Privacy Policy

UPOSA (University Practice Old Students' Association) is the alumni association of University Practice Senior High School, University of Cape Coast, Cape Coast, Ghana. We are the data controller for personal data processed through www.uposa.org, the member portal at alumni.uposa.org and the UPOSA mobile app (together, the "Services").

This policy explains what we collect, why, who we share it with and the rights you have under the Data Protection Act, 2012 (Act 843) of Ghana. Contact us at info@uposa.org, on 0244036676 or 0246446333, or at University Practice Senior High School, UCC, Cape Coast.

When you register or update your profile:

• Full name, email address, password (stored only as a secure hash) and profile photo.
• Phone numbers, gender, date of birth, marital status, residential address, city, region and country.
• Year group, programme and house at University Practice SHS.
• Employment type, occupation, organization and areas of expertise.
• Emergency contact and next-of-kin details.
• Mentorship, volunteering and contribution preferences, and whether you are in a UPOSA WhatsApp group.

When you use the Services:

• Forum posts and comments, job postings and applications (including cover letters and CV links), mentorship requests, event RSVPs, and your participation in polls and elections.
• Dues and donation records: amount, currency, reference, status and the name and email used to pay.
• Messages you send through our contact, transcript request and newsletter forms.
• Reports you make about content or members, and the members you block. A reported member is never told who reported them.

Payments: card and mobile money details are entered directly with our payment providers (Paystack, Stripe and Coinbase Commerce). We never receive or store your full card number, CVV or mobile money PIN.

Technical data: our servers record IP addresses and request details to keep the Services secure and to prevent abuse. Your browser or phone stores your sign-in session and display preferences (such as light or dark mode). We do not use advertising, tracking or analytics cookies.

Anonymous website traffic: we count page visits using route categories, approximate country, device type, browser, operating system and referral hostname. Daily visitor estimates use a keyed hash that changes per website and UTC day; we do not store raw IP addresses, browser identifiers, account details, page tokens or query strings in this traffic dataset. Visits are retained for 400 days. Collection respects Do Not Track and Global Privacy Control and excludes known automated clients.

• Running your membership: verifying that you are an old student, approving your registration, keeping the member register and managing dues. We do this to provide the membership you asked for.
• Member directory: showing your name, photo, year group, programme, house, city, country, occupation, organization and expertise to other signed-in members, only if you choose to appear. Your email, phone numbers and address are never shown in the directory. Members who registered before 2 October 2026 appear by default and can switch this off at any time.
• Service messages: account verification, password resets, payment receipts and important membership notices.
• News and updates: association news by email, only if you opt in. You can opt out at any time in your settings or through the unsubscribe link in every newsletter.
• Payments and accounting: processing dues and donations and keeping the financial records the law requires.
• Community features: forum, jobs, mentorship, events, polls and elections, at your request. Election ballots are used only to count results and are never shown to other members.
• Security: protecting accounts, preventing fraud and abuse, and enforcing our Terms of Use.

We do not sell your personal data. We share it only with:

• Other members: your directory profile (if you opt in) and anything you post in community areas.
• UPOSA executives and administrators: to manage membership, dues, events and elections, under confidentiality.
• Service providers who process data for us under contract: Render (application hosting), MongoDB Atlas (database), Vercel (website hosting), Cloudinary (photos and documents), Resend (email delivery), and Paystack, Stripe and Coinbase Commerce (payments). Our staff may use OpenAI to help draft public content such as news articles; member personal data is not sent to it.
• Authorities: when required by Ghanaian law or a valid legal request, or to protect the rights and safety of our members.

Some of our service providers store or process data outside Ghana, including in the United States and the European Union. We choose providers that protect data with encryption, access controls and contractual commitments, and we transfer only what each provider needs to deliver its service.

• Account and profile data: for as long as you are a member, until you delete your account.
• Financial records (dues, donations, payments): for as long as Ghanaian tax and accounting law requires. If you delete your account, these records are kept but no longer linked to your name or contact details.
• Forum posts and comments: these stay after account deletion but are shown as written by "Deleted member". Ask us if you want specific posts removed.
• Contact and transcript requests: for as long as needed to handle the request and keep a record of the correspondence.
• Security logs: for a short period, then deleted.

The Services use encrypted HTTPS connections. Passwords and reset links are stored only as one-way hashes, payment provider credentials are encrypted, access to member records is limited by role, and the mobile app keeps your sign-in session in your phone's secure storage. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you and the Data Protection Commission as the law requires.

Under the Data Protection Act, 2012 (Act 843) you can:

• Access your data: use "Download my data" in your account settings, or ask us.
• Correct it: edit your profile at any time, or ask us to.
• Delete your account: in your account settings (see how to delete your account) or by emailing us.
• Withdraw consent or object: switch off the directory listing or news emails in your settings at any time.
• Complain to the Data Protection Commission of Ghana (dataprotection.org.gh) if you believe we have mishandled your data.

To use these rights by email, write to membership@uposa.org from the email address on your account. We aim to respond within 30 days.

UPOSA membership is for former students aged 18 or over, and the Services are not intended for children. If you believe a child has given us personal data, contact us and we will delete it.

We will update the date at the top of this page when the policy changes. For significant changes, we will tell members by email or in the Services before they take effect.