Privacy Policy

1. Introduction

Uganda One Festival 2026 ("we", "us", "our") is committed to protecting your privacy and handling your personal data lawfully, fairly, and transparently. This Privacy Policy explains what personal information we collect from you when you interact with our website, registration platform, and event activities, and how we use, store, and protect that information.

This policy is drafted to align with the Data Protection and Privacy Act, 2019 of Uganda and the Data Protection and Privacy Regulations, 2021.

2. Who We Are (Data Controller)

For the purposes of data protection law, the data controller is:

• Uganda One Festival
• Address: Plot 66, Katego Rd, Kampala, Uganda
• Email: info@ugandaonefestival.com
• General contact: info@ugandaonefestival.com
• Phone: +256 788 474 635

If you have any questions about this policy or how we handle your data, please use the privacy email above.

3. Data We Collect

The personal data we collect depends on how you interact with us:

3.1 When you register as an Exhibitor, Vendor, Performer, or Partner

• Identity data: full name, stage name (for performers), business or organisation name, date of birth or age, gender
• Contact data: email address, phone number, postal address, region, country
• Demographic data: region in Uganda, gender
• Application content: creative domain or vendor type, product/service description, performance type, portfolio links, social media handles, supporting photos and documents you choose to upload
• Compliance data (vendors): health certificates, trade licences, food handler permits, and other regulatory documents required by Ugandan authorities
• Payment data (vendors): transaction reference numbers, mobile money phone numbers, payer name, payment receipt uploads — we do not store full payment card details

3.2 When you use our website

• Technical data: IP address, browser type, device information, operating system
• Usage data: pages visited, time spent on pages, links clicked
• Cookies: see Section 10

3.3 When you communicate with us

• Email content, SMS replies, support inquiries, social media interactions

4. How We Use Your Data

We use your personal data for the following purposes:

• To process, review, and respond to your festival application
• To communicate with you about your application status, including approval, rejection, and follow-up requirements (by email and SMS)
• To verify vendor payments and compliance documents
• To allocate booths, performance slots, and partnership packages
• To send invitation cards, QR passes, and on-site access credentials
• To send important festival updates and logistical information
• To produce festival programmes (with consent, your stage name and performance details may appear in publicly distributed schedules)
• To analyse application trends and improve future events (using anonymised or aggregated data)
• To comply with legal obligations, including health, safety, tax, and regulatory requirements
• To prevent fraud, ensure security, and enforce our terms

5. Legal Basis for Processing

Under the Data Protection and Privacy Act, 2019, we rely on the following lawful bases:

• Consent: when you voluntarily submit your application or subscribe to communications
• Contract: when processing is necessary to evaluate, approve, and deliver on your festival participation
• Legal obligation: for tax, health and safety, and other regulatory compliance
• Legitimate interests: for fraud prevention, security, and event management — only where these don't override your rights

You may withdraw consent at any time by emailing us, though doing so may affect our ability to process your application.

6. Sharing with Third Parties

We do not sell your personal data to anyone. We share data only when necessary, with the following categories of recipients:

• Festival operations partners — stage crews, booth allocators, security, accreditation teams — strictly for festival logistics
• Payment processors — Stanbic Bank Uganda, Airtel Money, MTN Mobile Money — for processing vendor application fees
• Communication providers — email and SMS gateways (e.g. Africa's Talking, EgoSMS) — for sending notifications
• Government and regulatory bodies — where required by Ugandan law (e.g. KCCA health inspections for food vendors, URA for tax matters)
• Selected media partners — with your consent, public-facing performer or exhibitor information for festival promotion
• Legal authorities — when required by court order, subpoena, or similar legal process

All third parties handling your data on our behalf are required to maintain confidentiality and use appropriate security measures.

7. How Long We Keep Your Data

We retain personal data only for as long as needed for the purposes set out above:

• Approved applicants and participants: for the duration of festival operations and up to 3 years after the event, for record-keeping, finance reconciliation, and future event invitations
• Rejected applicants: for up to 12 months after the event, for record-keeping and to inform future application cycles
• Payment records: for at least 7 years, as required by Ugandan tax and financial regulations
• Compliance documents (health certs, licences): until expiry plus 24 months
• Marketing communications: until you opt out

After these periods, data is securely deleted or anonymised.

8. Security Measures

We use industry-standard security practices to protect your data:

• HTTPS/TLS encryption for all data transmitted between your browser and our servers
• Encrypted database storage with restricted access
• Strong password requirements and CSRF protection on all forms
• Role-based access controls — only authorised festival administrators can view applications
• Regular security audits and patch management
• Secure file uploads with size and type restrictions
• Activity logging for all administrative actions on your data

However, no online system is 100% secure. If you discover or suspect a security vulnerability, please email security@ugandaonefestival.com immediately.

9. Your Rights

Under the Data Protection and Privacy Act, 2019, you have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure ("right to be forgotten"): request deletion of your data, subject to our legal obligations to retain certain records
• Restriction: ask us to limit how we use your data while a concern is being resolved
• Objection: object to processing based on legitimate interests, or to direct marketing at any time
• Data portability: receive your data in a structured, commonly used format
• Withdraw consent: withdraw any consent you previously gave
• Lodge a complaint: contact the Personal Data Protection Office (PDPO) of Uganda

To exercise any of these rights, email privacy@ugandaonefestival.com with the subject "Privacy Request" and we will respond within 30 days.

10. Cookies & Tracking

Our website uses cookies and similar technologies for:

• Essential cookies — required for login sessions, CSRF protection, and form state
• Functional cookies — remember your preferences and form drafts
• Analytics cookies — anonymised usage data to help us improve the site (we do not use intrusive cross-site tracking)

You can disable non-essential cookies in your browser settings, though some site features may not function correctly without them.

11. Children's Data

Our registration platform is intended for individuals aged 13 and above. Where applicants under 18 register as performers or exhibitors, we require parental or guardian consent and may collect contact information for the guardian. We do not knowingly collect personal data from children under 13. If you become aware that a child under 13 has provided us with personal information, please contact us immediately so we can delete it.

12. International Transfers

We primarily process data within Uganda. Where data is transferred internationally (e.g. through cloud email providers, SMS gateways), we ensure such transfers comply with Section 19 of the Data Protection and Privacy Act, 2019, including using providers that maintain adequate data protection standards.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when changes were last made. For significant changes that affect how we use your data, we will notify you by email or a prominent notice on our site at least 30 days before the change takes effect.

14. Contact Us

For any questions, concerns, or to exercise your rights, please contact us: