Data Protection Policy

1. Purpose & Scope

PRA collects and processes personal data in the course of its governance, programme delivery, fundraising and partner engagement activities. This policy sets out how PRA handles that data lawfully, fairly and transparently in line with the Swiss Federal Act on Data Protection (nFADP), and in a manner compatible with the EU General Data Protection Regulation (GDPR) for any data subjects in EU member states.

This policy applies to: all personal data processed by PRA, regardless of format (digital or paper); all staff, NEDs, volunteers, interns and contractors who handle personal data on PRA's behalf; all processing activities carried out in Geneva, in Botswana, in Namibia, or by any PRA-authorised processor.

2. Data We Hold and Why

3. Data Protection Principles

PRA processes personal data in accordance with the following principles:

• Lawfulness, fairness and transparency: data is processed on a clear legal basis and individuals are informed.
• Purpose limitation: data is collected for specified purposes and not further processed in incompatible ways.
• Data minimisation: PRA collects only the data that is necessary for the stated purpose.
• Accuracy: data is kept accurate and up to date; inaccuracies are corrected promptly.
• Storage limitation: data is not kept longer than necessary (see Section 6).
• Integrity and confidentiality: appropriate technical and organisational measures protect data against unauthorised access, loss or destruction.
• Accountability: PRA can demonstrate compliance with these principles.

4. Individual Rights

Data subjects have the following rights under nFADP and, where applicable, GDPR. Requests should be directed to the Data Protection Officer (Board Chair) and will be responded to within 30 days.

5. Data Sharing & Third Parties

PRA does not sell personal data. PRA may share data with:

• Statutory authorities: where required by law or court order.
• Auditors and legal advisors: under confidentiality obligations, for governance and compliance purposes.
• Funders: anonymised or aggregated impact data only, unless the data subject has consented to identified reporting.
• Technology service providers (e.g. email, cloud storage): subject to data processing agreements that bind them to equivalent data protection standards.

6. Retention Periods

Data due for deletion is securely destroyed: digital data is permanently deleted and confirmed; paper records are shredded.

7. Security Measures

• Access to personal data is restricted to those who need it for their role.
• All PRA devices used to handle personal data are password-protected and use encrypted storage.
• PRA uses reputable, GDPR-compliant cloud services for document and email storage.
• Paper records containing personal data are stored securely and are not left unattended.
• Staff and NEDs handling personal data receive data protection awareness as part of their onboarding.

8. Data Breaches

A data breach is any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. If a breach is suspected or discovered:

• Report immediately to the Data Protection Officer (Board Chair).
• DPO assesses severity within 24 hours.
• If the breach is likely to result in a risk to individuals' rights and freedoms: notify the Swiss Federal Data Protection and Information Commissioner (FDPIC) within 72 hours.
• If the breach is likely to result in a high risk to individuals: notify affected data subjects without undue delay.
• All breaches are logged regardless of severity, with the nature of the breach, data involved, actions taken, and outcome.

9. Monitoring & Review

• The DPO reviews data processing activities annually and following any significant change in PRA's operations.
• This policy is reviewed annually by the Board at its March meeting.
• The policy is updated immediately if the Swiss nFADP implementing ordinances change or if PRA begins operating in a new jurisdiction with materially different data protection requirements.