Privacy Policy

Code Academy Uganda Limited (“Code Academy”, “we”, “us”, “our”) provides technology education to children and young people. This Privacy Policy explains how we collect, use, store, disclose and protect personal data about students, parents/guardians and other individuals in line with the Ugandan Data Protection and Privacy Act, 2019 (the Act). By enrolling a child, contacting us or using our services you acknowledge this policy and the rights it describes.

This policy applies to all personal data processed by Code Academy in Uganda and in connection with our services, including data collected in-person, via our website, apps, forms, email and social media. It covers data about students (including minors), parents/guardians, staff, suppliers and other contacts.

• Data Controller: Code Academy Uganda Limited, Mpererwe, Mugalu Zone, Kampala, Uganda.
• Data Protection Officer (DPO): dpo@codeacademyug.org
• Phone: +256 784 781926

You may contact the DPO for records requests, complaints, or privacy questions.

We collect only the personal data necessary for the purposes described below. Categories include:

• Parent/Guardian: full name, phone number, email, physical address, relationship to child, billing information.
• Student: full name, date of birth, gender, school/grade, attendance records, learning progress, projects, class placement.
• Sensitive data (collected only with explicit consent): medical conditions, allergies, special learning needs, disability information.
• Media: photographs, video and audio recordings captured during classes, events and promotional activities.
• Technical/website data: IP address, device/browser type, cookies and usage logs.
• Financial/payment data: payment card/token details or references collected by our payment processor.

We rely on the following lawful bases under the Act:

• Consent: for sensitive data, marketing, media use and any processing where explicit consent is required.
• Contractual necessity: to enrol students, deliver courses and manage payments and relationship obligations.
• Legal obligation: to comply with statutory, regulatory or contractual duties.
• Legitimate interests: for internal administration, improving services, fraud prevention and ensuring safety, provided these do not override data subject rights. Where legitimate interest is relied upon, we document and balance those interests.

We process personal data for:

• Administration and delivery of education programs, registration, class management and progress reporting.
• Health and safety: addressing medical needs, allergies and safeguarding.
• Communications: operational notices, invoices, schedules, progress reports and service updates.
• Improvement: curriculum assessment, internal research and quality assurance.
• Marketing and promotion: showcasing student work or events
• Legal and compliance: responding to lawful requests from authorities, record-keeping and dispute resolution.
• IT, security and fraud prevention.

• Children’s data: For persons under 18, parental or legal guardian consent is required for all processing beyond what is necessary to provide education (including any media or marketing use).
• Withdrawal: Parents/guardians may withdraw any social media consent at any time by contacting our DPO at dpo@codeacademyug.org. Withdrawal will not affect lawful processing already carried out prior to withdrawal. We will stop future uses of the child’s media on the withdrawn platform(s) within 30 calendar days of receipt of the withdrawal request.

• Separate consent for public-facing material: Use of photographs, video or audio of students in public-facing printed or broadcast advertising (billboards, TV, cinema, large-scale outdoor/OOH) requires a separate explicit written consent form from the parent/guardian and cannot be authorised by the registration media opt‑in alone.
• Scope and limits for social media: Consent given via the registration media opt‑in covers posting to the TikTok, WhatsApp, X, Instagram, Facebook, LinkedIn, YouTube for promotional and educational purposes as described at the time of consent. We will not publish a student’s full name together with their image on any public-facing post unless the parent/guardian has given explicit additional consent for naming.
• Time-limited, revocable licence: Media consent for social platforms is time‑limited and revocable. Unless otherwise specified on the consent, platform consent will remain valid for three years from the date given. On withdrawal or expiry we will cease future use on the affected platform(s) within 30 calendar days.
• Recordkeeping and operational safeguards: All media consents, withdrawals and verification steps will be logged. Staff will check the media opt‑in/opt‑out list before any photography/recording and will exclude children whose parents/guardians have not consented or who have opted out.

We do not sell personal data.

We share data with staff who need it to perform their duties and with trusted processors (payment processors, cloud providers, learning platforms, email and SMS providers, code camp venue management). Example processors: Google Workspace, Microsoft 365, Skillsbox or other named providers where applicable.

• Processor safeguards: all processors are subject to Data Processing Agreements requiring confidentiality, security, limited use, deletion/return of data and compliance with the Act. We perform due diligence and reserve audit rights.
• Cross-border transfers: where personal data is transferred outside Uganda we implement safeguards (contractual protections, equivalent protection checks or explicit consent) to ensure adequate protection.

We implement appropriate technical and organisational measures, including:

• Access controls and role-based permissions;
• Encryption of data in transit and where practicable at rest;
• Regular backups, malware protection and secure configuration of systems;
• Staff training on data protection and confidentiality;
• Background checks for staff who handle children’s data where appropriate;
• Periodic security reviews and, where appropriate, third-party security assessments.

We retain personal data only as long as necessary for the purpose collected, legal obligations or legitimate business needs. Typical retention periods:

• Student enrollment and progress records: duration of enrolment plus 7 years.
• Medical/sensitive data: while the student is enrolled and as needed for safety; deleted once no longer necessary unless retention is required by law.
• Media: up to 5 years unless the consent specifies longer; media with explicit longer consent retained as agreed.
• Financial/payment records: 7 years to satisfy accounting and tax requirements.

Specific retention schedules will be applied and documented. On expiry of retention we securely delete or anonymise data.

Under the Act you have the right to:

• Access your personal data and request a copy;
• Rectify inaccurate or incomplete data;
• Erasure (right to be forgotten) where there is no lawful reason to retain data;
• Object to processing, including for direct marketing;
• Withdraw consent at any time for processing that relied on consent;
• Restrict processing and request portability where applicable.

To exercise rights, contact the DPO at dpo@codeacademyug.org. We will verify identity and respond within the timeframes required by the Act (usually within 30 days); complex requests may require extension with notice.

We maintain an incident response plan. If a personal data breach occurs that is likely to result in risk to the rights and freedoms of individuals we will:

• Notify the Data Protection Office and affected data subjects without undue delay and in accordance with statutory requirements;
• Contain the breach, assess impact, and implement remediation measures;
• Keep records of breaches and our response actions.

We will conduct DPIAs for processing likely to result in high risk to individuals’ rights and freedoms (for example, systematic monitoring of children, large-scale processing of sensitive data, or extensive recording of minors). DPIAs will document risks and mitigation measures.

We maintain records of processing activities, DPIAs, consent records and vendor contracts. Processors must comply with our security and data protection requirements. We perform periodic reviews and audits of key processors.

We may update this policy to reflect changes in law or our practices. Significant changes affecting data subject rights or major processing operations will be notified by email or website notice. The “Last Updated” date at the top reflects the current version.

If you have a concern about our processing of personal data, please contact our DPO first at dpo@codeacademyug.org. If unresolved you may lodge a complaint with the Uganda Data Protection Office / National Information Technology Authority or other designated supervisory authority under the Act.

Code Academy Uganda Limited

• Mpererwe, Mugalu Zone, Kampala, Uganda
• DPO email: dpo@codeacademyug.org
• General email: info@codeacademyug.org
• Phone: +256 784 781926

By enrolling a child, yourself or otherwise providing personal data, you confirm that you have read and understood this policy and, where required, provide consent for media capture and usage for promotional purposes.