Protection of Your Personal Data

This privacy statement provides information about the processing and the protection of your personal data. Processing operation: management of procurement, grant award and sub-delegation procedures, contract execution and project/grant implementation.

Data Controller: Director, African Union - Inter-African Bureau for Animal Resources (AU-IBAR). Kenindia Business Park, Museum Hill,Westlands Road. P.O. Box 30786-00100 Nairobi, Kenya.Tel: +254 (20) 3674 000.

Record reference: {Insert filing or record reference here}


The African Union, Interafrican Bureau for Animal Resources (hereafter ‘AU-IBAR’) is committed to protecting your personal data and to respecting your privacy. AU-IBAR collects and further processes personal data pursuant to the African Union Treaty on Cyber Security and Personal Data Protection.

This privacy statement explains the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data. It also specifies the contact details of the responsible Data Controller with whom you may exercise your rights.

Why and how do we process your personal data?

Purpose of the processing operation: AU-IBAR collects and uses your personal information for the purpose of the management of procurement, grant award and sub-delegation procedures, contract execution, grant execution and other relevant activities in the course of project implementation.

Processing of personal data takes place using both automated means, in particular the AU-IBAR’s electronic systems for the management of procurement/grants/contract execution/grant & project implementation (e.g. SAP, ARIS) and manual means, such as paper files.

Your personal data will not be used for an automated decision-making including profiling.

On what legal ground(s) do we process your personal data

The data processing is considered lawful because:

  • a.   It is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or
  • b.   It is necessary for the performance of tasks carried out in the public interest and in the exercise of official authority vested in AU-IBAR;
  • c.   It is necessary for compliance with legal obligations including such as funding agreements concluded between AU-IBAR and another entity; or
  • d.   You, as the data subject, have given consent to the processing of your personal data for one or more specific purposes.

In very limited and specific cases, we might process special categories of personal data namely data related to the health of the data subjects. The processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law insofar as it is authorised by the applicable law providing for appropriate safeguards for the fundamental rights and the interests of the data subject. If so, the processing will be limited to the submission by the contractor of a certificate that the contractor itself, its staff, its subcontractors and/or any person for which the contractor is answerable, are fit to implement their obligations under the contract, with no further details on the health of the data subject. This way the contracting authority ensures the health, safety and welfare of the data subjects and ensures the protection of project funds by confirming that the contractors can implement their obligations. On the other hand, the contractors comply with their obligation of proper implementation of the contract.
Please note that in certain circumstances, it may be necessary to reconcile the rights of data subjects with the needs of investigations competent public authorities

Which personal data do we collect and further process?

In order to carry out this processing operation AU-IBAR collects the following categories of personal data:

  AU-IBAR Staff or Service provider1 Representative of country, REC or IO2 Tenderers, grant applicants, implementing partners3

Reference persons mentioned
in the CVs of key experts

Personal data processed in the context of project implementation
Name X X X X X
Function X X X X X
Title X X X X X
Contact details (e-mail address, business telephone number, mobile telephone number, fax number, postal address, department and office number, country; X X X   X
Signature X X X   X
Opinions X X      
Declarations on honour on conflict of interest, impartiality, objectivity and confidentiality X X      
Bank account reference (IBAN and BIC codes),VAT number, passport number, ID number     X   X
Information on expertise, technical skills and languages, educational background, professional experience, gender, age etc.     X   X
Declaration that they are not in one of the exclusion situations     X   X
Certificates for social security contributions and taxes paid     X   X
Any other data that may be collected by AU-IBAR during project implementation     X   X

1 Personal data of AU-IBAR Staff or Service provider involved in procurement or grant award procedure
2 Personal data of Country/REC/International Organization representatives concluding sub-delegation or partnership agreements with AU-IBAR, acting as contact points and/or participating as members and/or observers in evaluation committees
3 Personal data of Tenderers, grant applicants, implementing partners and their staff, subcontractors, proposed experts

How long do we keep your personal data?

AU-IBAR keeps your personal data for the time necessary to fulfil the purpose of collection or further processing. The retention periods are aligned with the African Union Commission policy on Retention.

Files relating to tenders, grant procedures and related contracts, including personal data are to be retained in the service in charge of the procedure until it is finalised, and in the archives for a period of 7 years following the conclusion of the contract. However, documents from unsuccessful tenderers/applicants have to be kept only for 7 years following the conclusion of the contract/grant agreement.

In case of investigations where irregularities are suspected or have been established in relation to an open file, it can only be closed when: (1) it has finally been established that no irregularity took place; or (2) the irregularity has been rectified, possibly, but not necessarily, as a result of litigation.

AU-IBAR contractors/beneficiaries are under contractual obligation to keep records for a 7 year period after the final payment made under the contract. These documents comprise any documentation concerning income and expenditure and any inventory, necessary for the checking of supporting documents, including but not limited to timesheets, plane and transport tickets, pay slips for the remuneration paid to the experts and invoices or receipts for incidental expenditure.

How do we protect and safeguard your personal data?

All personal data in electronic format (e-mails, documents, databases, uploaded batches of data, etc.) are stored either on the servers of AU-IBAR or of its contractors. All processing operations are carried out pursuant to AU-IBAR’s Personal Data Protection policy.

The AU-IBAR’s contractors are bound by a specific contractual clause for any processing operations of your data on behalf of AU-IBAR.

In order to protect your personal data, the AU-IBAR has put in place a number of technical and organisational measures in place. Technical measures include appropriate actions to address online security, risk of data loss, alteration of data or unauthorised access, taking into consideration the risk presented by the processing and the nature of the personal data being processed. Organisational measures include restricting access to the personal data solely to authorised persons with a legitimate need to know for the purposes of this processing operation.

Who has access to your personal data and to whom is it disclosed?

Within AU-IBAR, access to your personal data is limited to staff and internal service providers responsible for carrying out the relevant processing operation and to the bodies charged with a monitoring or inspection task such as the African Union Commission internal audit function.

Outside AU-IBAR, the following may have access to your personal data:

  • External experts and contractors participating in the evaluation of tenders when external expertise is required;
  • Staff of the contractor or beneficiary who need to have access to the data strictly for performance, management and monitoring of the contract or grant; and
  • Members of the public in accordance with AU-IBAR’s obligation to publish information on the outcome of procurement procedures and on the beneficiaries of funds. The information published on the AU-IBAR website shall include name, domicile country, amount of award and the name of the project

Transfer of personal data to other jurisdictions

Transfers of personal data to other jurisdictions could occur in the context of award procedures, and contract/project implementation in order for AU-IBAR to carry out its task and comply with its obligations. Such transfers would be limited to transfers to representatives of partner countries/RECs, international organizations or services providers to facilitate the implementation of a project or contract and all matters pertaining thereto such as processing of visas and tax exemptions and import permits.

What are your rights and how can you exercise them?

You have specific rights as a ‘data subject’ the right to access your personal data and to rectify them; the right to erase your personal data; and to object to the processing. You can exercise your rights by contacting the Data Controller.