VIPAWA CHILDREN’S ART MUSEUM UGANDA (VCAM) PRIVACY NOTICE
Effective as of: 8th November, 2025
Introduction
Vipawa Children’s Art Museum (“VCAM”, “we”, “our”, “us”) is committed to protecting the privacy and personal data of our visitors, children, parents/guardians, donors, website users and other supporters. This Privacy Notice explains how we collect, use, disclose and safeguard personal data in line with the Data Protection and Privacy Act, 2019, Data Protection and Privacy Regulations (Uganda) and other applicable laws.
Scope
This notice applies to visitors to our website and digital platforms, participants in our programs and events, parents/guardians, donors, members, subscribers, volunteers, and other individuals whose personal data we collect or process.
Data Controller
The Data Controller for your personal data is VCAM.
Information We Collect and How We Use It
We collect and use personal data for various purposes as outlined in the table below.
| Type of Personal Data Collected | Purpose of Processing / Use | Legal Basis |
|---|---|---|
| Name, age, gender, contact details (phone, email, address) | To register participants, manage memberships, process event sign-ups, communicate with parents/guardians, and send confirmations. | Contractual necessity; Legitimate interest (programme administration) |
| Parent/Guardian information (name, contact, relationship to child) | To obtain verifiable consent for a child’s participation and ensure parental contact in emergencies. | Legal obligation; Consent |
| Child participation data (programme enrolment forms, workshop records, attendance logs) | To manage children’s participation in museum programmes and maintain accurate records. | Contractual necessity; Legitimate interest |
| Health or allergy information (where provided) | To protect the safety and well-being of children during museum activities; to respond to medical emergencies. | Explicit consent; Vital interests of the data subject |
| Photographs, videos, artwork, stories of children or visitors | To celebrate participants’ achievements, promote museum activities on social media and publications, and document our impact. | Explicit consent from parent/guardian |
| Payment details (billing address, transaction references, membership or donation records) | To process payments, issue receipts, and maintain donation/membership records. | Contractual necessity; Legal obligation (financial record-keeping) |
| Email addresses for newsletters and subscriptions | To share updates, educational content, event information, and fundraising campaigns. | Consent (opt-in basis); Legitimate interest (museum communications) |
| Technical data (IP address, browser, cookies, device identifiers) | To analyse website usage, improve functionality, enhance user experience, and ensure security. | Legitimate interest; Consent (for cookies) |
| Survey and feedback information | To improve programmes, evaluate impact, and design better services. | Legitimate interest; Consent |
| Volunteer/staff data submitted online | To manage recruitment, on boarding, and communication with volunteers. | Contractual necessity; Legal obligation |
| Emergency contact details | To ensure rapid communication in case of incident involving a child or visitor. | Vital interests; Legal obligation |
Children’s Privacy
Vipawakids only collect or use a child’s personal data with verifiable parental or guardian consent. We will not knowingly collect personal information from children without such consent. Parents may withdraw consent at any time.
Sharing, Disclosure and International Transfers
We do not sell personal data. Where data is shared (e.g., with technical service providers or cloud storage partners), we ensure they comply with Uganda’s Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations. Data may be transferred internationally only in compliance with applicable safeguards.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes outlined in this notice, or as required by law. For children’s programme participants, data is kept for up to two (2) years after completion, then securely deleted or anonymised.
Data Security
We maintain appropriate physical, technical, and organizational measures to protect data against unauthorized access, loss, or misuse. These include lockable storage, restricted access, password-protected systems, and secure disposal of obsolete data.
Rights of Data Subjects
Parents/guardians and data subjects have the right to access, correct, delete, or object to processing of their personal data, and to withdraw consent. Requests should be made via the contact details below.
Cookies and Online Tracking
Our website uses cookies to enhance user experience and analyse site usage. Users can control cookies through their browser settings.
Data Breach Procedure
In case of a data breach, VCAM will immediately contain the incident, notify affected individuals and the Personal Data Protection Office, and take corrective actions to prevent recurrence.
Changes to this Privacy Notice
We may update this Privacy Notice from time to time. Any updates will be posted on our website with a revised ‘Last Updated’ date.
Questions about our Privacy Notice
If you have any questions about these privacy statements, the practices of this site, or your dealings with this Web site, you can contact us at vcam@vipawakids.org