POLLICY DATA INSTITUTE LTD PRIVACY POLICY – 2026

 

1. About Pollicy Data Institute Ltd

 

Pollicy Data Institute (Pollicy) is an Afrofeminist collective of technologists, data scientists, creatives, and academics working at the intersection of data, design, and technology to build a just and inclusive digital future.

 

We believe data can be liberating when it is handled with care, consent, and respect for the people it describes. That belief shapes how we treat your data, in our public-facing work and in our internal systems alike. Power over data should sit with the people it belongs to. Trust has to be earned and protected. This Policy is where we put that into practice.

 

2. Purpose of this Privacy Policy

 

This Policy explains what personal data Pollicy collects, why we collect it, how we use, share, and protect it, and what rights you have over it. It applies whenever you engage with Pollicy through our digital assets including website(s), research, events, campaigns, social media, or any correspondence by email, phone, or letter regardless of where you are located.

 

This Policy is written in line with Uganda’s Data Protection and Privacy Act, 2019 (“the Act”), which gives effect to Article 27 of the Constitution of the Republic of Uganda on the right to privacy. Where our work involves people or partners outside Uganda, we apply the same standards set out here, as part of our responsibility to you wherever you are.

This Policy governs any Pollicy website, platform, or account that links to it. It does not extend to third-party sites, plug-ins, or platforms we link to or use, each has its own privacy policy, and we encourage you to read those separately.

 

3. Legal and Regulatory Context

 

Pollicy operates across several African countries, and this Policy reflects the laws that apply where we work, alongside our own internal data governance standards.

 

Pollicy is founded and headquartered in Uganda, where the Data Protection and Privacy Act, 2019, and its Data Protection and Privacy Regulations, 2021, form the core framework for our handling of personal data. This Act gives effect to Article 27 of the Constitution of the Republic of Uganda on the right to privacy.

 

We also draw on the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention, 2014), the AU Data Policy Framework (2022), and the AU Continental 

Artificial Intelligence Strategy (2024) as guiding frameworks for data sovereignty, interoperability, and inclusive digital transformation across the continent.

 

Where you engage with us from a country not listed here, we apply the same principles set out in this Policy as our baseline standard.

 

4. Our Data Protection Principles

 

Pollicy is accountable to the following principles whenever we collect, process, hold, or use personal data, in line with Section 3 of Uganda’s Act and the same spirit that guides our work with communities:

• Accountability; We answer to you for the data we hold.
• Fairness and lawfulness; We collect and process data fairly and lawfully.
• Minimality; We collect only what is adequate, relevant, and necessary for the purpose.
• Retention; We keep personal data only for as long as the law allows or the purpose requires.
• Quality; We take reasonable steps to keep the data we hold accurate and current.
• Transparency and participation; You can see what we hold, and you have a real say in what happens to it.
• Security; We safeguard the data placed in our care as a matter of respect.

 

5. What Personal Data We Collect

We collect only the personal data necessary to carry out our work. We collect it in the following ways:

 

5.1 Data you give us directly

When you sign up for an activity, subscribe to a mailing list, or otherwise contact us, we may collect your name, address, email address, phone number, demographic information (such as gender or occupation), and anything else you choose to share with us.

 

5.2 Special and Sensitive Personal Data

We do not usually ask for special personal data or information about racial or ethnic origin, religious or philosophical beliefs, political opinion, sexual life, financial information, or health status. If you choose to share this in a communication with us, we treat that as your consent to our processing it for the purpose you shared it. Where we do need this information for example, to arrange accessibility support at an event, we will say so clearly at the point of collection and rely on your express consent.

 

5.3 Data from automated technologies and cookies

When you visit our website, we automatically log technical information such as your device and browser type, IP address, pages viewed, and time spent on a page. We use cookies, small files stored on your device to understand how people use our site and to improve it. You can remove or reject cookies through your browser settings, though this may affect how the site works for you.

 

5.4 Data collected through events, research, and our digital tools

For our events, surveys and research interviews, we collect information through approved digital tools, with your express consent. Beyond the minimum we ask for (typically name, email, and location), how much you share is up to you. The tools we currently use for this include:

• Google Forms for surveys and applications.
• Google Meet and Zoom for virtual meetings, events, and webinars
• Mailchimp for newsletter sign-ups and management.
• Google Analytics for non-identifiable data on how visitors use our site. 

 

These providers are approved for organisational use under our internal IT Policy and are not under our control; each has its own privacy policy, which we vet but recommend you read directly.

 

5.5 Data from social media

We maintain accounts on platforms including Twitter/X, Facebook, TikTok, Instagram, and Medium. If you interact with these including by tagging us or using our hashtags, we may collect what you choose to share with us there. We do not store or process information about our followers beyond the platform itself, and each platform’s own privacy policy governs your use of it. We use link-shortening services to make links easier to share; the destination sites may set their own cookies or collect your IP address.

 

5.6 Children’s data

Some of our digital literacy and community programmes involve younger participants. We do not collect or process personal data relating to a child except with the prior consent of a parent, guardian, or other person with authority to decide on the child’s behalf, and only where necessary for example, to comply with the law, or for research or statistical purposes. Where a programme involves minors, we will set out separately what data we need and why, and seek that consent before collection.

 

6. Why We collect and Use your Data

 

We collect personal data directly from you, for a lawful purpose that is specific and connected to Pollicy’s work, and generally on the basis of your consent. Where we rely on another lawful basis such as a contractual relationship, a legal obligation, or our legitimate interest in running our programmes, we will make that clear at the point of collection.

 

7. How We Use Your Information

 

We use your information to;

• To operate, maintain, and improve our website and programmes, and to respond to your questions.
• To send confirmations, invoices, technical notices, security alerts, and administrative messages.
• To tell you about upcoming events, research, surveys, and other news only where you have opted in.
• To keep our systems secure, and to investigate and deter fraudulent or unlawful activity.
• To personalise how our content and services are presented to you.
• To notify you of changes to our services or this Policy.

 

8. How we Share your Information

 

Pollicy does not sell, rent, or lease your personal data, and we do not buy personal data from other sources. We do not share your data with third parties for their marketing purposes. Where we publish compilations of petition numbers or research findings, we do so in a way that does not disclose your personal identity.

We may share personal data in the following circumstances:

• With your consent for example, where you ask us to share your data with a partner for their own use.
• In connection with a genuine partnership, merger, financing, or similar transaction involving Pollicy.
• For legal, protection, and safety purposes, or to comply with the law and lawful requests.
• To protect the rights and property of Pollicy, our staff, partners, or others.
• In an emergency, to protect the safety of any person.
• With service providers who need it to do work on our behalf, under written confidentiality and security terms, consistent with our internal Data Safeguarding and Retention Policy.

When we share data with partners or researchers, we require that recipients apply data protection standards equivalent to our own, and we anonymise data wherever possible before sharing or publishing it.

 

8.1 Third-party service providers

We retain ownership and control of the information held in our accounts with third-party providers. Each provider has its own privacy policy, and while we vet these providers, they are not under our control and their practices may change.

8.2 Cross-border data transfers

Because our work spans Uganda, Kenya, Tanzania, and other African countries, personal data may sometimes be processed or stored across borders. Where this happens, we transfer data only to a country with data protection measures at least equal to those required by the applicable law, or where you have agreed to the transfer, or where the transfer is otherwise necessary for a contract made in your interest.

 

8.3 Artificial intelligence and your data

Where Pollicy staff use AI tools in our work for example, transcription or research assistance our internal policy requires that personal, confidential, or sensitive information is never entered into public or third-party AI tools without a prior risk assessment, and that data is anonymised or pseudonymised wherever possible before such tools are used. AI outputs involving your data are always reviewed by a person, and AI is never used to make automated decisions about you without prior human review.

 

9. Your Rights

 

As a data subject, you have the right to:

• Access the personal data we hold about you, once you have verified your identity.
• Request correction of personal data that is inaccurate or out of date.
• Request deletion of your personal data where it is no longer necessary for the purpose it was collected.
• Object to processing that is causing, or is likely to cause, unwarranted and substantial damage or distress, by giving us written notice.
• Withdraw consent at any time, where our processing is based on your consent, including opting out of any communications.
• Be informed about how your information is collected and used.
• Lodge a complaint with the relevant national data protection authority if you are not satisfied with how we have handled your request. Please refer to section 15 of this policy.

To exercise any of these rights, write to us at info@pollicy.org. We will respond within a reasonable time and may ask you to verify your identity first.

 

10. How Long We Keep Your Data

 

We keep personal data only for as long as is necessary for the purpose it was collected, or for as long as the law requires, in line with our internal retention schedule:

• For Research and programme data, we keep it up to 10 years from creation or project completion.
• For Event and participant data, we keep it up to 5 years after project completion.
• For Communications (e.g., newsletter, correspondence), we keep it up to 5 years, or until you unsubscribe.

Once data is no longer needed, we delete it securely or anonymise it.

 

11. Keeping Your Data Secure

 

Protecting your data reflects the trust communities place in us. We apply access on a least privilege basis, meaning staff only see the data they need to do their work. Sensitive and confidential data is stored only on approved, encrypted systems, protected by two-factor authentication and strong password requirements. Where a third-party processor handles data on our behalf, we require them to meet equivalent security standards. No transmission over the internet is completely secure, and any data you send us online, once received, we apply strict access controls so that only authorised personnel can reach it.

 

12. Data Breaches

 

If a breach occurs that is likely to put your rights or personal data at risk, we act promptly to contain it, assess the impact, and log it through our internal incident-reporting process. We notify the relevant national authority, the Personal Data Protection Office (PDPO) in Uganda within the legally prescribed time. Where required, we also notify affected individuals directly, with a summary of the breach, its likely impact, and the corrective actions taken.

 

13. Our Registration and Accountability

 

Pollicy is registered with Uganda’s Personal Data Protection Office as both a Data Controller and a Data Processor (Registration Certificate No. PDPO-202302-1583). This registration reflects our responsibility for implementing appropriate data protection measures and reporting obligations under the Act.

 

Within Pollicy, responsibility for data protection is shared: our IT Personnel act as technical custodians of data safeguards and lead incident response; our Operations Lead oversees day-to-day compliance with the PDPO and other national regulators; and our Executive Director provides overall oversight, authorising breach notifications and major decisions affecting your data.

 

14. Changes to This Policy

 

We may update this Policy from time to time to reflect changes in our practices or the law. Where a change is material, we will notify you by posting an announcement on our website or social media channels. Continuing to use Pollicy’s services after a material change takes effect means you accept the updated Policy.

15. How to Raise a Concern or Complaint

 

If you have a concern about how we have handled your personal data, please contact us first at info@pollicy.org so we can try to resolve it directly. If you remain unsatisfied, you may lodge a complaint with the relevant national authority: the Personal Data Protection Office (PDPO) in Uganda via https://pdpo.go.ug/file-complaint.

Approved by:

Neema Iyer

Executive Director, Pollicy

Date: 3 September 2026