Contents
1. Purpose and Scope
This policy sets out how ASCO protects its website, administrative systems, and the data of the people who interact with them — donors, newsletter subscribers, and members of the public who contact us.
2. Account and Password Security
- Every person with access to ASCO's website admin system must have their own individual login — shared logins are not permitted.
- Passwords must be at least 10 characters and must be changed immediately if a default or temporary password was issued.
- Login credentials must never be shared over email, chat, or any unsecured channel.
- Access is automatically logged out after a period of inactivity, and all administrative actions are recorded in an internal activity log.
3. Access Control
Administrative access to the website is limited to Executive Structure members and staff who need it to perform their role, and is removed promptly when someone leaves that role. The administrative area is technically excluded from public search engines and is not linked from the public website.
4. Data Protection
ASCO collects limited personal information through this Website — newsletter sign-ups, contact form submissions, and basic, privacy-conscious visit analytics — as described in our Information Disclosure page. This data is handled in a manner consistent with the Protection of Personal Information Act (POPIA). Visitor IP addresses are never stored in raw form; only a one-way, time-limited hash is kept, and this is used only for basic traffic statistics, never to identify individuals.
5. Backups
ASCO maintains the ability to export a complete backup of its website content and uploaded files on demand, so that data can be recovered in the event of a technical failure or security incident.
6. Third-Party Services
Where ASCO relies on third-party services — such as its web hosting provider or PayPal for donations — those providers are expected to maintain appropriate security standards for the data they process on ASCO's behalf. ASCO is not responsible for the internal security practices of independent third parties.
7. Incident Response
Any suspected security incident — including unauthorised access, a compromised account, or suspicious activity on the Website — should be reported immediately to the Head of ICT & Communications at info@africansolidaritycivic.org. Passwords for any potentially affected account will be reset without delay, and affected individuals will be notified where their personal information may have been exposed.