PRINCE JIM SHEPHERD NADIOPE FOUNDATION’S PRIVACY POLICY
“Last updated: December 30th, 2023”
Thank you for using princejimshepherd.org. We are committed to protecting your privacy and, for that reason, we have adopted this Privacy Policy to explain our data collection, use, and disclosure practices for the princejimshepherd.org services (including its website and web-based applications, and any other tools, products, or services provided by Prince Jim Shepherd Foundation Inc. that link to or reference this Privacy Policy) (collectively, the “Services”). The Services are owned and operated by Prince Jim Shepherd Nadiope Foundation, a Ugandan based non-profit organization (“Prince Jim Shepherd Nadiope Foundation,” “we,” “us,” or “our”).
Prince Jim Shepherd Nadiope Foundation takes great care to preserve your privacy and safeguard any personal details you provide to us, whether on this website or by another means. This Policy explains how Prince Jim Shepherd Nadiope Foundation uses your personal information, how we preserve your privacy and safeguard your information and details your rights regarding the information we use.
You acknowledge and agree that Prince Jim Shepherd Nadiope Foundation is not responsible for the data collection or use practices of any other user of the Services or a third party utilized in providing the Services.
This Privacy Policy describes, among other things:
- Personal and other information we collect about you;
- How we use your information;
- How we may share your information with third parties; and
- Your choices regarding the personal information we collect about you.
Prince Jim Shepherd Nadiope Foundation is one of the largest charitable providers for services for people living with mental illness and we have relationships with fundraisers, supporters and volunteers, so we use personal information every day.
Prince Jim Shepherd Nadiope Foundation is a registered charity in Uganda (80034239100218), a company limited by guarantee in Uganda (80034239100218) and authorised and regulated by the Uganda Registration Service Bureau. Prince Jim Shepherd Nadiope Foundation is the trading name of the Prince Jim Shepherd Nadiope Foundation Limited.
By using our website or providing us with your personal information you are agreeing to this Policy. We update this Policy from time to time, for example to keep it up to date in line with General Data Protection Regulations and other applicable legislation, so please check it regularly. We will communicate changes as often as we can.
How We Collect Information About You?
We may collect personal information from you when you:
- become one of our members;
- apply for a paid or unpaid role within Rethink Mental Illness, for the processing of your application;
- make a donation to us;
- order materials or training from us;
- use one of our services, including our national advice service (correspondence between you and the advice service will remain confidential); or
- Contact us or become involved with us in another way, for example with our governance, as a campaigner, fundraiser or as a volunteer.
- Consent
By accessing or using the Services, you consent to this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use the Services. Information gathered through the Services may be transferred, used, and stored in Uganda or in other countries where our service providers or we are located. If you use the Services, you agree to the transfer, use, and storage of your Personal Information (as defined below) in those countries. The data protection and other laws of Uganda and other countries might not be as comprehensive as those in your country. You agree that all transactions relating to the Services or Prince Jim Shepherd Nadiope Foundation is deemed to occur in Uganda, where our servers are located.
- Collection of Your Personal and Other Information
When you register for, or use our Services, we collect Personal Information. By “Personal Information” we mean information that can identify or reasonably be linked to an individual, such as:
- Names;
- Personal or business addresses;
- Email addresses;
- Phone numbers;
- Your bank or Credit card information (which you submit for payment purposes and is collected by our payment processors); and
- Information contained in any photograph or video you submit to us.
- your date of birth
- your gender
- age, nationality, and ethnicity information for monitoring purposes
- If you apply for a job or volunteer for us, information necessary for us to process your application and assess your suitability – this may include things such as your employment status or unspent criminal convictions.
- information as to whether you are a taxpayer to enable us to claim Gift Aid
- where you have left us a legacy, information regarding the Executors of the Will which you may have provided us
- information about your activities on our website or social media platforms when you interact with us, for example your IP address
- information about your income and the money you owe where we are providing advice and information on income and debts
- any other personal information you provide to us
We may also collect special category data. This is certain types of personal data that is considered to be more sensitive. Examples of special category data are information about your health, race, religious beliefs, sex life or sexuality or genetic/biometric information.
We will make it clear to you as to why we are collecting this type of information and tell you what it will be used for. For example, we may need this information to provide you with support if you are using one of our services. We will keep special category data in strict confidence – only those members of staff who need to see or report on this information can see it.
- How We Use Personal Information
We will use personal information to:
- provide you with a support service
- administer your donation or support your fundraising (including processing Gift Aid)
- keep a record of your relationship with us
- respond to queries, requests and complaints
- send you correspondence and communicate with you (see supporter section below)
- check for updated contact details against third party sources so we can stay in touch with you
- understand how we can improve our services by carrying out evaluations
- generate reports on our services and our work
- manage Prince Jim Shepherd Nadiope Foundation events
- further our foundation objectives
- safeguard our staff and volunteers
- process your application for a job or to volunteer
- conduct training
- audit and administer our accounts
- carry out fraud prevention and money laundering checks
- establish, defend, or enforce legal claims
- conduct due diligence
- identify potential supporters, donors and other partners
- understand how you engage with us through our website to enable us to improve user experience
- test our technical systems to ensure it is working correctly
- meet our legal obligations, for example a contract or our obligations to regulators, government and law enforcement bodies
Our Services may link to or integrate with social media platforms, including but not limited to Facebook, Twitter, Instagram, or Snapchat. When you connect a social media account to our Services, then we may collect information about that social media account and share information with that social media account as described in the connection process. This collected information may include, but is not limited to, your name, email address, demographic information from your profile, friend lists, postings or other content, and your profile picture. You acknowledge and agree that Prince Jim Shepherd Nadiope Foundation is not responsible for the data collection or use practices of any such connected social media platform. You should read each social media platform’s privacy policy before connecting that social media account.
- Marketing and Profiling
We want to keep in touch with our supporters about the work we do, and tell you about the amazing difference you’re making, and how your support (both financial and non-financial) could help more people severely affected by mental illness. We will only keep in touch if you tell us via our contact preferences forms that you are happy for us to contact you (this is ‘opting-in’) by phone, email, or SMS.
‘Marketing’ is defined as anything which ‘furthers the aims of the foundation’ and includes things like our newsletter, fundraising appeals and campaigning actions like us asking you to sign a petition or email your Member of Parliament.
If you give us your address, we will write to you to keep you updated about our work, appeals, campaigns and events (this is postal marketing, to which we apply legitimate interest), and will continue to do so, unless you tell us otherwise, or we have had no other contact from you one year from then. Just before that we will ask you again if you still want to hear from us.
Where we have your consent to use your details for marketing, you can withdraw it at any time by contacting us at supportercare@princejimshepherd.org or +256750421123. We will ask you every year if you are still happy to hear from us if you have not donated, signed a petition or otherwise engaged with us within that time.
We might personalise our communications to you (for example by looking at donations you have already given us and sorting them by date, subject, frequency and amount), and use this to decide if and when we ask you again. It makes communications more relevant to you and is based on behaviour – not by purchasing data from outside sources.
- Why We Ask For Information About Your Interest In Mental Health?
Sometimes we may ask you what your link is to mental illness. For example, if you have a mental illness yourself, or if a friend or relative of yours does, or if you have another connection to mental illness.
We ask for this information so we can understand more about people who support us. It can help us to provide you with information that is more relevant to you; it can help us represent you better in our campaigning work; and it helps us ensure we are carrying out diversity and inclusion best practice, and best practice within our own governance.
If you are happy for us to keep this information, we will treat it with strict confidence. If you do not want us to have this information you do not need to provide it.
- Do You Profile My Data For Marketing Purposes?
Yes, we do segment existing supporter data, for example, at postcode level, in order to see if we can find new supporters of a similar profile. At Prince Jim Shepherd Nadiope Foundation, our work is only made possible thanks to the generosity of our supporters, so it’s vital that our fundraising efforts are as effective as they can be. By developing a better understanding of our supporters through researching them, including using publicly available sources, we can tailor and target our fundraising events and communications (including volunteering opportunities) to those most likely to be interested in them. This allows us to be more efficient and cost-effective with our resources, and also reduces the risk of someone receiving information that they might find irrelevant, intrusive, or even distressing.
After taking a supporter’s preferences into account, we, or our trusted service providers, may also use information we hold on such supporters to research their potential to be a significant donor to Prince Jim Shepherd Nadiope Foundation, and collect additional details relating to their employment and any philanthropic activity. This might also include estimating their gift capacity, based on their visible assets, history of charitable giving and how connected they are to Prince Jim Shepherd Nadiope Foundation.
We’re committed to putting you in control of your data and you’re free at any time to opt out from this activity. To find out more please contact us at supportercare@princejimshepherd.org
- Online advertising
When we do online (paid search) advertising – this is anonymously targeted at those using websites we think will attract new supporters to us, or at those web users who have shown an interest in the foundation or related subjects. We do not store data received in this way – we place ads according to online behaviours and interests
We do not collect remarketing data for users who have visited our advice and information pages.
We follow Facebook’s and Instagram’s strict advertising policies when using that platform, and we only target based on ‘likes’ on our page or similar anonymised data using cookies.
We do not ever upload our own supporters’ data to Facebook or Instagram for advertising purposes, as we do not consider this is a fully ‘opted-in’ position to take.
Prince Jim Shepherd Nadiope Foundation currently advertises on the following social media channels:
- X (formerly tweeter)
- Google Search
- Legal Basis for Processing Your Information
Data protection laws require us to have a “legal basis” for processing your personal information. The relevant legal bases are set out in current Uganda data protection legislation (Data Protection and Privacy Act of Uganda, 2019
Consent: We ask you if we can use your personal information in a certain way, and you agree to this. Where we use your information for a purpose based on consent, you have the right to withdraw your consent at any time.
Contract: We have a basis to use your personal information where we are entering into a contract with you or are performing our obligations under that contract. An example of this would be applying to work or volunteer with us.
Legal obligation: We use your personal information to comply with one of our legal or regulatory obligations. For example, we may need to share your information with the Police or regulators such as the Uganda Registration Service Bureau.
Vital interests: We may use your personal information where it is necessary for us to protect health or life. For example, we may pass your personal details to the emergency services.
Legitimate interests: We have a basis to use your personal information if it is reasonably necessary for us to do so and in our legitimate interests. Some examples (e.g. based on legal need or a contract) of us using personal information under “legitimate interest” are:
- Where you have given us your details we may use them to process your donation to us to set up and fulfil your membership, e.g. to send out copies of your invoice to you or to contact you. This counts as a type of contract because you asked us to do this for you.
- If you attend one of our services we will keep professional records of the support we’ve given you and who else is involved in your care – this is also a type of contract.
- When dealing with your personal information we will at all times comply with the Uganda Data Protection Act 2019 and any other applicable legislation.
How Do You Keep My Information Secure?
We will take precautions to prevent the loss, misuse, or unauthorised alteration of personal information you give us. For example, our website does not store your personal information when you enter it into one of our contact preference forms – it links directly to our secure database.
We may send communications to you by email. Email is not a fully secure means of communication, and whilst we do our utmost to keep our systems and communications protected, we cannot guarantee this.
We make no representations about any other websites, and when you access any other website through a link on our website (including social media sites) you should understand that it is independent from us and that we have no control over that website or the way your personal information is collected through those websites.
Those websites may have their own privacy policies and we encourage you to look at those policies or contact the website operators directly to understand how your personal information is used.
Although we have a link to other mental health service providers in that we collaborate with them, we have separate databases with separate data sign-up forms and we never transfer data between these organisations.
Most of our data storage and transfer solutions are based in the EEA; however, we do use a cloud-based email marketing solution that is based outside of the EEA. All data is stored and transferred in accordance with current Data Protection regulations through contract. Where data is sent outside of EEA, we have Standard Contractual Clauses in place to ensure the same level of data protection security is applied
How Long Do We Keep Your Information?
We will keep data for only as long as it makes sense to do. We will take the following into account when determining the retention period for personal data:
- the purpose for which we process your personal data and how long we need to keep it in order to achieve that purpose
- how long the information is likely to remain accurate
- how long the information might be relevant to possible future legal claims
- any applicable legal, reporting, regulatory or accounting requirements which specify how long certain records need to be kept
In general, we will review your data 2 years after your last contact with us and delete or minimise those we have no reason to keep. Our marketing contact stops automatically after 2 years if the basis on which we can legitimately contact you lapses (see note above in section 2 on ‘consent’). If you ever change your mind about your marketing choices, you can update your contact preferences at any time by calling us on +256750421123, on supportercare@princejimshepherd.org or by returning to a contact form on this website and changing your preferences yourself. Any choices you make will overwrite any previous preferences you told us. This helps us record the most up-to-date information for you.
If you don’t want us to hold your data at all anymore, we have a duty to let you know that the best way for us to be sure we don’t contact you again is to minimise the data we hold (e.g. reduce it to name and last known address) and then ‘block’ those details from contact rather than delete them completely. If you have a special reason for us to delete all record of you – just let us know.
- Sharing Your Information with Other Organisations or Individuals
We will never sell your data to another organisation.
If we ever need to send data to a third party (for example to our printers to send you a magazine you asked for), we will make sure the company we use has signed a data processing agreement with us, so that they are bound to take care of your data in the same way we do.
We may disclose your information if required to do so by law (for example, to comply with applicable laws, regulations, and codes of practice, or in response to a valid request from a competent authority).
Your rights
Uganda Data Protection law provides you with rights over the personal information we hold about you.
Right to access your personal information
You have the right to request to access to and/or request a copy of the personal information we hold about you. We will provide you with this information unless legal exemptions apply.
Right to have your inaccurate information corrected (right to rectify)
You have the right to have inaccurate or incomplete information we hold about you corrected. If you believe the information we hold about you is inaccurate or incomplete, provide us with details and we will review, and where applicable, correct any inaccuracies.
Right to restrict use
You have the right to ask us to restrict the processing of some or all of your personal information. You can request this if; some information we hold on you isn’t right; we are not lawfully allowed to use it; you need us to retain your information in order for you to establish, exercise or defend a legal claim; or you believe your privacy rights outweigh our legitimate interests to use your information and you have objected to us doing this.
Right to erasure
You have the right to ask us to delete some or all of your personal information. If we are unable to delete your information, as there are some exceptions where we are unable to delete personal information, we will explain why this is.
Right for your information to be portable
You have the right to receive your personal information in a commonly used format and to request that we provide the information to another provider (data controller).
Right to object to the use of your personal information
If we are processing your personal information, you have the right to object to the processing of that data at any time. If you request this, we will stop processing your data.
In relation to all of these rights, please email or write to us at the address below. Please note that we will require proof of identity in order to carry this out and ask you the scope of the request you’re making, so that we can best help you within the applicable timeframe of one month (in accordance with the Information Commissioner’s Office guidelines).
In certain circumstances (for example where required or permitted by law) we might not be able to provide you with access to some of your personal information, but where appropriate we will notify you of the reasons for this.
- Information Security
We utilize reasonable information security measures to safeguard your Personal Information against unauthorized access, modification, or destruction. For example, we utilize Secure Socket Layer (SSL), Transport Layer Security (TLS), or similar encryption technology when sensitive data is transmitted over the Internet, and use firewalls to help prevent external access into our network. However, no data transmission over the Internet and no method of data storage can be guaranteed to be 100% secure. Therefore, while we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its security.
We restrict access to Personal Information in our possession to our employees, Service Providers, and Online Tool Providers who need to know that information in order to operate, develop, improve or support our Services. If we share Personal Information with Service Providers or Online Tool Providers, we require that they also use reasonable information security measures to safeguard your Personal Information.
- Third Party Websites
Please note that the Services may link or integrate with third-party sites, services or apps. We are not responsible for the privacy or security policies or practices or the content of such third parties. Accordingly, we encourage you to review the privacy and security policies and terms of service of those third parties so that you understand how those websites collect, use, share and protect your information.
- Changes to this Policy
We may modify or update this Privacy Policy periodically with or without prior notice by posting the updated policy on this page. You can always check the “Last Updated” date at the top of this document to see when the Privacy Policy was last changed. If we make any material changes to this Privacy Policy, we will notify you by reasonable means, which may be by e-mail or posting a notice of the changes on our website prior to the changes becoming effective. We encourage you to check this Privacy Policy from time to time. IF YOU DO NOT AGREE TO CHANGES TO THIS PRIVACY POLICY, YOU MUST STOP USING THE SERVICES AFTER THE EFFECTIVE DATE OF SUCH CHANGES (WHICH IS THE “LAST UPDATED” DATE OF THIS PRIVACY POLICY).
How to Contact Us?
If you wish to exercise any of the rights above, please contact our Data Protection Officer, Samuel Zavuga. You can contact her at info@princejimshepherd.org If you have any questions about this policy, please contact us at supportercare@princejimshepherd.org or +256750421123