01Scope and applicable framework
This notice covers the shared institutional portal. School admissions, university admissions and parish requests are handled through separate forms and services; their specific notices apply alongside this one.
Gabonese Law No. 025/2023 amends Law No. 001/2011 on personal data protection. The law sets out information, rights, security, children's data, sensitive data and international-transfer requirements. Publishing this notice does not replace any filing, authorization or other formality required for a particular processing activity.
The project records do not establish one legal person as controller for every service. The Institution must identify the controller for each purpose before the relevant collection takes place.
02Public-service data flows
The code shows the following public-service flows. The legal basis and retention schedule for each flow must be confirmed by the responsible entity; neither can be inferred reliably from the code alone.
03Service providers and transfers
The code uses Vercel for deployment, Supabase for selected data and authentication services, Sanity for selected editorial content, Resend for email delivery and Cloudflare Turnstile for anti-bot checks. OpenAI is used for certain assistant and message-rewriting features when those features are invoked. Google Tag Manager is loaded only after cookie consent and only when an identifier is configured; the tags inside the deployed container are not available in the repository. Public Google Maps embeds and YouTube players connect to their providers only after a visitor action.
These providers may process information on infrastructure outside Gabon. The exact service region, contracts, transfer safeguards and applicable APDPVP formalities depend on the production configuration and must be verified by the relevant controller. No exact transfer mechanism is claimed here.
04Security, retention and automated decisions
The application implements access controls and technical measures for specific services. This notice does not claim that every record has a verified retention period or that every service has completed a legal-compliance review. The responsible entity must set and document a retention period for each purpose and review access to the relevant data.
The public forms reviewed create or forward requests for human follow-up. No automated decision about admission or parish requests was identified in those flows. No user profiling for advertising was identified in the code reviewed.
05Your rights and how to contact the responsible service
Depending on the applicable rules and the circumstances of the processing, a person may request access, correction, updating, erasure, restriction or objection, and may raise a complaint with the APDPVP. The request should identify the service and the data concerned. The responsible service may need to verify the requester's identity and authority before disclosing information.
The Institution must publish a verified contact point for privacy requests for each service. The public contact details currently differ between the portal, school and university; they are listed as items for administrative confirmation rather than being treated here as a verified legal identity.
