Privacy Policy

We may update this policy from time to time, so please check this page occasionally to make sure you are aware of and agree with any changes. By creating an account and using our website, you agree to be bound by this policy. If you have any questions about our privacy practices, please contact us at support@inatom.org.

Who we are

INATOM Rwanda, the Institute for Nuclear Education, Awareness and Technology Outreach, is an educational organisation based in Kigali, Rwanda. We operate the website at www.inatom.org and its membership platform (the “Service”). Our purpose is to educate students, support professionals, and advance nuclear science for peaceful development. For the purposes of applicable data-protection law, INATOM Rwanda is the data controller responsible for your personal data.

How we collect information from you

We obtain information about you when you:

• Use our website;
• Create an account or apply to become a member;
• Sign in with Google;
• Enrol in a course or take a quiz;
• Register or apply for an event;
• Subscribe to our newsletter; or
• Contact us through our contact form or by email.

What information we collect

If you visit as a non-member

When you browse the website without signing in, we collect only the standard technical information needed to deliver and secure the site, such as your IP address and the pages you visit. This helps us keep the platform reliable and improve its quality.

When you create an account

To register, we ask for your name, email address, and a password (which we store only in a securely hashed form). You may also tell us your phone number, country, and institution, and choose whether to subscribe to our newsletter.

Your profile

You can choose to add more details to your profile, including a display name, avatar, gender, biography, city, field of study, professional roles, skills, nuclear interests, and links to your LinkedIn, X (Twitter), or personal website. Providing these is optional and helps you connect with the community.

Learning and participation

As you use the Service, we record your course enrolments, lesson progress, quiz attempts and scores, certificates earned, event registrations and applications, and any content you submit, such as questions, community posts, and showcase entries.

If you apply for an event

Some events use an application form that may ask for additional details relevant to that event, such as your organisation, job title, and country, so we can evaluate applications and manage attendance. Only the information requested on the form is collected.

If you sign in with Google

If you register or log in with Google, we receive your name, email address, and profile picture from Google to create or access your account. We do not receive your Google password.

Security and audit data

For the security of your account and the platform, we keep records of authentication events, such as login timestamps and, for auditing purposes, the IP address and browser type associated with those events.

How we use your information

We may use your information to:

• Create and manage your account and membership level;
• Provide courses, events, certificates, and other features of the Service;
• Process an application you have made to join, take a course, or attend an event;
• Authenticate you, keep your account secure, and detect or prevent fraud and abuse;
• Send you transactional emails, such as email verification, password resets, two-factor codes, certificate delivery, and event and application updates;
• Send newsletter and community updates where you have asked to receive them;
• Seek your views on the services we provide and notify you of changes to them;
• Produce anonymised statistics that help us understand who we are reaching and address any gaps in access; and
• Comply with our legal obligations and enforce our Terms of Use.

Legal bases for processing

We process your personal data on the following bases: performance of our contract with you (to provide the Service you request); your consent (for example, newsletter subscriptions, which you may withdraw at any time); our legitimate interests (such as securing the platform and improving our services); and compliance with legal obligations.

Your member dashboard

When you become a member, we provide a personal dashboard where you can view your profile, track your learning progress, manage your notifications, and update your details. You are responsible for keeping your profile information accurate and your login credentials confidential.

Who else has access to your information

We never sell or rent your information, and we do not share it with third parties for their own marketing purposes. We share it only with trusted service providers who process it on our behalf and under contract, including:

• Hosting and infrastructure providers, who host the website and the application that powers the Service;
• Our email provider (Resend), which delivers transactional and newsletter emails;
• Our media storage provider (Cloudinary), which stores uploads such as profile pictures; and
• Google, if you choose to sign in with Google.

These providers are required to keep your information secure and to use it only to provide services to us. We may also disclose information where we are required to do so by law or regulation, by a court order, to prevent fraud or other crime, or to protect the rights, property, or safety of INATOM Rwanda, our members, or others.

Servers located outside Rwanda

Our service providers may from time to time store or process data in countries outside Rwanda, which may not have the same data-protection laws. Where this happens, we take steps to ensure your data receives an adequate level of protection consistent with this policy and applicable law. By submitting your personal data, you agree to this transfer, storage, or processing.

How long we keep your information

We keep your personal data for as long as your account is active or as long as needed for the relevant activity. If you delete your account, it is deactivated and you are signed out; your records are retained in a deactivated state so they can be restored on request, and they remain available unless and until they are permanently deleted by an administrator. We may keep certain information for longer where necessary to meet legal obligations, resolve disputes, or preserve the integrity of issued certificates. We review our retention periods regularly and delete information that is no longer needed.

Your choices

You have a choice about the communications you receive from us. You can subscribe to or unsubscribe from our newsletter at any time using the link in our emails or by contacting us at support@inatom.org. We will only send you marketing or community updates where you have chosen to receive them; we will always send the essential transactional messages needed to operate your account.

Accessing and updating your information

The accuracy of your information matters to us. You can review and update most of your details at any time from your dashboard. You also have the right to ask for a copy of the information we hold about you, to correct or delete it, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, contact us at support@inatom.org.

Security

When you give us personal information, we take steps to keep it secure, including password hashing, encrypted access and refresh tokens delivered through secure, HTTP-only cookies, token rotation, optional two-factor authentication, rate limiting, and role-based access controls. No method of transmission over the internet or method of storage is completely secure, so while we strive to protect your information, we cannot guarantee its absolute security, and any transmission is at your own risk. Where you have chosen a password, you are responsible for keeping it confidential and should not share it with anyone.

Cookies

Like most websites, we use cookies and similar browser storage to keep you signed in and to remember your preferences. For details, please see our Cookie Policy.

Links to other websites

Our website may contain links to websites operated by other organisations. This policy applies only to our website, so we encourage you to read the privacy statements of any other sites you visit. We are not responsible for the privacy policies or practices of other sites, even where you reach them through a link from ours.

Children

You must be at least 16 years old to create an account, enrol in a course, or attend an event. The Service is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us personal data, please contact us so we can remove it.

Changes to this policy

We review this policy regularly and may update it from time to time. When we make material changes, we will update this page and, where appropriate, notify you through the Service.