This Privacy Policy outlines how SpaceUG, a digital civic engagement platform developed under the CIVICUS Crisis Response Fund, collects, uses, discloses, stores, and protects your personal information. By using spaceug.org (“we,” “our,” “the Platform”), you agree to the terms and practices described below.

We are committed to upholding your privacy, safety, and digital rights—especially within the context of shrinking civic space and rising digital risks for human rights defenders, civil society actors, and grassroots communities.

1. Who We Are

SpaceUG is a civic tech platform based in Uganda, operating under the guidance of local and international best practices on data protection and digital security. Our mission is to protect civic space, foster civic engagement, and support marginalized voices through digital tools and collective action.

We recognize the importance of privacy and data integrity, especially in environments where civic actors are vulnerable to surveillance, harassment, and political reprisals.

2. Scope of This Policy

This policy applies to:

• Visitors browsing the public content on spaceug.org

• Registered users with personal profiles

• Contributors, bloggers, and civil society organizations sharing content

• All interactions involving data submission, content upload, or account creation on the Platform

This policy does not apply to external links or third-party tools embedded on the site, which are governed by their own privacy policies.

3. What Information We Collect

We collect information to facilitate user interaction, platform security, and community coordination. Information is collected in three primary ways:

a. Information You Provide Directly

When you register, post, or interact with the Platform, we may collect:

• Personal identifiers: full name, email address, username

• Account data: password (stored securely using encryption)

• Profile information: photo, gender identity, location (optional), bio, organizational affiliation

• Contact and communication: messages, reports, forum replies, blog submissions, or event RSVPs

• Voluntary disclosures: such as self-identified gender, disability status, or advocacy focus areas

b. Information We Collect Automatically

• IP address and geolocation (approximate)

• Device and browser information

• Referring website or traffic source

• Pages viewed, session durations, and site interactions

• Login timestamps and log-out events

c. Information From Third Parties

We may receive limited data via integrations (e.g., secure identity providers or civic funding networks) where user consent is expressly given.

4. Purposes of Data Collection

We process your information for the following purposes:

We do not use your data for advertising, commercial targeting, or political profiling.

5. How We Store and Protect Your Data

Your data is stored securely in encrypted databases, with the following safeguards in place:

• End-to-end encryption for passwords and sensitive records

• HTTPS encryption for all traffic

• Access controls limiting platform administration to authorized personnel only

• Two-factor authentication (2FA) for critical backend access

• Regular vulnerability scanning and software updates

• Data backups in secure locations

In case of a data breach, we will notify affected users and authorities in line with the Uganda Data Protection and Privacy Act (2019) and other applicable standards.

6. Data Sharing and Disclosure

We respect your privacy and will only share your data when necessary:

a. With Trusted Service Providers

Such as hosting providers, data processors, or email delivery tools. All providers must agree to equivalent data protection commitments.

b. Legal and Regulatory Authorities

Only when compelled by lawful government orders or court mandates, and only after exhausting protective mechanisms.

c. Aggregated and Anonymized Reporting

We may share anonymized data for research, advocacy impact reports, or donor transparency never tied to your identity.

d. With Your Explicit Consent

In cases where user testimonials, spotlight stories, or campaigns require publishing your information, we will seek your consent first.

7. Your Rights

You have the following rights under applicable data protection laws:

• Right to access – You can request a copy of your personal data.

• Right to rectification – You can request correction of inaccurate or outdated information.

• Right to erasure ("right to be forgotten") – You can request full account and data deletion.

• Right to object – You may object to certain uses, such as emails or profiling.

• Right to restrict processing – In case of disputes or legal matters.

• Right to withdraw consent – For newsletters or any processing based on consent.

To exercise your rights, contact us at: privacy@spaceug.org

8. Cookies and Analytics

We use essential cookies for session management and login functionality. We also use privacy-respecting analytics tools (e.g., Matomo or Plausible) that:

• Do not track personal identities

• Do not set invasive tracking cookies

• Respect “Do Not Track” browser signals

You can control cookies via your browser settings.

9. Children’s Privacy

SpaceUG is not intended for children under the age of 16. We do not knowingly collect data from minors. If you are a parent or guardian and believe we’ve collected data from a child, please contact us for prompt removal.

10. International Data Transfers

Data may be processed outside of Uganda (e.g., in Germany, France, or the Netherlands) if required by trusted service providers. We ensure all transfers comply with applicable international data protection agreements and safeguard frameworks.

11. Account Deletion and Retention Policy

You can request deletion of your account at any time via:
📧 privacy@spaceug.org or via your account settings (coming soon)

• We will erase all personal data within 14 business days, unless legally required to retain it.

• Public posts (e.g., blogs, comments) may remain in anonymized or attributed form unless removal is explicitly requested.

• Inactive accounts may be archived after 12 months and deleted after 24 months of inactivity, with notice provided in advance.

12. Policy Updates

We may revise this Privacy Policy periodically to reflect changes in legal requirements, technology, or platform features. Users will be notified via email or site banners when significant changes occur.

13. Contact Information

For questions, concerns, or data requests, please contact:

Data Protection Lead – SpaceUG
📧 privacy@spaceug.org
🌍 www.spaceug.org

We commit to creating a civic platform rooted in transparency, safety, and inclusion. Thank you for trusting us.