Privacy policy

Yoma (Youth Agency Marketplace)s is a digital platform where youth can develop their skills, find opportunities, and achieve impact - while connecting to peers in a supportive community. Our mission is to positively impact youth, local communities, and the world! We are developing a digitally enabled ecosystem that is youth centric, provides value to all players and links up talent with opportunities and professional/entrepreneurial pathways.

We use the information we collect to provide you with a better learning-to-earning experience and fulfill our mission of providing free, accessible skills development, impact, and employment opportunities to youth worldwide. RLabs is a non-profit organization, so that a commercial for-profit motive will not interfere with our mission of providing a trusted ecosystem for youth.

Our Privacy Policy is based on the commitment to the following Privacy Principles:

1. Self-Sovereign Identity (SSI). This means that all the users on Yoma are in complete control and ownership of their data. They decide what data they want to share and with whom.

2. Data portability. As part of being SSI-focused, our users are able to use the data from Yoma on other platforms, even offline, for example, personal identification. The data that is gathered and generated by Yoma has value beyond the platform itself.

3. Data minimization. We understand how valuable our users' data is to them, and for that reason, we only collect data that we need in order for our users to benefit from the services offered by Yoma.

In order for us to continue discussing the Privacy Policy, we need to understand some key terms used in the document.

a) Platform – This refers to everything that Yoma offers online. It encompasses various devices and services, listed below.

b) Website – This is the Yoma website that is accessed through a browser on either a computer or mobile device.

c) Desktop – This refers specifically to the website accessed only via computer or laptop.

d) Services – The services refer to the backend development and data handling procedures that have been built in order to offer the experience that users receive. The backend development and data handling define the scope of the tools that the platform offers our users. For example, one of our services is the ability for a youth to take part in an opportunity or challenge with an opportunity partner. Another example might be the ability for opportunity partners to be able to verify and reward youth for successfully completing a challenge. The services offered by Yoma have been designed in such a way that we only require a small about of personal data in order for us to offer our services (data minimization.)

e) Partners – We have a number of different partners that provide value to youth on the platform. Below are the types of partners involved currently.

- Opportunity partners (OP). These are independent opportunity providers who list their opportunities on Yoma for youth to participate in. They are responsible for hosting, managing, reviewing and rewarding youth for completing opportunities.

◦ Our current list of opportunity partners on the platform comprises of:

• Atingi

• Rlabs

• Umuzi

• Africa Coding Network

• Goodwall

Introduction

This is the main privacy policy for Yoma, and it applies to all our Platforms.

Yoma ("We") respect your privacy and are determined to protect your personal data to create a safe and secure environment for all users.

Note: For each section in this Privacy Policy, you can view all general privacy practices at the beginning of the section and see more information by reviewing "Learn More" for the relevant section.

Purpose

This privacy notice explains you how we protect your privacy and how we collect and process your personal data through your use of this platform (regardless of where you visit it from). We'll also tell you about your privacy rights and how the data protection law protects you.

Data Controller

RLabs is the controller and responsible for your personal data (collectively referred to as "we", "us" or "our" in this privacy policy). Our contact details of the person responsible for our personal data compliance is Desme Jacobs, [email protected]. RLabs is the controller and responsible for this website. Physical and postal address 54 Kiewiet Road, Bridgetown, Athlone 7764 Cape Town, Western Cape, South Africa

Third-party links

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit. The plug-ins that are used on Yoma do however delete all your data once you close the session, so there is no risk of your data being stored anywhere after you've left the site.

The Information we collect

a) Personal Data in the User Profile

When you register on Yoma, you can choose a password and provide first name, last name, country of residence and a valid email address. We require your full name, e-mail address and password to successfully create an account and provide login credentials. After registration, users can access and revise their profile at any time and edit or update the data provided during the registration. Users can only access their own profile. The personal data provided cannot be viewed by other users. Registered users can also use a profile picture for their profile, which is visible to other users. The e-mail address is also used to send the user information on specific opportunities provided by Yoma or partner institutions, provided that these offers are compatible with the goal of providing learning to earning opportunities. Users have the possibility to object to this use at any time. In order to enable the user to make the best possible use of the platform offerings and to fulfil the purpose of Yoma, the e-mail address is also used to send the user information on specific opportunities provided by Yoma or partner institutions, provided that these offers are compatible with the goal of providing learning to earning opportunities. Users have the possibility to object to this use at any time.

Retention period: 12 months, or until the user requests that their data be deleted from the platform.

b) Other Personal Data

When you use the Yoma website and services, we may collect other information about your activities on the Website, including challenges or competitions you have participated in and content you have submitted as part of those activities, or content you post in public or private portions of the site. All actions undertaken while using the platform will be stored in a way that allows tracing back which account undertook certain actions.This includes any information that you provide to us directly, whether through our platforms, personal interaction or via phone, SMSs or any other medium.

Retention period: 12 months, or until the user requests that their data be deleted from the platform.

c) Technical and Log Data

When you access and use Yoma, log data will be stored. We collect or retrieve your information using technologies such as cookies, web beacons (explained below) and other technologies. Depending on how you access and use our platforms, this may include information about your interactions with our platforms, browser or device information (for example the type of device you're using, how you access our platforms, your browser or operating system, and your Internet Protocol ("IP") address). Please see our cookie policy for further details. The log data will be analysed in an anonymised form. Log data for the last 12 months is visible to the administrators. Additionally, administrators do have access to the database to trace back which user contributed certain posts or undertook certain actions in case of improper use or use of abusive language. Other participants do not have access to the data. Thus, this data cannot be seen by the other participants or partners.

Retention period: 12 months, or until the user requests that their data be deleted from the platform.

Cookies:

Web beacons:

The Information we do not collect

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offenses.

If you choose not to provide your personal data

Where we need to collect your personal data, or under the terms of this privacy notice, and you fail to provide that data when requested, we may not be able to offer you the experience/service you expect.

How we collect Information

1. We collect information directly from you. This includes personal data you provide when you:

• Register and create an account on our website

• Update your profile or post in public areas

• Participate in specific features or offerings

2. We may collect information from others, such as Yoma

• Register on Yoma via one of the opportunity partners

• Choose to participate in a challenge from an opportunity partner

• Ask for verification of a completed learning opportunity

• Want to redeem Zltos

3. We collect some information automatically, such as technical data about the devices and activities you undertake on the platform. Data

is collected when you:

• Log in to the platform

• Interact with our website and offerings

Why we use the Information

We use the information collected for the following purposes:

• Providing access to the platform and to the related services

• Customising the platform and your user experience

• Communicating with you regarding your account (e.g., if we may want to notify you about changes to our platforms or provide you with information about services)

• Informing you about specific opportunities and/or offers on the platform that may be of interest for you (based on your consent).

• Analysing and improving our services based on aggregated information

Comment on the purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the purpose and legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Transparency: Roles and Permission

Yoma Youth

Yoma youth are the holders of their own data and are permitted to engage across opportunities, challenges and impact tasks, as well as apply for jobs found on Yoma. The Yoma Youth are able to build their own digital CV, and share their CV with employers on the platform, in accordance with self-determination. They are also able to earn and spend digital currency on the marketplace.

Opportunity Provider (OP)

OPs provide challenges, courses, and tasks for Yoma Youth to engage with. They are also responsible for issuing verified credentials to the Yoma Youth on successful completion of the challenge, course, or task. OPs are not able to initiate contact with Yoma Youth, however once a Yoma Youth has applied to take part in a challenge, course or impact opportunity, the OP is able to connect with them on their own website/platform. OPs do not have access to any youth data unless the youth actively initiate a connection with the OP in the form of taking part in a challenge. At this point, the OP will be able to view the youth member's name, surname, and email address.

Employment Provider (EP)

Much like OPs, EPs are not able to initiate a connection with Yoma Youth. Rather, the EP lists an employment opportunity for Yoma Youth to browse, and only once the Yoma Youth has shown interest and would like to form a connection to share their CV, is the EP able to communicate with the Yoma Youth. Like the OPs, once the connection is formed between the EP and Yoma Youth, the relationship will be managed off the Yoma portal, and between the Yoma Youth and EP. EPs do not have access to any youth data unless the youth actively initiate a connection with the EP in the form of showing interest in a possible job opportunity. At this point, the EP will be able to view the youth member's name, surname, and email address. The youth will be able to share their digital CV, as per above, with the EP. Any information shared between these two parties beyond the Yoma platform is beyond our control.

Yoma Technical Team

This is the design and development team responsible with building and maintaining the platform. Only members of this team have access to the various databases and user information that is not encrypted. Access to the database is done strictly under the request 10 of the Product Owner and is limited to the fields specifically needed. This is often done when there is a user that is unable to access certain elements or features of Yoma, and the technical team is required to troubleshoot against a specific username and criteria. The technical team has access to all database information including, user email addresses for youth, OPs and EPs as well as name, country of origin and contact details. The technical team has been instructed to not look into the database unless expressly told to do so by the Product Manager or CTO. This is usually only done when there is a bug or query whereby the technical team needs specific details in order to help the user or diagnose a problem.

• We are committed to protect your personal information. We don't share your personal information with or give access to third parties unless you provide explicit consent to do so. Before any information is shared, we will ask for your consent and let you know what information is needed, why it is needed and with whom we are planning to share it. You may decide whether or not you want us to share your information. Circumstances in which we may share personal information with third parties:

• We may share information with ecosystem partners or third-party providers.

We may share information with ecosystem partners or third-party providers. Ecosystem partners are partners on the platform such as OPs and EPs who are actively engaged in connecting with the youth and other OPs/EPs on the platform. Third parties are service providers who offer a service to Yoma as a means to improve or optimise the service offering, for example, a third-party chat bot to help deal with user queries.

Let's take a closer look at how, when, and why we may share data with these two parties.

• Our partners in the Yoma ecosystem consist of a number of different organizations that all collect customer information, this may include access to: Personal Information and Usage Information, to facilitate their services. We restrict the user's Personal Information that we share with them to the minimum data required by them for them to be able to offer their specific services. We require our Partners to maintain privacy and security of this data and limit their usage of the data provided to the extent applicable for executing their services. Specifically, the only data we share with our opportunity partners is your name and country when you want to participate in a challenge. When it comes to our employer partners, we give you the ability to share specific parts of your CV when you apply for a job. For example, you can choose not to share your previous work experience with employer partners if you don't want to. We also share your email address with them so that if they are interested in taking the conversation further, they are able to contact you directly.

• Third parties where you provide consent. In some cases, third parties may wish to obtain information about you in order to promote their products to you, or for whatever other reason. We may share information with third parties where you provide consent in the form of explicit opt-in. Such circumstances may include (but are not limited to) an entry into a competition sponsored by a third party where the provision of your information is a condition for entry to the competition, or where you express your interest in a product or service for which you would like more information. We will also ensure that your opt-in is explicit and that we provide a clear description of what data would be shared with the third party. Remember that once you have opted in to allow us to send your information to the third party, we cannot control what they do with your data; therefore, be sure to investigate their privacy policies before providing permission for us to share your information.

We also may share your personal data with Analytics providers [such as Google, based outside the EU]; search information providers [such as Google or Bing, based inside OR outside the EU] and/or Social Media sites [such as Facebook, Twitter, LinkedIn, based inside OR outside the EU]. All user data is assigned to a personal decentralized identifier (DID). These DIDs are held by the user and are paired with other DIDs through asymmetric key pairs which are cryptographically stored, and are used to create connections, sign contracts, issue credentials and issue rewards.

We may have to share your personal data with the parties set out below for the purposes set out in the table above.

• External Third Parties Service

• Providers based in the UK who provide IT and system administration services

• Professional advisers including lawyers, bankers, auditors and insurers based in the UK who provide consultancy, banking, legal, insurance and accounting services.

• Carefully selected external consultants who support Yoma in delivering their service to members.

• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Links to Third-Party Websites:

• There are different types of learning, earning and impact opportunities provided on Yoma. These opportunities are generally provided by partners of Yoma. To access an opportunity, our platform may provide links to third-party websites.

• An additional registration on the partner's platform may be required. Do note that other websites may have varying Terms of Service, Privacy Policies and Copyright Policies. We advise our customers to read the policies governing third-party websites and note the Personal Information collected by them, before using the website.

• Our Privacy Policy applies only to content, use, data collection and privacy relating to our website and platforms.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Your Legal Rights

Unless subject to an exemption under the data protection laws, you have the following rights with respect to your personal data:

• Be informed that your personal information is being collected – at the point of collection – and the purposes for which it is being processed, retention periods and who it will be shared with;

• Access personal data held and processed by us;

• Rectification of any personal data that is inaccurate or incomplete;

• Erasure, or right to "be forgotten" if you would like to remove yourself and your data from the platform. This is initiated and executed by the youth/user;

• Erasure, or right to "be forgotten" if your data is no longer necessary for the purpose for which it was collected and Consent is the lawful basis for processing;

• Request that processing is restricted although we may still store their personal data; this is an alternative to requesting erasure of your data and the restriction is likely to be for a fixed period;

• Data portability if data is processed by automated means, which means to receive your data, or some of your data, in a format that can be easily used by another person (including the data subject themselves) or organisation;

• Object to processing in certain circumstances, including preventing the use of their data for direct marketing;

• Request human intervention if automated decision-making or profiling is used.

If you wish to exercise any of the rights set out above, please contact [email protected].

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests, but should not exceed more than two months. In this case, we will notify you and keep you updated.

Changes to this Notice and your Duty to Inform us of Changes

This Privacy Notice is reviewed periodically in line with our policy review schedule.

Please keep us informed if your personal data changes during your relationship with us. It is important that the personal data we hold about you is accurate and current.

If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information Commissioner's Office. You can contact them as follows:

Commissioner

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England, UK

Tel.: +44 3031231113,

E-Mail: [email protected] or by using the following Link

Contact formular: https://ico.org.uk/global/contact-us/email/

All data is currently stored in the UK in accordance with EU- and UK-GDPR regulations and standards.