Privacy Policy

Last updated: 24 July 2026

1. Introduction

Startup Uganda ("Startup Uganda", "we", "us", or "our") is committed to protecting the privacy and personal data of everyone who interacts with us, including visitors to our website, registered members, ESO representatives, mentors, investors, job applicants, and newsletter subscribers.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have over it. It is written to comply with Uganda's Data Protection and Privacy Act, 2019 ("the Act") and the Data Protection and Privacy Regulations, 2021, which are enforced by the Personal Data Protection Office (PDPO) at the National Information Technology Authority-Uganda (NITA-U).

By using our website (startup.ug) or otherwise providing us with your personal data, you acknowledge the practices described in this policy.

2. Who we are

Startup Uganda is the national association of Innovation and Entrepreneurship Support Organisations (ESOs), operating a Secretariat based in Kampala, Uganda. For the purposes of the Act, Startup Uganda is the data collector and data controller responsible for the personal data described in this policy.

You can reach us using the details in the Contact us section below.

3. Information we collect

The personal data we collect depends on how you interact with us. This may include:

Account and profile information

• Full name, email address, and password (for members who register directly).
• Profile information supplied through Google, Facebook, or LinkedIn sign-in, such as your name, email address, and profile photo, where you choose to use one of these options.
• Your role in the ecosystem (e.g. ESO, startup founder, mentor, investor, government agency, corporate partner).

Membership and organisation information

• Organisation name, registration/incorporation details, physical address, sector and focus area, logo, and description, submitted as part of an ESO, startup, investor, or mentor application or profile.
• Supporting documents you upload, such as certificates of incorporation, pitch decks, or reports.

Communications

• Messages you send us directly, through the in-platform chat between members, or via email.
• Your email address if you subscribe to the Startup Uganda In Motion newsletter.

Technical and usage information

• IP address, browser type, device information, and pages visited, collected automatically when you use our website.
• Location information if you use address look-up (e.g. when registering an organisation) via Google Maps.

4. How we collect information

We collect personal data:

• Directly from you, when you register an account, apply for membership, complete a profile, upload a document, subscribe to our newsletter, or contact us.
• Automatically, through cookies and similar technologies when you browse our website (see Cookies).
• From third parties, such as Google, Facebook, or LinkedIn, when you choose to sign in using one of those services, subject to their own privacy policies and the permissions you grant them.

5. Our legal basis for processing

In line with the data protection principles set out in the Act, we only collect and process personal data that is adequate, relevant, and necessary for the purpose for which it is collected. We process your personal data on one or more of the following bases:

• Your consent — for example, when you create an account, apply for membership, or subscribe to our newsletter.
• Performance of a contract or membership relationship — to provide membership services, maintain your organisation's directory listing, and administer the Experts Portal.
• Our legitimate interests — such as keeping our website secure, understanding how it is used, and improving our services, provided this does not override your rights.
• Legal obligation — where we are required to disclose information to a competent authority under Ugandan law.

6. How we use your information

We use personal data to:

• Create and administer member accounts and organisation profiles.
• Review and verify membership, mentor, and investor applications.
• Operate the public directories of ESOs, startups, investors, mentors, and job/programme listings.
• Facilitate communication between members, including the messaging feature.
• Send the Startup Uganda In Motion newsletter and other communications you have opted into.
• Respond to enquiries sent to us directly.
• Maintain the security, integrity, and performance of our website.
• Meet reporting requirements to our funding partners (Enabel, the European Union, and Belgium) in a manner that does not identify individuals unless required and consented to.
• Comply with our legal and regulatory obligations in Uganda.

We do not sell your personal data to any third party.

7. Sharing and disclosure

We may share personal data with:

• Service providers who process data on our behalf strictly to help us run our website and communications, including hosting providers, Google (Maps and sign-in), Meta (Facebook sign-in), LinkedIn (sign-in), Mailchimp and Mailgun (email delivery), and analytics providers.
• Other members, where information forms part of a public directory listing (such as an ESO or startup profile) or where you initiate direct contact with another member through our platform.
• Our funding and programme partners, in aggregated or anonymised form, for reporting on the impact of the WeWork: Green and Decent Jobs for Youth programme, unless you have separately consented to identifiable reporting.
• Regulators or public authorities, including NITA-U, where we are legally required to do so.

Any third party that processes personal data on our behalf is required to protect it in a manner consistent with this policy and the Act.

8. International data transfers

Some of the service providers we rely on (such as Google, Meta, LinkedIn, Mailchimp, and Mailgun) may process personal data on servers located outside Uganda. Where we transfer personal data outside Uganda, we take reasonable steps to ensure it continues to receive an adequate level of protection, consistent with the requirements of the Act, and we only work with providers that maintain appropriate technical and organisational safeguards.

9. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including satisfying any legal, accounting, or reporting obligations. Membership and profile information is generally retained for the duration of your membership and for a reasonable period afterward, in case you re-apply or for legitimate record-keeping purposes. You may request earlier deletion at any time, as described under Your rights.

10. Data security

We apply reasonable technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including access controls, encrypted password storage, and secure hosting. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to keep your data appropriately protected and to respond promptly to any suspected data breach in line with our obligations under the Act.

11. Your rights

Under the Data Protection and Privacy Act, 2019, you have the right to:

• Be informed of how your personal data is collected and used, as set out in this policy.
• Access the personal data we hold about you.
• Request correction of personal data that is inaccurate or incomplete.
• Request deletion of personal data that we no longer have a valid reason to hold.
• Object to or restrict processing that is likely to cause you unwarranted damage or distress.
• Withdraw consent at any time, where processing is based on consent (for example, unsubscribing from our newsletter), without affecting the lawfulness of processing carried out before withdrawal.
• Lodge a complaint with the Personal Data Protection Office at NITA-U if you believe we have not handled your personal data in accordance with the Act.

To exercise any of these rights, contact us using the details in the Contact us section. We will respond within a reasonable time and in line with the timeframes required by the Act.

12. Cookies and similar technologies

Our website uses cookies and similar technologies to keep you signed in, remember your preferences, and understand how our website is used so we can improve it. You can control or disable cookies through your browser settings; please note that some parts of our website may not function properly if you disable cookies.

13. Children's privacy

Our website and membership services are intended for organisations and individuals operating in Uganda's innovation and entrepreneurship sector and are not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

14. Third-party links

Our website may contain links to third-party websites, including member organisations, partners, and social media platforms. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing them with personal data.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will update the "Last updated" date at the top of this page when we do. We encourage you to review this page periodically.

16. Contact us

If you have questions about this Privacy Policy, want to exercise any of your rights, or want to raise a concern about how we handle your personal data, please contact us at:

Startup Uganda Secretariat
Kampala, Uganda
Email: communications@startup.ug