How we handle your data — in plain language.

01 · Overview

We are STEMCity Labs — an African STEM-education and civic-technology hub, headquartered at TechBuzz Hub, Ntinda, Plot 668 Kayondo Road, Kampala, Uganda. Contact us about anything in this policy at stemcitylabs@gmail.com.

This policy explains what personal data we collect when you interact with us — through the website, our programs, or as a partner or funder — why we collect it, who sees it, and what rights you have over it.

02 · What we collect

• When you contact us — your name, email, phone (if you provide it), the message, your organisation if you mention one, and any documents you attach.
• When you subscribe to our newsletter — your email address.
• When you or your child enrols in a program — the participant's name and age, school or institution, parent/guardian contact info, emergency contact, dietary or medical notes if relevant, and any photo-consent decision.
• When you apply for a role, partnership, or tender — CV, cover letter, portfolio, references, organisational documents.
• When you visit this website — standard server logs (IP address, browser, pages visited, timestamp) collected by GitHub Pages, our hosting platform.

03 · Why we collect it

We collect personal data only to:

• Respond to your inquiry or process your application.
• Run our programs safely (cohorts need contact info and emergency contacts).
• Send updates and resources to people who've asked for them — you can unsubscribe at any time.
• Report aggregated impact to funders, partners, and the public (we never report individual data).
• Improve our work — what's serving learners, what isn't.

04 · Legal basis

We rely on the following legal bases under Uganda's Data Protection and Privacy Act 2019 (and equivalent international frameworks like GDPR where applicable):

• Consent — newsletter, photo and media use, optional fields.
• Contract — program enrolment, partnership agreements, supplier engagements.
• Legitimate interests — responding to direct inquiries, basic site security, fraud prevention.
• Legal obligation — tax records, funder audit requirements, regulatory reporting.

05 · Children's privacy

Most of our programs work with under-18s. We treat their data with extra care.

• A parent or guardian must consent before a child enrols. The child's own assent is also sought where age-appropriate.
• We collect only what we need to run programs safely.
• Photo and media use requires separate written parent/guardian consent — see the next section.
• We do not market to children. We don't run any third-party advertising on this site.
• Children's data is deleted within 12 months of a program ending, unless we have ongoing consent or a legal/funder requirement to keep it longer.

06 · Photo & media consent

Our programs are visual. We sometimes photograph or film learners and use those images for impact reports, news posts, and outreach. Consent for this is collected separately at the start of each program.

You can withdraw consent at any time by emailing stemcitylabs@gmail.com. We will stop using future material featuring you or your child. Material already published may take time to remove from cached copies, social media, and printed reports.

07 · Cookies & analytics

This site currently sets no cookies. We do not track visitor identity, sessions, or behaviour across pages.

Our typography is loaded from fonts.googleapis.com. No cookies are set by this, but Google's servers see your IP address when fetching the font files. We plan to self-host fonts and eliminate this dependency.

If we add analytics in future, we will use a privacy-respecting, cookieless tool (Plausible is our current candidate). We'll update this policy and the dedicated Cookies page before doing so.

08 · How we share data

We do not sell your personal data. Ever.

We share data only with:

• Processors who help us run the organisation (email, document storage, hosting, payment gateways) — under written contracts that bind them to the same standards.
• Funders and auditors, when grant agreements require it, and only the minimum needed.
• Law enforcement — only when a valid legal process compels it.

When we work with partners (schools, NGOs, universities) on shared programs, our sharing with them is limited to what's needed for that program. They process the shared data under their own privacy policies.

09 · Where data lives

Most operational data sits with us in Uganda. Email runs on Google Workspace. Our website source code sits on GitHub. Both providers operate globally and have their own data-protection commitments.

10 · How long we keep it

• Contact form submissions — 24 months from last contact, then deleted unless an active matter is ongoing.
• Newsletter subscribers — until you unsubscribe.
• Program participant records — 24 months after a program ends (or 6 years where funder reporting requires it), then deleted or anonymised.
• Photos and media with active consent — until consent is withdrawn or 7 years.
• Financial and tax records — as long as Ugandan law requires.

11 · Your rights

Under Uganda's Data Protection and Privacy Act 2019 — and similar protections under GDPR and other laws — you may:

• Ask what we hold about you (access)
• Correct anything that's wrong (rectification)
• Ask us to delete your data, subject to legal or funder retention rules (erasure)
• Get a copy in a portable format (portability)
• Object to specific uses of your data
• Withdraw consent at any time, for any data we hold on consent grounds

Email stemcitylabs@gmail.com with the subject "Privacy request — [type]" and we'll respond within 30 days.

12 · Security

We use the security features built into our chosen providers (Google Workspace, GitHub). The contact form is for general inquiries — please don't send sensitive personal data through it.

No system is perfectly secure. If a breach affects you, we'll notify you without undue delay.

13 · Changes to this policy

When we update this policy we'll change the "Last updated" date above. For material changes we'll also notify newsletter subscribers and people enrolled in active programs.

14 · Contact

Questions, requests, or complaints about how we handle your data:

You may also lodge a complaint directly with the Uganda Personal Data Protection Office.