How Good Forests Foundation Uganda collects, uses, shares and protects personal data.
Plain-language summary. We use personal data to respond to enquiries, administer donations and partnerships, manage participation and improve and secure our website. We do not sell personal data.
Who we are and the scope of this Policy
Good Forests Foundation Uganda (“GFU”, “we”, “us” or “our”) is a Ugandan non-profit organisation working in reforestation, agroforestry, farmer livelihoods, forest restoration and sustainable value chains. This Privacy Policy applies to personal data collected through deeppink-kudu-110177.hostingersite.com, related online forms and digital communications that link to this Policy.
For purposes of Uganda’s data-protection law, GFU is the data controller where it determines why and how personal data is processed. A partner may be an independent or joint controller where it separately determines those purposes and methods; any additional notice provided for a particular programme or service will also apply.
Personal data we collect
Information you provide
- Contact and enquiry data, including your name, email address, telephone number, organisation, subject and the contents of your message.
- Supporter and partnership data, including interests, affiliation, correspondence, meeting notes and information needed to assess or administer a partnership.
- Donation and transaction data, including donor identity, contact details, amount, currency, date, transaction reference, receipt details and any lawful donor preferences. Banks, mobile-money operators or payment providers may collect payment credentials directly; GFU does not intend to store full card numbers, PINs or mobile-money passwords.
- Volunteer, employment, consultancy or procurement data, including CVs, qualifications, work history, identification and references where you submit an application or expression of interest.
- Programme and event data, including registration, attendance, feedback, location, monitoring information and photographs, audio, video or stories where a separate lawful basis and appropriate notice or consent applies.
- Communication preferences, including whether you wish to receive newsletters, updates, invitations or fundraising communications.
Information collected automatically
When you use the website, servers and authorised service providers may record technical and usage data such as your IP address, device and browser type, operating system, pages viewed, referring page, dates and times, approximate location derived from IP, error reports and cookie or similar identifiers.
Information from other sources
We may receive limited personal data from payment providers, programme partners, event organisers, public sources, social-media platforms or a person who refers you to us. We will only use such data where the source was authorised to share it and our processing is lawful.
How and why we use personal data
- Respond to enquiries, requests and complaints and maintain related records.
- Process donations, issue receipts, prevent fraud and provide donor or impact communications.
- Assess and manage volunteering, employment, consultancy, procurement and partnership opportunities.
- Plan, implement, monitor and evaluate forestry, livelihood, training and community programmes.
- Publish impact information, stories or media where lawful and appropriately authorised; public reporting should use aggregated or de-identified information where practical.
- Operate, maintain, secure, troubleshoot and improve the website and our information systems.
- Send newsletters, event notices and fundraising or programme updates where you have consented or where another lawful basis permits, always with an available opt-out for direct marketing.
- Meet legal, regulatory, safeguarding, donor, accounting, audit and record-keeping obligations and establish, exercise or defend legal claims.
Legal bases for processing
Depending on the activity, we rely on one or more lawful grounds recognised under applicable Ugandan law:
- Your informed consent, which you may withdraw for future processing at any time.
- Taking steps at your request or performing a contract with you.
- Compliance with a legal or regulatory obligation.
- Our legitimate interests, or those of a partner or third party, where those interests are not overridden by your rights and reasonable expectations; examples include responding to enquiries, securing systems, preventing fraud and improving services.
- Protection of vital interests, performance of a public-interest task or another ground allowed by law, where relevant to programme or emergency circumstances.
Where information is optional, we will try to identify this. If required information is not provided, we may be unable to respond, process a donation or application, or provide the requested service.
Cookies and similar technologies
The website may use cookies, local storage, pixels or similar technologies. These may be set by GFU or by authorised providers that support hosting, security, analytics, maps, video, social-media features or donations.
- Strictly necessary technologies help pages, forms, security and user choices function.
- Analytics technologies help us understand website use and improve performance.
- Preference technologies remember choices such as language or cookie settings.
- Third-party or embedded-content technologies may be set when you view a map, video, social feed or payment tool.
Where consent is required, non-essential technologies should remain disabled until you choose to allow them. You can change available cookie settings or use your browser controls. Blocking some technologies may affect website features. GFU should publish or configure a separate cookie notice when the final list of tools and retention periods is confirmed.
When we share personal data
We may share only the data reasonably necessary with:
- Website hosts, email providers, database and cloud-service providers, IT support, analytics providers and other processors acting under appropriate instructions and safeguards.
- Banks, mobile-money operators, payment processors and financial-service providers involved in a donation or transaction.
- Programme funders, implementing partners, consultants, auditors and professional advisers where sharing is necessary, lawful and subject to appropriate confidentiality or data-protection obligations.
- Government authorities, regulators, courts, law-enforcement bodies or other persons where disclosure is required or permitted by law or needed to protect rights, safety or property.
- A successor or reorganised entity in connection with a lawful merger, transfer or restructuring of GFU’s activities, subject to appropriate safeguards.
We do not sell or rent personal data. We will not disclose identifiable beneficiary information to donors or the public merely for reporting where aggregated or de-identified information is sufficient.
International transfers
Some service providers or partners may store or process data outside Uganda. GFU will only make an international transfer where it is permitted by applicable law, including where the destination provides adequate or equivalent protection, appropriate safeguards are in place, or the individual has given valid consent when consent is the required basis. We will also take reasonable steps to prevent unauthorised onward transfers.
How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purpose collected, including legal, accounting, donor, safeguarding and dispute-resolution requirements. The exact period depends on the record and context. Our working retention approach is:
- General enquiries: normally up to 24 months after the matter is closed, unless a longer period is justified.
- Unsuccessful applications: normally up to 12 months after the process ends, unless you consent to longer consideration or law requires otherwise.
- Donation, accounting and audit records: for the period required by applicable financial, tax, donor and audit rules.
- Marketing records: until you unsubscribe or withdraw consent, plus a minimal suppression record where needed to respect your choice.
- Security and technical logs: normally up to 12 months unless a longer period is needed to investigate an incident.
- Programme, safeguarding and media records: according to an approved programme-specific retention schedule, participant notice, consent terms, donor requirement and applicable law.
At the end of the applicable period, we will securely delete, destroy or de-identify the record so it cannot reasonably be reconstructed or linked to you.
Security and data breaches
GFU uses reasonable administrative, organisational and technical safeguards designed to protect personal data against loss, misuse, unauthorised access, alteration, disclosure or destruction. These may include access controls, confidentiality duties, secure backups, encryption where appropriate, staff awareness, vendor checks and incident procedures. No website or electronic transmission can be guaranteed completely secure.
If we reasonably believe personal data has been accessed or acquired by an unauthorised person, we will investigate and make notifications to the Personal Data Protection Office and affected individuals as required by law.
Children and safeguarding
The general website is not designed to collect personal data directly from children. A person under 18 should not submit personal data, donate or apply without involvement of a parent, guardian or other authorised adult. Where GFU programmes involve children, we will apply programme-specific safeguarding procedures and obtain parent or guardian consent unless another lawful exception applies. Extra care will be taken before publishing a child’s image, voice, location or story.
Your rights
Subject to applicable law and any lawful limitations, you may have the right to:
- Ask whether we hold your personal data and request access to it.
- Ask us to correct data that is inaccurate, incomplete or out of date.
- Request deletion, destruction, restriction or cessation of processing where the legal conditions are met.
- Object to certain processing, including direct marketing, and opt out of promotional communications.
- Withdraw consent at any time where processing relies on consent, without affecting processing already carried out lawfully.
- Request information about recipients, the purpose of processing and safeguards for relevant transfers.
- Challenge a significant decision made solely by automated means, where applicable.
- Complain to GFU or lodge a complaint with Uganda’s Personal Data Protection Office, and seek other remedies available under law.
To exercise a right, email info@deeppink-kudu-110177.hostingersite.com with the subject line “Privacy Request”. We may request reasonable information to verify identity and authority. We will respond within the period required by law. We will not charge a fee unless permitted for a manifestly unfounded, excessive or repetitive request.
Communications and direct marketing
You can stop promotional email by using the unsubscribe option, replying with an opt-out request or contacting us. Transactional, safety, legal or service messages may continue where necessary. We will not use personal data for direct marketing after a valid objection or withdrawal of consent.
External links and embedded services
The website may link to or embed services operated by third parties, including maps, social-media sites, videos and payment tools. Those organisations may process data under their own privacy notices. GFU is not responsible for their independent practices, and you should review their notices before providing information.
Changes to this Policy
We may update this Policy to reflect changes in law, technology, website functions or our practices. The current version will be posted on the website with a revised date. Where a change materially affects how we use previously collected data, we will provide additional notice or seek consent where required.
Contact and complaints
Questions, complaints and rights requests may be sent to:
- Good Forests Foundation Uganda (GFU)
- Email: info@deeppink-kudu-110177.hostingersite.com (subject: Privacy Request)
- Telephone: +256 200 969 927
- Kampala office: Crown House Rooftop, Plot 4A, Kampala, Uganda
- Fort Portal office: Plot 19 Nyaika Avenue, Fort Portal City, Uganda
You may also contact Uganda’s Personal Data Protection Office. Current official contact details and complaint guidance are available at pdpo.go.ug.
