Privacy Policy

1. Who we are

Uganda Culture is a free website that documents Uganda's cultures together with the communities who hold them. It is run by Uganda Culture, based in Uganda. In this policy, "we", "us" and "our" mean Uganda Culture, the organisation responsible for Uganda Culture.

We decide why and how the personal information described here is used, and we are responsible for looking after it under Uganda's Data Protection and Privacy Act, 2019, and the Data Protection and Privacy Regulations, 2021.

This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to the Uganda Culture website and to the emails we send.

How to contact us

If you have a question about this policy or about your information, email us at [email protected] or use our contact form. To ask for a copy of your data or for it to be erased, use the Your data form.

2. Our approach

We collect only what we need to run the site and to document culture responsibly. Reading Uganda Culture is free and does not need an account. We do not show adverts, we do not use advertising or analytics cookies, and we do not sell personal information.

Much of what we publish is about people: elders, narrators, musicians, craftspeople and families. We treat their information with the same care as yours. Every record credits the people who shared it, and living people are named only with their consent.

3. What we collect and why

What we collect depends on how you use Uganda Culture. The sections below describe each situation.

When you visit the site

When you open a page, your browser sends technical information, such as your IP address, the page you asked for, the date and time, and the type of browser you use. Our hosting provider and Cloudflare, which delivers the site and protects it from attacks, process this information so that pages reach you and the site stays secure. We use it to keep the site running, to find and fix faults and to stop abuse. We do not use it to build a profile of you.

We set a small number of cookies. They are described in our Cookie Policy.

When you join the newsletter

Our newsletter is sent about once a month. To sign up, you give your email address and, if you wish, your name. We then send you a confirmation email, and you are added to the list only after you confirm. This is called double opt-in.

As proof of your consent, we keep your email address, your name if you gave it, where on the site you signed up, when you agreed, when you confirmed, and a one-way hash of the IP address you used. A one-way hash is a scrambled code that cannot be turned back into your IP address. Every issue contains a one-click unsubscribe link, and you can also manage your choice on the newsletter page or your account page.

When you contribute

You can send us stories, photos, audio, video links, recipes and events through Contribute, with or without an account. We keep what you send, your name and email address so that our editors can contact you about it, and how you would like to be credited. You can choose to be credited by your name, by another name, or not publicly.

When you contribute, you accept the Contributor Agreement. We record which version you accepted and when. Editors review every contribution, a separate person approves it, and only then does an editor publish it.

Contributions often include information about other people, such as relatives, elders or the narrator of a story. Please share information about another person only if they have agreed. Section 5 explains how consent works for narrators and for children.

When you have a member account

To register, you give your first name, surname, email address and a password. You may also give a phone number and your interests. We ask where you live, as a district or town, and whether you would like the newsletter. We record that you accepted the Terms of Use and the Contributor Agreement, with the version and the time.

Your password is stored only as a secure hash, so we cannot read it. Each time you sign in, we send a six-digit code to your email address. We keep a record of these codes so that we can check them and limit misuse. We use your account details to run your account, to show your contributions and credits as you chose, to keep your account secure and to send you the messages you asked for.

You can see and change your details at any time on your account page, and you can close your account there.

When you contact us

When you write to us through the contact form, suggest a correction, ask for removal or make a data request, we keep your name, your email address, what you wrote and the date. We use this to answer you, to act on your request and to keep a record of what we decided. Our forms are protected against abuse by rate limits, which restrict how many messages can be sent in a short time.

If you are a member of staff

Staff accounts on our administration system use two-step sign-in, with an authenticator app or a passkey. We record staff actions in an audit log, so that every change to the site can be traced to the person who made it. This protects the people and communities whose information we hold, and it protects staff by showing clearly who did what.

4. Our lawful bases

We use personal information only where the Data Protection and Privacy Act allows it. Depending on the situation, we rely on one of these grounds:

• Your consent: for the newsletter, for naming living people, for recording and publishing oral histories, and for contributions about or showing children.
• A contract with you: to provide your member account under the Terms of Use, and to handle your contributions under the Contributor Agreement.
• A legal obligation: to answer data requests, to keep records the law requires and to respond to lawful requests from the authorities.
• Other grounds the Act allows: such as keeping the site and our records secure, preventing abuse and keeping an audit trail of editorial decisions.

5. Consent

Your consent

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not make unlawful anything we did before you withdrew it. To withdraw, use the unsubscribe link, your account page, the Your data form, or email us at [email protected].

Narrators and people named

Oral histories, including those in Voices of Uganda, are recorded and published only with the narrator's consent. A narrator can withdraw consent at any time. When consent is withdrawn, the record is hidden from the site, from our API and from search.

Every record has a sensitivity level. Open records may be published after review. Sensitive records need sign-off from the community concerned before they are published. Restricted records are never published.

If you are named or shown on Uganda Culture and did not agree, or if you no longer agree, use Request removal. We acknowledge removal requests within 48 hours and decide them within 7 days. When the request comes from the person named, their family, their community or the rights holder, we hide the page while we review it.

Children

Anyone under 18 needs the consent of a parent or guardian to register or to contribute. Contributions about children, or that show children, need the consent of the child's parent or guardian. If you think a child's information has been shared without that consent, please tell us through Request removal.

6. Who we share it with

Services that work for us

We use a small number of service providers, called processors, who handle personal information on our behalf and only on our instructions:

• our hosting provider, which runs the servers that hold the site and its data;
• Cloudflare, which delivers the site and protects it from attacks, and which sees visitors' IP addresses;
• an S3-compatible storage provider, which holds photos and other files;
• an email delivery provider, such as Postmark, Mailgun or Amazon SES, which sends sign-in codes, confirmations and the newsletter;
• Africa's Talking, which sends text messages, if text messages are switched on.

Services your browser contacts

Some pages load content directly from other organisations. When a page shows a map, your browser fetches map tiles from OpenStreetMap servers, which see your IP address. When you open a page with an embedded video, your browser contacts YouTube, through its privacy-enhanced mode at youtube-nocookie.com, or Vimeo. These organisations act under their own privacy policies. Our Cookie Policy has more detail.

What we publish

When a contribution is published, it appears with the credit you chose. We do not publish your email address, phone number or where you live.

When the law requires it

We may disclose personal information where the law requires us to, for example in response to a valid court order.

We never sell it

We do not sell, rent or trade personal information, and we do not share it with advertisers.

7. Transfers outside Uganda

Some of our service providers may store or process information outside Uganda. When this happens, we choose providers that give an adequate level of protection for personal information, and we transfer information only as the Data Protection and Privacy Act allows.

8. How we protect it

We take care to keep personal information safe. Our measures include:

• storing passwords only as secure hashes;
• a six-digit code sent by email each time a member signs in, with the account locked for 60 minutes after five codes;
• member sessions that last at most 24 hours and end after 60 minutes without activity;
• two-step sign-in for all staff, and an audit log of staff actions;
• rate limits on our forms, and protection from Cloudflare against attacks;
• review by editors and a separate approver before anything is published, and restricted cultural knowledge that is never published.

No system is perfectly secure. If a breach puts your information at risk, we will act as the law requires, including informing the Personal Data Protection Office.

9. How long we keep it

We keep personal information only for as long as we need it. Some information, such as used sign-in codes, contact messages, declined submissions and data from closed accounts, is deleted after a set period. Published contributions are kept while they are published. Consent records are kept for as long as the record they cover exists, and afterwards for as long as we may need to prove that consent was given.

The table below shows how long we keep each kind of information. It is updated automatically when our settings change.

10. Your rights

Under the Data Protection and Privacy Act, 2019, you have the right to:

• know what personal information we hold about you and how we use it;
• get a copy of your personal information;
• have information that is wrong or incomplete corrected;
• ask us to erase your personal information;
• object to, or ask us to stop, a particular use of your information;
• withdraw your consent at any time where we rely on it.

How to use your rights

You can ask for a copy of your data, or for it to be erased, through the Your data form or by emailing us at [email protected]. We will first check that you are who you say you are, so that we never give your information to someone else. We will then answer within 30 days.

We may need to keep some information where the law requires it, or to prove that consent was given. If so, we will tell you what we kept and why.

Members can see and change most of their details directly on their account page. To correct a published record, use Suggest a correction. To have a page about you removed, use Request removal.

11. Complaints

If you are unhappy with how we have handled your information, please tell us first at [email protected], and we will try to put it right. You also have the right to complain to the Personal Data Protection Office, which oversees the Data Protection and Privacy Act in Uganda.

12. Changes to this policy

We may update this policy when the site or the law changes. The date of the current version and a note of what changed are shown on this page. When a change needs your acceptance, members are asked to accept the new version before they continue. If you have any questions about a change, email us at [email protected].