Privacy notice

1. Introduction

This Privacy Notice explains how MANCO (Midwives And Nurses Charity Organisation) ("MANCO", "we", "us" or "our") collects, uses, discloses, retains and protects personal data obtained through this website and through the forms, payment reporting and communications connected to it. It is issued in accordance with the Data Protection and Privacy Act, 2019 (the "Act") and the Data Protection and Privacy Regulations, 2021 of the Republic of Uganda.

This Notice applies to every person who visits the website, contacts us, applies for membership, offers to volunteer, subscribes to our field notes or reports a gift (each a "data subject" or "you"). It does not apply to websites operated by others, even where we link to them.

2. Who is responsible for your personal data

MANCO is the data controller for the personal data described in this Notice. MANCO is a non-governmental organisation limited by guarantee, based in Rakai District, Uganda.

Questions, requests and complaints about personal data should be addressed to our designated data protection contact at info@mancoug.org, with the words "Data protection" in the subject line.

3. Personal data we collect

We collect only the personal data that is adequate, relevant and limited to what is necessary for the purposes set out in section 4.

Data you give us directly

• Contact form: your name, email address, telephone number (optional), the subject of your enquiry and your message.
• Membership application: your name, telephone number, email address (optional), district, place of work, professional cadre and the membership category you apply for.
• Volunteer form: your name, telephone number, email address (optional), area of residence, the ways in which you are able to help and your availability.
• Field notes subscription: your email address.
• Gift reporting: the amount and frequency of your gift, the cause you chose, the payment network used, the transaction identification number, the telephone number from which you paid and, if you choose to give them, your name and email address and whether you wish to remain anonymous.

Data collected automatically

• Technical data: your Internet Protocol (IP) address, browser type, device type, the pages requested and the date and time of each request, recorded in our server logs for security and to keep the service working.
• A strictly necessary session cookie, described in our Cookie Policy.

We do not use analytics, advertising or social media tracking technologies, and we do not build profiles of visitors.

Data we do not ask for

We do not ask for, and you should not send us through this website, information about your health, your HIV status, your religious or political beliefs or any other special personal data within the meaning of section 9 of the Act. If you choose to include such information in a message, we will use it only to respond to you, restrict access to it and delete it when it is no longer needed.

We never ask for your Mobile Money PIN, bank card details or passwords. Anyone who asks for these in our name is not acting for MANCO.

4. Why we use your personal data, and our lawful basis

We process personal data only where at least one of the grounds in section 7 of the Act applies.

• To reply to your enquiry: on the basis of your consent, given when you submit the form.
• To consider and administer your membership in accordance with our Constitution: because processing is necessary to take steps you have requested and, once you are admitted, to perform our obligations to you as a member.
• To plan outreach days with volunteers: on the basis of your consent.
• To send field notes: on the basis of your consent, which you may withdraw at any time by using the unsubscribe link in any message or by writing to us.
• To verify, record and acknowledge gifts, apply them to the cause you chose, keep proper books of account and prepare audited financial statements: because processing is necessary to comply with our legal obligations and to act on the instruction you give us when you report a gift.
• To keep the website secure, detect and prevent fraud and misuse, and investigate security incidents: because processing is necessary for our legitimate interest in protecting the people we serve and the funds entrusted to us, and for the prevention or detection of crime.

We do not use personal data for automated decision making that produces legal or similarly significant effects for you.

5. Gifts and payment networks

Gifts are paid directly by you to MANCO's merchant accounts with the relevant Mobile Money network. Those payments are processed by the network operator under its own terms and privacy notice, and MANCO does not receive or store your PIN or account credentials. When you report a gift, we compare the transaction identification number, amount and telephone number with our merchant statement in order to confirm it.

5A. The website assistant

The "Ask MANCO" assistant answers questions using only the public content of this website. When you use it, your question and the last few messages of the conversation are sent to our artificial intelligence service provider, DeepInfra, Inc., which processes them on our behalf to produce an answer. Your name, contact details and the rest of your visit are not sent.

We do not keep conversations. Where the assistant cannot answer, we keep the question, with any email address or telephone number automatically removed, for up to ninety days so that we can improve the answers on this website. The current conversation is held in your browser's session storage until you close the tab.

Please do not enter health information, payment details or other personal data into the assistant. It cannot give medical advice and cannot look up or confirm a payment.

6. Who we share personal data with

We do not sell, rent or trade personal data. We disclose it only as follows:

• To service providers who host our website, store our data or deliver our email, acting on our written instructions and bound by obligations of confidentiality and security consistent with the Act.
• To the Mobile Money network operator concerned, only where necessary to verify or reverse a transaction you have reported.
• To our artificial intelligence service provider, only the text you type into the website assistant, as described in section 5A.
• To our auditors and professional advisers, in confidence, where necessary for the audit of our accounts or to obtain advice.
• To regulators, courts, law enforcement agencies or other public bodies, where we are required or permitted by law to do so.

Members' details may be made available to the Center to which a member belongs, for the purposes of the Center's work under our Constitution.

7. Transfers outside Uganda

Some of our service providers may store or process data on servers outside Uganda. Where this happens, we will transfer personal data only where the country concerned provides adequate protection for personal data at least equivalent to that provided under the Act, or where you have consented to the transfer, in accordance with section 19 of the Act.

8. How long we keep personal data

We keep personal data only for as long as is necessary for the purpose for which it was collected, or for as long as the law requires.

• Contact enquiries: up to two years from our last exchange.
• Volunteer offers: up to two years from the last outreach day you took part in, or from your offer if you did not take part.
• Membership records: for the duration of your membership and six years after it ends.
• Gift records and supporting financial records: for the period required by the laws governing accounts and taxation, which is at present at least seven years.
• Field notes subscriptions: until you unsubscribe.
• Questions the website assistant could not answer: up to ninety days, without contact details.
• Server logs: up to ninety days, unless needed to investigate a specific security incident.

When the retention period ends, we delete or irreversibly anonymise the data.

9. How we protect personal data

We apply appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction, as required by section 20 of the Act. These include encrypted connections, protection of every form against forged requests and automated abuse, access to records only by authorised staff with individual accounts, and an audit trail of every change made in our administration system.

No method of transmission or storage is completely secure. If a breach of security compromises your personal data, we will notify the Personal Data Protection Office and, where required, you, in accordance with section 23 of the Act.

10. Your rights

Subject to the conditions and exceptions in the Act, you have the right to:

• be informed of the use to which your personal data is put;
• access the personal data we hold about you and obtain a copy of it;
• request the correction of personal data that is inaccurate, incomplete, misleading or out of date;
• request the deletion or destruction of personal data that we are no longer authorised to retain;
• object to the processing of your personal data, including at any time to its use for direct communications such as field notes;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out before you withdrew it; and
• not be subject to a decision based solely on automated processing.

To exercise any of these rights, write to info@mancoug.org. We may ask you to verify your identity before acting on your request. We will respond within the period set by the Act and the Regulations, and we do not charge a fee unless a request is manifestly unfounded or excessive.

11. Children

This website is not directed at children, and we do not knowingly collect personal data from any person under the age of eighteen through it. Where our work involves children, for example in a story or photograph, we obtain the prior written consent of a parent or guardian as required by section 8 of the Act, and we change names and identifying details.

12. Cookies and links to other sites

Our use of cookies is explained in our Cookie Policy. The map on our contact page is loaded from OpenStreetMap only if you choose to show it; that service is then governed by its own privacy notice. We are not responsible for the privacy practices of other websites to which we link.

13. Complaints

If you are concerned about how we have handled your personal data, please contact us first at info@mancoug.org so that we can try to resolve the matter. You also have the right to lodge a complaint with the Personal Data Protection Office, established under the Act within the National Information Technology Authority, Uganda.

14. Changes to this Notice

We may amend this Notice from time to time to reflect changes in the law or in our practices. The date of the latest version appears at the top of this page. Where a change materially affects how we use personal data you have already given us, we will take reasonable steps to bring it to your attention.