Privacy & data protection

HJRA Continental Leadership Training Academy operates this platform for applicants, cadets, staff, alumni and supporters. For privacy questions or requests, write to us at the contact address published on our website. We will confirm our registered legal entity name and postal address on this page once finalised.

Applicants and cadets: the information you enter in your application and profile — identity, contact, education, health declarations, consents, uploaded documents — plus assessment, formation and academic records created during training.

Staff and supervisors: employment and role information needed to run the academy, together with the records you create in the system.

Donors and supporters: your account email, the amount, currency, date, reference and designation of each gift, and — if you provide them — a name, address, tax identifier and message. Country is kept separately so we can show the map of where our supporters are, without any street address or name.

Technical: sign-in session data and basic security logs. We do not use advertising or tracking cookies; the only cookies and local storage we use keep you signed in and remember your language and theme.

Card payments are completed on the secure payment page of our payment provider, DPO Pay (Direct Pay Online). Your card number, expiry and security code are entered on their systems, never on ours. We receive only a transaction reference and the payment status. We never see, store or process card data. Bank-transfer gifts reach us as a reference code plus the amount confirmed by our finance office.

Your name for receipts, your address and your tax identifier are encrypted in your own browser, with a key derived from a passphrase that never leaves your device. What reaches our database is unreadable text. There is no decryption key on our servers and no staff tool that can reveal these fields — academy staff, administrators and the platform operator see only "Protected".

The same applies to the contributor name, email and personal message attached to each gift when you are signed in with protection switched on. Amount, currency, date, reference, payment method and designated cause stay readable, because our finance office must account for every gift and issue audited reports.

Because only you hold the key, we cannot recover these details if you lose your passphrase. In that case you clear them from your donor dashboard and enter them again. Receipts that carry your name and address are produced in your browser for you to print or save.

To assess applications, run training and formation, keep academic and field records, communicate with you, account for gifts and comply with legal, audit and safeguarding obligations. We rely on your consent where you give it, on our agreement with you where you are a cadet, staff member or donor, and on our legitimate interest in running the academy safely.

Access inside the platform is limited by role and enforced in the database, not only in the screens: cadets see their own records, captains and supervisors see the cadets assigned to them, and leadership sees what their responsibilities require. Sensitive categories such as medical episodes are restricted further to medical officers and named leadership. Every role and status change is recorded in an audit log.

We do not sell personal data and we do not share it with advertisers. We share it only with service providers who operate the platform for us (hosting and database, email delivery, the payment provider), and where the law requires it.

Applicant records are kept while the application is live and for a limited period afterwards; cadet, academic and formation records are kept as part of the academy's permanent register; financial records are kept for the period required by audit and tax rules. Exact retention periods will be confirmed on this page. Where a role changes and an administrator chooses to erase a person's input, that person's contributed content is deleted while assessment scores, library material, courses and examinations remain, as they belong to the academy's record.

You may ask for a copy of your data, ask us to correct it, ask us to delete it where we are not required to keep it, withdraw a consent you gave, or object to a particular use. Donor details protected by your passphrase are already under your sole control: you can change or erase them yourself at any time. Write to our contact address and we will respond within a reasonable period.

All traffic is encrypted in transit. Access to data is governed by row-level rules in the database, privileged operations are logged, and the platform is scanned regularly for permission errors. The donor fields described above are additionally encrypted end-to-end so that even a full database disclosure would not reveal them.

We will update this notice when our practices change, and the date at the top will change with it.