We take data protection very seriously, so please review our privacy statement below.

1. We use the data you provide about your users exclusively for providing them access to federated systems. We never give out any user information except for selected data of properly registered SAML Service Providers, and only in case of the transaction is initiated and confirmed by the user.
2. All released data is encrypted by the public key of the Service Provider targeted by the user, thus only decipherable by the targeted service, not in transit.
3. We never send any e-mails to users except for sending out password reset tokens.
4. Nobody can read users' passwords, they are stored securely. Only the person having control over a user's mailbox can reset the password to a new value.
5. All user data is stored and handled securely, following to the latest security best practices.
6. We are not to any extent responsible for:
   1. how a Service Provider implements data protection;
   2. the accuracy of the personal data that is submitted by Identity Provider Administrators;
   3. whether Identity Provider Administrators have legal rights to submit data to this service;
   4. any kind of user activity in eduid.africa system or other relying systems.
7. Any personal data is irrevocably deleted if we receive credible information that:
   1. the data submitted to this service is not accurate, misleading, threatening or it was previously collected or submitted illegally;
   2. the data subject (user) did not agree in submitting their data;
   3. the data subject (user) requests the removal of the data;
8. We remove all data associated with your Identity Provider (including users' personal data) if you unsubscribe from this service, or the Identity Provider is abandoned. The Identity Provider is considered abandoned if any of the following conditions apply:
   1. no successful user logins are performed for 365 consecutive days, or
   2. you do not settle our invoice for more than 60 calendar days after the first notice.

This service is operated by XXX, registered in Country. For any questions about data protection, do not hesitate to contact us at privacy@example.org.