped of location data before they are uploaded.
• Every action on the platform is recorded in an audit trail that cannot be edited or deleted. It is checked every night for tampering.
• Pages that show personal information are never stored in shared caches, and inactive sessions are signed out automatically.

No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authorities as the law requires.

• Account and business information is kept while your account is open and the programme needs it.
• Sign-in codes and password links are deleted automatically when they expire. Invitation links last 72 hours.
• When you replace or delete a document or photo, the old file is deleted.
• Document access for a sponsor ends after 30 days, or earlier if the founder withdraws it.
• When an account is closed, the person can no longer sign in and their business is removed from the public website. We keep the records the programme needs for reporting to its funders and for audit.
• The audit trail is permanent by design, so that the programme's results can always be checked. It records actions, such as "a business shared documents with a sponsor", and can include business and organisation names.

You can do much of this yourself from your dashboard:

• See your information: your dashboard shows your profile, your documents and the date you gave consent.
• Correct it: update your profile, or ask us to fix anything you cannot change yourself.
• Control document sharing: approve or refuse each sponsor request, and withdraw access at any time.
• Control your public profile: show or hide your public contact details, remove your photos, or ask us to take your business off the public website.
• Withdraw your consent or close your account: contact us. We will remove your public listing and delete what we are not required to keep.
• Object to how we use your information, or ask for a copy of it.

To make a request, write to us using the details below. We may need to confirm your identity first, and we will reply within 30 days. If you are not satisfied with our answer, you can complain to the competent authority in Burundi.

E-BRIDGE is for people aged 16 and over. We do not knowingly collect information from younger children. If you believe a child under 16 has registered, please contact us and we will remove their information.

We will update this policy when the way we handle information changes, and change the date at the top of the page. If a change is significant, we will let account holders know by email before it takes effect.

For any question about your privacy or to make a request, contact ERB: