The following principles, drawn from the NDPA's general processing standards, govern every system and process described in this policy — most concretely, the Foundation Operations Platform that is the Academy's system of record.
Principle
What it requires
How the Academy applies it
Lawfulness, fairness, and transparency
Process personal data only on a valid legal basis, and be open about it.
This policy, plus purpose-specific notices at the point of collection (e.g., the beneficiary intake form, the donation form).
Purpose limitation
Collect data for specified, explicit purposes; do not reuse it for incompatible new purposes without a fresh basis.
Each data field in the operations platform maps to a stated purpose (Section 7); repurposing requires a documented review.
Data minimization
Collect only what is adequate and necessary.
No demographic fields (date of birth, gender, etc.) are collected without a clear purpose and, where applicable, consent — a rule written directly into the platform's data model.
Accuracy
Keep personal data accurate and up to date.
Staff correct records on request; donors and beneficiaries may request correction at any time (Section 15).
Storage limitation
Keep personal data no longer than necessary for its purpose.
Retention schedule in Section 13; financial records are the exception, kept to meet statutory and audit requirements.
Integrity and confidentiality
Protect personal data with appropriate technical and organizational security.
Role-based access control, environment-based secrets, and on-delete safeguards described in Section 14.
Accountability
Be able to demonstrate compliance with the above.
This policy, the platform's role/permission design, and the records-of-processing approach in Section 19.