Privacy Notice
Last updated: [date]
DRAFT – not for publication. This notice must be reviewed and approved by a qualified lawyer before it is published.
The short version
- The Civic Engagement Academy is run by the Evidence and Methods Lab (EML) in Kampala, Uganda. We are the data controller for the personal data described here.
- We collect what we need to run the programme: your application, your Fellow account, your attendance and, if you choose, a cohort directory profile.
- Live sessions are recorded. Recordings are shared only with your cohort and the programme team, and are deleted after [retention period – confirm].
- We use analytics cookies only if you click "Accept". Essential storage keeps you logged in and remembers your preferences.
- We never sell your data. We share it only with service providers who help us run the programme, and with KAS where needed to co-issue certificates.
- You can ask to see, correct or delete your data, or object to how we use it, by emailing hello@evidenceandmethodslab.org. You can also complain to Uganda's Personal Data Protection Office (PDPO).
Who we are
The Civic Engagement Academy ("the Academy", "we", "us") is a free online leadership programme run by the Evidence and Methods Lab (EML), Plot 13 Kenneth Dale Lane, Kamwokya, Kampala, Uganda.
EML is the data controller for personal data collected through the Academy website and programme. Certificates are co-issued by EML and the Konrad-Adenauer-Stiftung (KAS) [confirm KAS's full legal name and its role – joint controller, recipient or neither].
- Contact: hello@evidenceandmethodslab.org
- Data Protection Officer: [Data Protection Officer name], [DPO email address]
- PDPO registration number: [PDPO registration number]
We process personal data in line with Uganda's Data Protection and Privacy Act, 2019 (the "Act") and the Data Protection and Privacy Regulations, 2021 (the "Regulations"). We are registered with the Personal Data Protection Office (PDPO) as required by law.
What we collect and why
When you apply
We collect the information you give us in the application form:
- full name, email address and phone number
- gender
- current role, organisation, sector and region
- years of professional experience
- your motivation statement
- how you heard about the Academy (referral source)
Why: to assess your application, select a balanced cohort, contact you about the outcome and, if you are selected, enrol you. We use gender, sector, region and experience to help build a diverse cohort and to report anonymised, aggregate statistics about who applies and takes part. Referral source helps us understand which outreach works.
Your Fellow account
We use one-time-code sign-in: when you sign in, we send a one-time code to your email address. We store:
- your email address and account identifier
- one-time codes (briefly, until used or expired)
- login timestamps and basic technical data such as IP address and browser type, for security
Why: to give you secure access to session links, materials and recordings, and to protect accounts from misuse.
Attendance records
We record which live sessions you attend and for how long [confirm whether duration or join/leave times are recorded].
Why: to award the Certificate of Attendance (which requires at least 85% attendance across the 15 sessions), to follow up if you miss sessions, and to evaluate the programme.
Cohort directory (optional)
If you opt in, we show a profile to other Fellows in your cohort. This may include your name, role, organisation, sector, region, a short bio and [photo / LinkedIn link – confirm fields]. The directory is visible only to logged-in members of your cohort and the programme team.
Why: to help Fellows connect and learn from one another. You can change or remove your profile at any time.
Session recordings
See Session recordings below.
Communications and feedback
If you email us or complete a feedback survey, we keep your messages and responses to answer you and improve the programme. Survey results are reported in anonymised, aggregate form.
Our lawful basis
The Act requires a lawful basis for processing personal data. We rely on:
- Your consent – for submitting your application, joining the cohort directory, analytics cookies and being recorded in live sessions. You may withdraw consent at any time; this does not affect processing already carried out.
- Performance of an agreement with you – for running your Fellow account, recording attendance and issuing your certificate once you have accepted a place.
- Compliance with a legal obligation – for example, keeping records we are required to keep or responding to lawful requests.
- Legitimate interests / proper performance of our functions – for security, preventing misuse, and evaluating and improving the programme, where this does not override your rights. [Lawyer to confirm the precise statutory bases under the Act.]
We do not use your data for automated decision-making that has legal or similarly significant effects on you. Applications are reviewed by people.
Session recordings
All 15 live online sessions are recorded (video and audio). If you speak, appear on camera or use the chat, you may appear in the recording.
- Who can see them: only Fellows in your cohort, facilitators and the programme team, through your logged-in account.
- Why: so Fellows who miss a session can catch up, and so the cohort can revisit the material.
- Your choices: you can keep your camera off, change your display name and use the chat instead of speaking. Tell us if you would like a particular contribution edited out and we will consider your request.
- No public use: we will not publish recordings or use them for marketing without your separate, explicit consent.
- Retention: recordings are deleted [retention period – confirm, e.g. X months after the cohort ends].
Fellows must not make their own recordings or screenshots (see our Code of Conduct).
Cookies and local storage
We use two kinds of storage on your device:
- Essential storage – cookies or browser storage needed to keep you logged in and remember your preferences (such as your cookie choice). These are always on because the site cannot work without them.
- Analytics cookies – used only if you click Accept on our cookie banner. They help us understand how the site is used, in aggregate. If you click Decline, no analytics cookies are set.
Our analytics provider is [analytics provider name]. You can change your choice at any time via [cookie settings link/location].
Sharing and service providers
We do not sell or rent your personal data. We share it only where needed:
- KAS – your name, and confirmation of your completion, to co-issue your certificate [confirm any further data shared with KAS].
- Service providers (processors) that act on our instructions, under written agreements requiring confidentiality and security:
- website hosting: [hosting provider]
- email delivery (including login codes): [email provider]
- video-conferencing and recording: [video-conferencing provider]
- recording storage: [storage provider]
- analytics (only with consent): [analytics provider name]
- Other Fellows – only your opt-in directory profile and what you share in sessions.
- Authorities – where the law requires it.
International transfers
Some of our providers store or process data outside Uganda, for example [video-conferencing provider] and [email provider], which host data in [countries – confirm].
We transfer personal data abroad only where the Act allows it – for example, where the recipient country or the provider offers adequate protection for personal data, or where you have consented. We use [contractual safeguards – confirm, e.g. data processing agreements with standard data protection clauses] to protect your data.
How long we keep data
| Data | Retention |
|---|---|
| Unsuccessful applications | [retention period – confirm] after selection closes |
| Successful applications and Fellow accounts | [retention period – confirm] after the cohort ends |
| Attendance records and certificate records | [retention period – confirm] (so we can verify certificates) |
| Cohort directory profile | Until you remove it, or [retention period – confirm] after the cohort ends |
| Session recordings | [retention period – confirm] |
| Analytics data | [retention period – confirm] |
After these periods we delete data or anonymise it so it can no longer identify you.
How we keep data secure
We take appropriate technical and organisational measures, including:
- encrypted connections (HTTPS) across the site
- one-time-code sign-in with short-lived, single-use codes
- access to personal data limited to staff who need it
- recordings and the cohort directory available only to logged-in cohort members
- [encryption at rest, backups, staff training – confirm]
If a data breach puts your data at risk, we will notify the PDPO and, where required, you, in line with the Act and Regulations.
Children
The Academy is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it.
Your rights
Under the Act you have the right to:
- Access – ask whether we hold your data and receive a copy.
- Correction – ask us to correct inaccurate or incomplete data.
- Deletion – ask us to delete data we no longer need or are not entitled to hold.
- Objection – object to, or ask us to stop, processing your data, including for direct marketing.
- Withdraw consent – at any time, where we rely on consent.
- Complain – to the PDPO (see below).
How to exercise your rights
Email hello@evidenceandmethodslab.org or our DPO at [DPO email address]. We may need to confirm your identity. We will respond within [response period – confirm statutory timeframe]. There is normally no charge.
You can update your directory profile yourself at any time through your account.
Complaints
If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to:
Personal Data Protection Office (PDPO) [PDPO postal address] [PDPO website and email – confirm]
Changes to this notice
We may update this notice, for example if we change providers or for future cohorts. We will post the new version here with a new "Last updated" date and tell enrolled Fellows by email about significant changes.
Contact us
Evidence and Methods Lab (EML) Plot 13 Kenneth Dale Lane, Kamwokya, Kampala, Uganda hello@evidenceandmethodslab.org Data Protection Officer: [Data Protection Officer name], [DPO email address]