WEBSITE PRIVACY POLICY

Impact and Innovations Development Centre (IIDC) (“The Learning Partner”) is committed to protecting the privacy, dignity, and legal rights of all visitors who access our website. This Website Privacy Policy is published in accordance with Section 13 of Uganda’s Data Protection and Privacy Act, 2019 (DPPA), Clauses 5.6 and 15 of the IIDC Data Protection Policy, and Articles 12 and 13 of the EU General Data Protection Regulation (GDPR).

Strict Scope of Website Data Collection:

  • Web Analytics Only: Our website collects and processes technical and usage data strictly for internal visitor analytics, website performance monitoring, and operational insights.

  • No Third-Party Data Harvesting: IIDC acts solely on its own behalf. We do not use our website to gather, broker, or harvest information for any other organization for any reason.

  • Prohibition on Sale of Data: In strict compliance with Section 37 of the DPPA 2019, IIDC never sells, rents, or offers for sale any personal or visitor data under any circumstances.

For all data collected or processed through this website, IIDC is the Data Controller and Data Collector, meaning IIDC alone determines the purposes for and the manner in which data is processed. Ultimate executive and legal accountability for data protection compliance rests with the Executive Director (ED), while day-to-day statutory enforcement is led by the designated Data Governance Officer (DGO) / Data Protection Officer (DPO):

  • Data Controller: Impact and Innovations Development Centre (IIDC)

  • Designated Contact Officer: Data Governance Officer (DGO) / Data Protection Officer (DPO)

  • Email Address: [email protected]

  • National Supervisory Authority (Uganda): Personal Data Protection Office (PDPO), operating under the National Information Technology Authority – Uganda (NITA-U), accessible at [https://www.pdpo.go.ug/home](https://www.pdpo.go.ug/home).

  • International Supervisory Authorities (EEA/UK): Visitors residing in the European Economic Area (EEA) or the United Kingdom may also contact their local Data Protection Authority (DPA) under GDPR Article 77.

In accordance with the principle of Minimality (Data Minimisation) under Section 3(1)(c) and Section 14 of the DPPA 2019, Clause 9 of the IIDC Data Protection Policy, and Article 5(1)(c) of the GDPR, IIDC only collects adequate, relevant, and limited technical data necessary for website analytics and performance monitoring.

Categories of Analytics Data Collected

When you visit our website, our analytics and performance monitoring tools collect only the following limited technical metadata:

  • Network & Device Identifiers: Truncated or cryptographic hashes of Internet Protocol (IP) addresses (anonymized prior to storage so you cannot be personally identified), device type (desktop, tablet, or mobile), operating system version, and browser type/version.

  • Traffic & Interaction Metrics: Pages visited, entry and exit URLs, referral sources (how you arrived at our site), date and time stamps of visits, time spent on pages, and navigation paths.

  • Performance & Diagnostic Telemetry: Page load speeds, server response times, broken link errors (HTTP 404/500 status codes), and script crash diagnostics.

Data We Strictly Do Not Collect

  • No Direct Personal Identifiers via Analytics: Our analytics configuration does not collect your name, postal address, telephone number, email address, National ID number, passport number, or banking details.

  • No Special / Sensitive Personal Data: In accordance with Section 9 of the DPPA 2019 and Clause 16 of the IIDC Data Protection Policy, our website does not collect or process special category data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics, health status, or sexual life.

  • No Children’s Data: In compliance with Section 8 of the DPPA 2019 and Section 7.1 of the IIDC ICT Policy, our website does not knowingly collect or process personal data relating to children.

  • Visitor Analytics and Audience Insights

    • Specific Activities: Measuring aggregated visitor counts, geographic region distribution, popular content, and traffic sources to improve our learning resources and user experience.

    • Lawful Basis under Uganda DPPA 2019 & IIDC Policy: Prior, express, and informed Consent in accordance with Section 7(1) of the DPPA 2019 and Clause 14.1 of the IIDC Data Protection Policy.

    • Lawful Basis under EU GDPR & ePrivacy Directive: Consent under Article 6(1)(a) of the GDPR and Article 5(3) of the ePrivacy Directive, obtained via an affirmative opt-in action before any non-essential analytics cookies or tracking scripts are placed on your device.

  • Website Performance Monitoring

    • Specific Activities: Diagnosing page load latency, fixing broken links, optimizing mobile and desktop display rendering, and ensuring continuous website availability and uptime.

    • Lawful Basis under Uganda DPPA 2019 & IIDC Policy: Legitimate Interests pursued by IIDC to maintain functional digital services without unduly prejudicing visitor privacy under Clauses 5.4 and 11.2(c) of the IIDC Data Protection Policy, or prior Consent where client-side analytics cookies are used.

    • Lawful Basis under EU GDPR & ePrivacy Directive: Legitimate Interests under Article 6(1)(f) of the GDPR for strictly anonymized, server-side diagnostic telemetry, or Consent under Article 6(1)(a) of the GDPR and Article 5(3) of the ePrivacy Directive where information is stored on or accessed from the visitor’s terminal equipment.

  • Cybersecurity and Infrastructure Integrity

    • Specific Activities: Protecting IIDC web services, networks, and endpoints against unauthorized access, port scanning, malware intrusion, and Denial-of-Service (DoS) attacks.

    • Lawful Basis under Uganda DPPA 2019 & IIDC Policy: Statutory Security Obligation and Legitimate Interests to safeguard data integrity and institutional systems under Section 20 of the DPPA 2019, Section 5 of the IIDC ICT Policy, and Clauses 5.4 and 18 of the IIDC Data Protection Policy.

    • Lawful Basis under EU GDPR & ePrivacy Directive: Legal Obligation and Legitimate Interests to ensure network and information security under Articles 6(1)(c), 6(1)(f), and 32 of the GDPR.

In compliance with Section 13(1)(d)–(e) of the DPPA 2019 and Clauses 10.2(b)–(c) and 15.3(j) of the IIDC Data Protection Policy:

  • Voluntary / Discretionary Provision: Providing data for web analytics is entirely optional and discretionary.

  • No Consequences for Refusal: If you decline or opt out of web analytics tracking, there are no negative consequences. You will retain full, unrestricted access to all public pages, publications, and resources on the IIDC website.

  • Consent Standards & Withdrawal: Where consent is used, it must be freely given, specific, informed, and an unambiguous indication of your wishes signified by a clear affirmative action. Pre-ticked boxes, silence, or continued browsing do not constitute valid consent. Under Clause 7.1(j) and Clause 15.3(h) of the IIDC Data Protection Policy and GDPR Article 7(3), you have the right to withdraw your consent or adjust your analytics preferences at any time via our website’s cookie settings control or your browser settings.

In accordance with Section 13(1)(g) of the DPPA 2019 and Clauses 8, 10.2(e), and 15.3(e) of the IIDC Data Protection Policy:

  1. No Sharing with External Organizations for Their Own Purposes: IIDC does not collect, share, or disclose website analytics data for the benefit of any third-party organization, advertiser, data broker, or external entity.

  2. Strict Internal Role-Based Access Control (RBAC): Internally, website analytics dashboards and logs are restricted strictly on a “need-to-know” basis under the Principle of Least Privilege. Only authorized personnel—specifically the ICT Officer, Data Custodian (DC), Data Steward (DS), Technical Advisor (TA) Monitoring, Evaluation & Learning (MEL), and the Information Management Team (IMT) / Information Management Group (IMG)—may access analytics reports to perform their official duties.

  3. Contracted Data Processors (Hosting & Analytics SaaS Providers): Where IIDC utilizes a vetted cloud hosting or web analytics Software-as-a-Service (SaaS) provider to process technical analytics on our behalf, that vendor acts strictly as a Data Processor under Section 21 of the DPPA 2019, Section 9.1 of the IIDC ICT Policy, and Clause 18.10 of the IIDC Data Protection Policy. Every Data Processor is bound by IIDC’s mandatory Data Processing Addendum (DPA) (and GDPR Article 28 clauses), which legally enforces that the Processor:

    • Processes data only on IIDC’s documented instructions and never uses IIDC data for its own purposes, cross-site tracking, or advertising;

    • Ensures all authorized personnel are bound by an enforceable duty of strict confidentiality;

    • Cannot engage any sub-processor without IIDC’s prior, specific, written consent, while remaining fully liable for any approved sub-processor;

    • Submits to technical audits and inspections by IIDC; and

    • Securely deletes or returns all data upon contract termination without retaining any copies.

  4. Statutory Exceptions: IIDC will never disclose data to third parties unless strictly required by law under Section 7(2) of the DPPA 2019 and Clause 8.5 of the IIDC Data Protection Policy, and only after formal verification and authorization by the Executive Director and DGO/DPO.

IIDC enforces an ultra-cautious governance framework regarding Artificial Intelligence (AI), Large Language Models (LLMs), and automated algorithms under Section 6 of the IIDC ICT Policy, Section 27 of the DPPA 2019, Clauses 6.2.10.4, 30, and 31 of the IIDC Data Protection Policy, and Article 22 of the GDPR:

  • Zero-Tolerance Prohibition on Public AI Ingestion: IIDC staff, consultants, and vendors are strictly barred from uploading, pasting, or ingesting any identifiable visitor data or raw system logs into public or consumer AI models (such as free tiers of ChatGPT, Claude, Gemini, or DeepSeek).

  • Strict Enterprise AI Controls: If an approved enterprise analytics tool listed on the IIDC Approved AI Tool Registry is used to synthesize high-level website performance insights, it must operate under a Zero Data Retention (ZDR) enterprise contract (ensuring inputs are never retained or used to train foundation models), process only fully de-identified and aggregated data, and undergo mandatory Human-in-the-Loop (HITL) verification.

  • No Automated Decision-Making or Individual Profiling: Website visitors are never subjected to decisions based solely on automated processing or algorithmic profiling that produce legal effects or similarly significantly affect them.

In accordance with Section 19 of the DPPA 2019, Section 5.4 of the IIDC ICT Policy, Clause 41 of the IIDC Data Protection Policy, Section 6 of the IIDC DPA, and Chapter V (Articles 44–49) of the GDPR:

  • Primary Localization: IIDC prioritizes hosting institutional and analytics data within Uganda or in jurisdictions with equivalent statutory data protection standards.

  • Transfer Safeguards: Website analytics data shall not be transferred, stored, or accessed on servers or cloud data centers outside Uganda (or outside the EEA for European visitors) unless:

    1. The receiving country or territory ensures an adequate level of protection for personal data at least equivalent to Uganda’s DPPA 2019 (and an EU Adequacy Decision where GDPR applies);

    2. Appropriate legal and technical safeguards (such as executed Data Processing Addenda, Standard Contractual Clauses, and end-to-end encryption) are in place;

    3. Written pre-clearance has been secured from the IIDC DGO and, where statutorily required, the National Personal Data Protection Office (PDPO); or

    4. The visitor has provided explicit, informed consent.

Pursuant to Section 20 of the DPPA 2019, Sections 4 and 5 of the IIDC ICT Policy, Clauses 18, 34, 35, and 38 of the IIDC Data Protection Policy, and Article 32 of the GDPR, IIDC maintains comprehensive technical and organizational safeguards to protect website analytics data against unauthorized access, alteration, disclosure, accidental loss, or destruction:

  • Encryption in Transit: All web traffic connecting to IIDC web services and analytics endpoints is encrypted using Transport Layer Security.

  • Encryption at Rest: All organizational servers, cloud partitions, databases, and endpoints storing analytics records are encrypted using industry-standard Advanced Encryption Standard (AES) 256-bit encryption.

  • Multi-Factor Authentication (MFA) & Access Security: Administrative access to website backends and analytics consoles requires mandatory Multi-Factor Authentication (MFA) via dedicated authentication apps or physical FIDO2 security keys, alongside complex passwords.

  • Vulnerability Management & Auditing: All web and analytics software is kept continuously updated with security patches, and elevated administrative privileges are logged and audited frequently.

Pursuant to Section 13(1)(i) and Section 18 of the DPPA 2019, Sections 5.3 and 9.3 of the IIDC ICT Policy, Clauses 5.3(h), 5.3(j), 25, and 36 of the IIDC Data Protection Policy, and Article 5(1)(e) of the GDPR, IIDC retains website analytics data only for as long as is necessary to achieve the purposes for which it was collected and processed.

  1. Active Session and Event Telemetry

    • Retention Schedule: Retained in an identifiable or session-linked form only for the minimum duration required to generate visitor analytics and performance insights, and never longer than is necessary for the specific purpose for which it was collected.

    • Storage and Disposal Protocol: At the expiry of the retention period, records are automatically de-identified, erased, or destroyed in a manner that prevents their reconstruction in an intelligible form. Where data is processed by a contracted Data Processor, all data and existing copies must be securely deleted or returned to IIDC upon termination of the agreement.

  2. Operational Incremental Backups

    • Retention Schedule: Retained for 30 days, captured via automated daily backups running during off-peak hours (01:00–03:00 EAT).

    • Storage and Disposal Protocol: Stored on a dedicated, encrypted on-server cloud partition. Automated lifecycle pruning is configured to permanently destroy incremental backups once they exceed their 30-day expiration date.

  3. System Full Backups

    • Retention Schedule: Retained for 180 days (6 months), captured via automated weekly backups every Sunday at 02:00 EAT.

    • Storage and Disposal Protocol: Downloaded and archived off-site and off-server in an encrypted vault. Full backups are automatically destroyed through lifecycle pruning upon reaching the 180-day statutory and operational retention limit.

  4. Aggregated Statistical Reports and Historical Archives

    • Retention Schedule: Retained for longer periods solely for historical, statistical, or research purposes in accordance with Section 17(3)(d) and Section 18(2)(f) of the DPPA 2019 and Clause 5.3(j) of the IIDC Data Protection Policy, or as semi-annual snapshots where required by statutory or donor obligations.

    • Storage and Disposal Protocol: Statistical insights are strictly de-identified and aggregated so that they cannot reveal the identity of any individual visitor. Semi-annual historical snapshots are stored in an immutable, cold-storage cloud archive with access restricted exclusively to the Data Governance Officer (DGO) and Executive Director (ED).

  5. Hardware Sanitization and Asset Decommissioning

    • Sanitization Standard: Any physical servers, endpoints, or storage media hosting website data that reach end-of-life, redundancy, or disposal must undergo cryptographically verified data sanitization in alignment with NIST SP 800-88 standards.

    • Disposal Protocol: Simple operating system reformatting is unacceptable; storage media must be securely wiped using multi-pass disk overwriting or physically destroyed via degaussing or shredding. A Certificate of Data Sanitization signed by the ICT Officer must be filed before any physical computing asset is recycled, auctioned, disposed of, or donated.

In accordance with Section 23 of the DPPA 2019, Section 8 of the IIDC ICT Policy, Clause 42 of the IIDC Data Protection Policy, Section 5 of the IIDC DPA, and Articles 33 and 34 of the GDPR, IIDC enforces a strict incident escalation protocol:

  1. Internal & Processor Containment: Any suspected security incident or personal data breach discovered internally must be reported to the DGO ([email protected]) and ICT Officer immediately. Any contracted external Data Processor must notify IIDC without undue delay and no later than 24 hours after becoming aware of a breach.

  2. Triage & Impact Assessment: The DGO, supported by the ICT Officer, conducts an impact assessment within 24 hours to evaluate the confidentiality impact and risk to the rights and freedoms of data subjects.

  3. Statutory Regulatory Notification: Where a breach involves personal data and poses a risk to the rights and freedoms of individuals, the DGO notifies the Uganda Personal Data Protection Office (PDPO) (and competent EU supervisory authorities where GDPR applies) within 72 hours of verification.

  4. Data Subject Notification: Where directed by the PDPO under Section 23(2)–(3) of the DPPA 2019 or required due to high risk under Clause 42.5 and GDPR Article 34, IIDC will promptly notify affected individuals, including via prominent placement on our website.

  • Under Part V (Sections 24–28) and Section 16 of the DPPA 2019, Clauses 7 and 22–32 of the IIDC Data Protection Policy, and Articles 15–22 of the GDPR, you have the following statutory rights regarding any personal data relating to you:

    • Right to Be Informed: You have the right to clear, transparent notice regarding the nature, purpose, recipients, and retention of data collected via our website prior to or at the time of collection.

    • Right of Access (Subject Access Request – SAR): You may request confirmation of whether IIDC holds personal data about you, a description of that data, and the identity or category of any third party that has had access to it. IIDC responds to verified SARs free of charge within 30 days / one month of receipt (extendable by up to two months for complex requests, with prior notice to you).

    • Right to Rectification / Correction: Under Section 16 and Section 28 of the DPPA 2019 and Clause 24 of the IIDC Data Protection Policy, you have the right to request correction of any inaccurate, incomplete, out-of-date, or misleading personal data within one month.

    • Right to Erasure (“Right to Be Forgotten”): Under Section 16(1)(b) and Section 28 of the DPPA 2019 and Clause 26 of the IIDC Data Protection Policy, you may request the erasure or destruction of your personal data where it is no longer necessary for the purpose collected, where you withdraw consent, or where you validly object to processing, which IIDC will action within one month.

    • Right to Object / Prevent Processing: Under Section 7(3) and Section 25 of the DPPA 2019 and Clause 29 of the IIDC Data Protection Policy, you have the right to object to the processing of your personal data at any time. Where you issue a written notice under Section 25 of the DPPA 2019 requiring IIDC to stop processing data likely to cause unwarranted substantial damage or distress, IIDC will respond in writing within 14 days. Where you object to processing based on IIDC’s legitimate interests, IIDC will cease processing immediately unless overriding legitimate grounds exist.

    • Right to Restrict Processing: Under Clause 27 of the IIDC Data Protection Policy and GDPR Article 18, you may request that IIDC ceases active processing and retains only the minimum data necessary to ensure no further processing occurs.

    • Right to Data Portability: Where processing is based on your consent, you have the right under Clause 28 of the IIDC Data Protection Policy and GDPR Article 20 to receive a copy of your personal data in a structured format and transmit it to another controller within one month.

    • Right to Prevent Processing for Direct Marketing: While IIDC does not use website analytics for direct marketing, you retain the absolute right under Section 26 of the DPPA 2019 and Clause 32 of the IIDC Data Protection Policy to prevent any processing for direct marketing (responded to within 14 days).

    • Rights Relating to Automated Decision-Making: Under Section 27 of the DPPA 2019 and Clause 30 of the IIDC Data Protection Policy, you have the right to ensure no significant decision is based solely on automated processing and to request human intervention or reconsideration within 21 days.

    Note on Technical Anonymization Limits: Because IIDC truncates/hashes IP addresses and aggregates web analytics data in accordance with data minimization standards, IIDC is generally unable to link historical analytics telemetry back to an identifiable individual unless you provide specific session identifiers or opt-in consent references.

    To exercise any of the above rights, please fill out the Google Form here

To exercise any of your statutory rights, submit a Subject Access Request (SAR), or raise a question regarding this Website Privacy Policy:

  1. Direct Contact with IIDC: Submit your request or query by email to the IIDC Data Governance Officer / Data Protection Officer at [email protected]. In accordance with Section 24(3) of the DPPA 2019, IIDC may request reasonable proof of identity where necessary to verify a request.

  2. Internal Escalation Path: Pursuant to Clause 7.3 of the IIDC Data Protection Policy, concerns may be addressed in the first instance to the relevant Data Steward (DS) or Data Custodian (DC), and escalated to the Data Governance Officer / Data Protection Officer and the Executive Director (ED) at [email protected].

  3. Right to Lodge a Regulatory Complaint & Seek Compensation: If you are dissatisfied with IIDC’s response or believe your rights under the law have been infringed, you have the right to:

    • Lodge a formal complaint with the Personal Data Protection Office (PDPO) in Uganda under Section 31 of the DPPA 2019 and Clauses 7.3 and 15.3(i) of the IIDC Data Protection Policy via https://www.pdpo.go.ug/home;

    • Lodge a complaint with your national Data Protection Authority (DPA) in the EU/EEA or UK under GDPR Article 77; and

    • Apply to a Court of competent jurisdiction for compensation for damage or distress caused by any contravention of the Act under Section 33 of the DPPA 2019.

In alignment with Section 10.2 of the IIDC ICT Policy and Clauses 1.1 and 5.6 of the IIDC Data Protection Policy, this Website Privacy Policy is reviewed annually every October by the Information Management Team (IMT) / Information Management Group (IMG) and whenever new web analytics features are introduced. Any updates will be published on this page with a revised effective date.

  • Data Controller: Impact and Innovations Development Centre (IIDC)

  • Designated Contact Officer: Data Governance Officer (DGO) / Data Protection Officer (DPO)

  • Email Address: [email protected]

  • National Supervisory Authority (Uganda): Personal Data Protection Office (PDPO), operating under the National Information Technology Authority – Uganda (NITA-U), accessible at https://www.pdpo.go.ug/home

  • International Supervisory Authorities (EEA/UK): Visitors residing in the European Economic Area (EEA) or the United Kingdom may also contact their local Data Protection Authority (DPA) under GDPR Article 77.