Privacy Policy

1. WHO I AM

This website, ivankabandize.com, is run by Ivan Kabandize, in Kampala, Uganda. I am the data controller for the personal data described here.

About this policy. This policy explains what personal data this website collects, why I collect it, who helps me handle it, how long I keep it, and the choices you have. I have written it in plain language on purpose. Where a legal word is unavoidable, I explain it.

What "personal data" means. It means any information that identifies you, or could be used to identify you, such as your name, your email address or an online identifier. In this policy "I" and "me" mean Ivan Kabandize, "you" means anyone who visits or uses the site, and "the site" means ivankabandize.com.

What is required and what is optional. I only ask for what I need. Where a field is marked optional you can leave it empty and nothing changes. If you leave out something that is required, I may not be able to do what you asked. For example, I cannot reply to your message without an email address. If you are not sure which details are required, ask me by writing to privacy@ivankabandize.com.

Details about other people. If you give me someone else's details, for example by mentioning a colleague in a message, please make sure they are happy for you to do so.

This policy covers this site only. It does not cover other websites, even if I link to them. You can print this page for your records using your browser's print command.

Questions or requests about your data: privacy@ivankabandize.com.

2. THE SHORT VERSION

I collect what I need to run this site: your messages, your account if you make one, and basic anonymous visit counts. I do not sell your data. I do not use advertising trackers. You can ask me for a copy of your data or ask me to delete it at any time.

3. WHAT I COLLECT, WHY, AND ON WHAT BASIS

The table below shows, for action you might take on the site, what I collect, why I collect it, and the legal reason (called the "basis") that allows me to do so.

A copy of the download link is also emailed to you. Being a download contact never adds you to a newsletter or the community. Each is a separate choice.

What the "basis" column means. The law says I need a valid reason before I use your personal data. These are the reasons I rely on:

• Your consent. You said yes, for example by ticking a box to join a newsletter. You can change your mind at any time, and withdrawing should be as easy as agreeing was. Withdrawing does not affect anything I did before you withdrew.
• Your request or agreement. I need the data to do what you asked, such as replying to your message or running your account.
• My legitimate interest. I have a sound reason to use the data that does not override your rights, for example counting visits so I know which articles are read, or keeping the site secure. If you object, I will stop unless I have a strong reason that outweighs your interests.
• A legal duty. Sometimes the law requires me to keep or share data, for example if a court orders it.

If you would like to know which reason applies to a particular thing I do with your data, ask me at privacy@ivankabandize.com.

4. WHO ELSE HANDLES YOUR DATA

I use these services to run the site. They process data on my behalf. You can ask me for the current list of the services I use at any time.

I do not sell your data. I do not sell it, rent it or trade it, and I do not share it with advertisers. I only share it with the services below, so that they can do the specific job I have given them, and they may only use it for that.

When I might have to disclose data. If a court, regulator or other public authority legally requires it, I may have to share personal data. I may also use it to protect my legal rights if there is a dispute or legal claim connected with the use of this site.

Where your data goes. The site's database is in Ireland. The site itself is hosted in the United States (East), and some of the services above operate worldwide. This means your data may be handled outside the country where you live.

Uganda's Data Protection and Privacy Act, 2019 (section 19) says personal data may only be processed or stored outside Uganda if the receiving country protects it at least as well as the Act does, or if you have consented. I choose providers that use recognised safeguards. For example, Vercel and Resend are certified under the EU-US Data Privacy Framework, and Supabase uses standard contractual clauses (legal agreements approved for international transfers) when data moves to the United States and Singapore.

You can ask me where a particular service handles your data by emailing privacy@ivankabandize.com.

5. HOW LONG I KEEP YOUR DATA

I keep your data only for as long as I need it for the reason I collected it. The table shows how long for each kind of data.

When data is due for deletion I remove it or anonymise it so it can no longer identify you.

Why some data is kept longer. I may keep data for longer if you have agreed to it, if the law requires it, or if I need it to deal with a legal claim. For example, if we work together, I keep the engagement records for the length of the work plus 6 years.

After the retention period. Once data is due for deletion, it is removed or anonymised. After that I can no longer give you a copy, correct it or move it, because it no longer exists in a form that identifies you.

6. EMAIL

Every newsletter and marketing email has a one-click unsubscribe. I keep one shared list of people who have unsubscribed, so if you leave one kind of email you are not sent the other without a fresh choice you make yourself. Automatic confirmation emails and download links are not marketing.

Confirming your address. When you sign up for a newsletter or tick a marketing box, I first send you an email asking you to confirm. You are only added once you do, so nobody can sign you up without you knowing.

Different kinds of email. Newsletters and marketing emails are your choice and you can stop them at any time. Emails that are part of something you asked for, such as a confirmation or a download link, are not marketing. They are sent because you made the request.

A privacy link beside every form. Next to each form on the site that asks for your email address, there is a link to this policy.

7. YOUR RIGHTS

You can ask me to give you a copy of your data, correct it, delete it, restrict or stop how I use it, give it to you in a portable format, stop marketing to you, or withdraw consent at any time. Email privacy@ivankabandize.com. I may ask you to confirm who you are and aim to reply within 30 days, usually sooner. There is no fee unless a request is clearly excessive.

Here is what each right means in practice:

Access. You can ask whether I hold data about you and get a copy of it.

Correction. If something is wrong or out of date, you can ask me to fix it.

Deletion. You can ask me to delete your data. I will, unless I need to keep it for a legal reason, in which case I will tell you.

Restriction. You can ask me to pause how I use your data, for example while we check whether it is accurate.

Objection. Where I use your data because of my legitimate interest, you can object. For marketing you can object at any time without giving a reason.

Portability. You can ask for the data you gave me in a common, machine-readable format so you can take it elsewhere.

Withdrawing consent. Where I rely on your consent, you can withdraw it at any time through a written request..

How to use these rights. Email privacy@ivankabandize.com, preferably from the address you used on the site, and tell me what you would like. It is free. I will confirm who you are first, and aim to reply within 30 days. If I need longer, or cannot do what you ask, I will tell you why.

If you are unhappy, I would like the chance to put it right first. You may also complain to Uganda's Personal Data Protection Office (complaints portal: pdpo.go.ug/file-complaint), or, in the EU or UK, to your local data-protection authority.

8. SECURITY

Traffic to this site is encrypted. Passwords are stored only as salted hashes. Database access is restricted with row-level security and permissions, and administration is limited to me. No system is completely secure. If a breach is likely to put your rights at risk, I will tell you and the relevant authority as the law requires.

What this means in practice.

An encrypted connection. Everything sent between your browser and the site travels over an encrypted connection (the padlock in your browser).

Passwords. I never see or store your actual password. It is turned into a scrambled code (a "salted hash") that cannot be turned back into the password.

Who can see what. The database has rules built in (called row-level security) so that each person can only reach the data they are allowed to see. Members-only articles are not sent in full to people who are not allowed to read them. Only I have administrator access.

9. CHILDREN

This site is for adults. Accounts are for people aged 18 or over. If I learn that a child's data was collected, I will delete it.

If you are a parent or guardian and think a child has given me their details, email privacy@ivankabandize.com and I will delete them.

10. COOKIES, LINKS AND CHANGES

Some features described in this policy roll out after the site launches; I will tell you when each one goes live. Cookies are covered in the Cookie Policy. This site does not respond to "Do Not Track" signals. It uses no advertising trackers and its analytics use no cookies and do not follow you across sites. I am not responsible for the privacy practices of sites I link to. If I change this policy, the date and version at the top change. For material changes I will tell account holders by email or a notice on the site before they take effect.

Logs and maintenance. To keep the site running and secure, the site and the services behind it keep technical logs of requests, which can include IP addresses. Hosting logs are kept for up to 24 hours.

More detail on request. If you want more detail about how I use your data than this policy gives, ask me at privacy@ivankabandize.com and I will tell you what I can.

If a change affects your consent. If I change something you agreed to, I will ask for your agreement again where the law requires it.

11. WORDS USED IN THIS POLICY

Personal data. Any information that identifies you, or could be used to identify you.

Usage data. Information collected automatically when you visit, such as the pages you view, your browser and device type, and your country.

Cookie. A small file a website stores on your device. The Cookie Policy explains the ones this site uses.

Data controller. The person who decides why and how personal data is used. For this site, that is me.

Data processor. A company that handles data on my behalf and on my instructions, such as the host of the site or the service that sends emails.

Consent. Your free, clear choice to let me use your data for a stated purpose. You can withdraw it at any time.

Legal references. This policy is written with Uganda's Data Protection and Privacy Act, 2019 in mind and, for visitors in the EU and UK, the GDPR (General Data Protection Regulation). It applies to this site only.

Questions: privacy@ivankabandize.com