Policy Statement: Protecting Personal Data and Respecting Privacy
Review Frequency: At least every 2-3 years, or earlier where necessary.

1. INTRODUCTION

 Treescape Planet Organization (TPO) is an environmental conservation and community development organization committed to promoting sustainable development through afforestation, agroforestry, reforestation, environmental education, ecotourism, sports sustainability, climate resilience, and community engagement.

In delivering our work, TPO collects and processes personal information relating to employees, board members, volunteers, interns, programme participants, schoolchildren, parents and guardians, community members, donors, partners, suppliers, visitors, and other individuals who interact with the organization.

TPO recognizes that personal data is valuable and that its collection, use, storage, sharing, and disposal must be handled responsibly. We are committed to protecting the privacy, dignity, and rights of individuals whose information we process.

TPO is registered with Uganda’s Personal Data Protection Office (PDPO) and is committed to fulfilling its applicable obligations under the Data Protection and Privacy Act, Cap. 97, and the Data Protection and Privacy Regulations, 2021, as amended or replaced where applicable.

This policy establishes the principles, responsibilities, and procedures that guide TPO in collecting, processing, storing, sharing, protecting, retaining, and disposing of personal data.

2. PURPOSE OF THE POLICY

The purpose of this policy is to ensure that personal data handled by TPO is processed lawfully, fairly, transparently, securely, and responsibly.

Specifically, the policy aims to:

1. Protect the privacy and rights of individuals whose personal information is collected or processed by TPO.
2. Establish clear standards for collecting, using, storing, sharing, retaining, and disposing of personal data.
3. Promote compliance with applicable Ugandan data protection and privacy legislation.
4. Define the responsibilities of TPO management, staff, volunteers, interns, partners, and third-party service providers.
5. Establish procedures for responding to requests from individuals concerning their personal data.
6. Prevent unauthorized access, disclosure, loss, alteration, misuse, or destruction of personal information.
7. Establish procedures for identifying, reporting, managing, and responding to personal data breaches.
8. Promote responsible data handling in environmental programmes, school activities, community projects, fundraising, communications, and partnerships.

 

3. SCOPE OF THE POLICY

This policy applies to all personal data collected, received, generated, stored, accessed, used, or otherwise processed by TPO in the course of its activities.

It applies to:

1. Board members and organizational leadership.
2. Employees and programme staff.
3. Interns and volunteers.
4. Consultants, contractors, and service providers.
5. Donors, sponsors, partners, and suppliers, where their personal data is processed by TPO.
6. Schools, community groups, programme participants, and other individuals engaging with TPO.

Any person or organization processing personal data on behalf of TPO under an applicable arrangement.

The policy applies to personal data held in physical or electronic formats, including paper records, databases, spreadsheets, email accounts, cloud storage, mobile devices, photographs, videos, audio recordings, online forms, and messaging platforms used for organizational purposes.

It also applies to personal information collected through TPO’s website, social media channels, programme registration forms, internship and volunteer applications, event attendance lists, project monitoring activities, surveys, donor communications, and partnership engagements.

Where TPO works with children, additional safeguards under its Child Safeguarding Policy and other relevant procedures must be applied.

4. LEGAL AND REGULATORY FRAMEWORK

TPO will implement this policy in accordance with applicable legal and regulatory requirements, including:

97. The Data Protection and Privacy Act, Cap. 97.
98. The Data Protection and Privacy Regulations, 2021.

• Applicable requirements and guidance issued by the Personal Data Protection Office.

1. Relevant child protection and safeguarding laws and requirements.

Other applicable laws governing confidentiality, employment, contracts, records, and the lawful processing of personal information.

This policy should be interpreted consistently with applicable law. Where a legal requirement imposes a higher standard of protection or a specific obligation, the legal requirement will prevail.

5. KEY DEFINITIONS

Personal data: Information relating to an identified or identifiable individual, such as a name, telephone number, email address, photograph, identification number, location information, or other information that can identify a person directly or indirectly.

Sensitive personal data: Personal information that receives additional protection under applicable law, which may include information concerning health, finances, family circumstances, religious beliefs, or other protected categories, depending on the information and applicable legal definition.

Data subject: The individual to whom personal data relates.

Data collector: A person or organization that collects personal data.

Data controller: A person or organization that determines the purposes and means of processing personal data.

Data processor: A person or organization that processes personal data on behalf of a data controller.

Processing: Any operation performed on personal data, including collection, recording, organization, storage, retrieval, use, disclosure, transfer, correction, restriction, or deletion.

Consent: A freely given, specific, informed indication of agreement to the processing of personal data, where consent is the appropriate legal basis for that processing.

Personal data breach: A security incident involving unauthorized access to, acquisition, disclosure, loss, alteration, destruction, or other compromise of personal data.

Data Protection Officer or designated privacy contact: The person appointed or designated by TPO to coordinate data protection compliance, receive privacy requests and concerns, and support the implementation of this policy.

Third party: An individual or organization other than the data subject, TPO, or a person authorized to process personal data on TPO’s behalf.

Data retention: The period during which personal data is kept for a legitimate, authorized, or legally required purpose.

 

6. DATA PROTECTION PRINCIPLES

TPO will handle personal data in accordance with the principles set out in Section 3 of the Data Protection and Privacy Act, Cap. 97.

6.1 Accountability

TPO will take responsibility for personal data under its control and establish appropriate measures to demonstrate compliance with this policy and applicable law.

6.2 Lawful and Fair Processing

Personal data will be collected and processed fairly and lawfully, with appropriate notice to individuals and a valid legal basis for the intended processing.

6.3 Data Minimization

TPO will collect only personal data that is adequate, relevant, and necessary for the purpose for which it is required. Information will not be collected merely because it may be useful in the future.

6.4 Purpose Limitation

Personal data will be collected for specified, legitimate purposes and will not be used for incompatible purposes without an appropriate legal basis and any required notice or consent.

6.5 Accuracy and Quality

TPO will take reasonable steps to ensure that personal data is accurate, complete, relevant, and kept up to date where necessary.

6.6 Retention Limitation

Personal data will not be retained indefinitely without justification. It will be kept only for as long as necessary for its stated purpose, applicable legal requirements, contractual obligations, accountability, or other lawful reasons.

6.7 Transparency and Participation

TPO will explain, where appropriate, what information it collects, why it collects it, how it uses it, and how individuals can exercise their rights.

6.8 Security and Confidentiality

TPO will implement appropriate technical and organizational safeguards to protect personal data against unauthorized access, disclosure, loss, alteration, misuse, or destruction.

 

7. PERSONAL DATA COLLECTED AND PROCESSED BY TPO

Depending on the nature of an activity or relationship, TPO may collect and process the following categories of information.

7.1 Identification and Contact Information

1. Names and contact details.
2. Email addresses and telephone numbers.
3. Relevant identification details where necessary and lawful.
4. Emergency contact information.
5. Organizational affiliations and professional contact details.

7.2 Employment, Internship and Volunteer Information

1. Curriculum vitae and application forms.
2. Education, qualifications, skills, and work experience.

• References and relevant recruitment information.

1. Internship or volunteer agreements.
2. Attendance, assignments, performance, and programme records.
3. Payment, reimbursement, and administrative information.

7.3 Programme and Community Information

1. Registration and attendance records.
2. Participation in tree planting, environmental education, community development, and other activities.
3. Training and monitoring records.
4. Feedback, surveys, and evaluation responses.
5. Information reasonably necessary to assess programme participation and impact.

7.4 Children’s Personal Data

Where TPO works with schools and children, it may process limited information such as names, ages, school or group affiliation, attendance, participation records, emergency contacts, and photographs or videos where appropriately authorized.

TPO will apply additional safeguards to children’s information, seek appropriate permissions, and limit access to authorized individuals.  Sensitive information about a child will only be collected where necessary, lawful, and subject to appropriate protection.

7.5 Donor, Partner and Financial Information

1. Names and professional contact details of donors, sponsors, partners, and representatives.
2. Donation, sponsorship, grant, and transaction records.
3. Invoices, receipts, payment confirmations, and reimbursement records.
4. Contractual and partnership documentation.

Where bank or mobile money details are necessary, TPO will restrict access to authorized personnel and use them only for legitimate administrative or financial purposes.

7.6 Photographs, Videos and Audio Recordings

TPO may collect photographs, videos, and audio recordings to document activities, monitor project progress, prepare reports, communicate with stakeholders, and raise awareness of its work.

Where individuals are identifiable, TPO will consider the purpose of the recording, applicable legal requirements, consent or other lawful basis, privacy risks, and any additional safeguarding measures required.

Photographs or recordings of children will be handled in accordance with TPO’s Child Safeguarding Policy and relevant media consent procedures.

7.7 Website and Digital Information

When individuals contact TPO or interact with its digital platforms, information may include names, email addresses, messages, submitted forms, and technical information collected by the relevant website or service.

Any cookies, analytics tools, mailing list platforms, or other tracking technologies will be managed in accordance with applicable requirements and the relevant platform’s privacy settings and disclosures.

TPO will not claim to collect specific technical information unless the relevant systems actually collect it.

7.8 Sensitive Personal Data

TPO will avoid collecting sensitive personal data unless it is necessary for a legitimate organizational purpose and can be processed lawfully with appropriate safeguards.

Access to such information will be restricted, and additional security measures will be applied according to the level of risk.

 

8. PURPOSES AND LEGAL BASIS FOR PROCESSING

TPO may process personal data for the following purposes:

1. Administering environmental conservation and community development programmes.
2. Organizing school visits, workshops, training, tree-planting activities, and field events.

• Managing employment, internship, and volunteer arrangements.

1. Communicating with programme participants, donors, sponsors, partners, and suppliers.
2. Administering grants, donations, payments, financial records, and reporting obligations.
3. Monitoring, evaluating, and reporting programme outputs and impact.

• Meeting legal, regulatory, contractual, safeguarding, and accountability requirements.
• Managing website enquiries, newsletters, and communications.

1. Documenting activities through photographs, videos, and reports.
2. Protecting the safety of participants and responding to incidents or complaints.

TPO will identify an appropriate legal basis for each relevant processing activity under applicable law. Depending on the circumstances, this may include consent, a legal obligation, contractual necessity, or another legally recognized basis.

Consent will not be treated as a universal basis for every processing activity. Where TPO relies on consent, the individual will be informed of the purpose and will be able to withdraw consent where applicable, subject to legal requirements and any consequences explained at the time consent is obtained.

 

9. RIGHTS OF DATA SUBJECTS

Subject to applicable law and any relevant legal limitations, individuals may have the right to:

1. Access personal information: Request confirmation of whether TPO holds their personal data and seek access to information that the law permits them to receive.
2. Receive information about processing: Understand the purposes for which their data is collected and the relevant recipients or categories of recipients
3. Correct inaccurate information: Request correction or completion of inaccurate or incomplete personal data.
4. Request blocking, erasure or destruction: Request appropriate action regarding personal data where the legal requirements for doing so are met.
5. Object to certain processing: Request that processing be stopped where the applicable legal grounds for objection are satisfied.
6. Prevent certain harmful processing: Exercise the rights available under applicable law where processing causes or is likely to cause unwarranted substantial damage or distress.
7. Object to direct marketing: Exercise applicable rights relating to the use of personal data for direct marketing.
8. Exercise rights concerning automated decisions: Use any rights available under applicable law where decisions are made through automated processing.
9. Withdraw consent: Where processing relies on consent, withdraw that consent for future processing, subject to applicable law.
10. Raise a complaint: Contact TPO about a privacy concern or submit a complaint to the PDPO in accordance with the law.

These rights are subject to applicable legal conditions and exceptions. For example, TPO may need to retain certain records to meet legal obligations or protect legitimate legal interests, even where an individual requests deletion.

 

10. PROCEDURE FOR EXERCISING DATA SUBJECT RIGHTS

Individuals who wish to exercise their privacy rights or raise a concern about personal data held by TPO should contact the designated privacy contact using the contact details provided in this policy.

A request should, where possible, include:

1. The individual’s name and preferred contact details.
2. A description of the request or concern.
3. Sufficient information to help TPO identify the relevant records.
4. Reasonable evidence of identity where necessary to prevent unauthorized disclosure.

TPO will:

1. Acknowledge and record the request.
2. Verify the identity and authority of the requester where reasonably necessary.
3. Assess the request under applicable law.
4. Consult relevant personnel or service providers where necessary.
5. Respond within the applicable legal timeframe.
6. Explain any lawful limitation or reason for refusing all or part of a request.
7. Maintain an appropriate record of the request and response.

Where a request concerns a child, TPO will take appropriate steps to verify the authority of the parent, guardian, or other representative and consider the child’s best interests and applicable legal requirements.

TPO will not disclose one person’s personal data to another person merely because a request has been made. Any disclosure must be lawful and appropriately verified.

Privacy Complaints

Individuals may submit privacy complaints to TPO through the designated privacy contact. TPO will assess the complaint, take appropriate steps to investigate or resolve it, and communicate the outcome where reasonably possible.

If an individual is dissatisfied with TPO’s response, they may seek guidance from or lodge a complaint with the Personal Data Protection Office through its official channels.

 

     11. DATA SECURITY MEASURES

TPO will implement reasonable technical, organizational, and physical safeguards proportionate to the nature of the data, the risks involved, and its operational capacity.

These measures may include:

1. Password protection and access controls for devices, accounts, and digital files.
2. Restricting access to personal data to authorized individuals who need it for their responsibilities.
3. Secure storage of paper records in controlled locations.
4. Secure sharing of files and sensitive information.
5. Appropriate device security, software updates, and malware protection.
6. Staff, intern, and volunteer awareness of privacy and confidentiality responsibilities.
7. Secure handling of personal data when working remotely or conducting field activities.
8. Periodic review of access permissions and storage arrangements.
9. Appropriate contractual safeguards for third-party service providers.
10. Secure backup and recovery arrangements where feasible and appropriate.

Personal data must not be stored on public or shared devices, personal accounts, or unsecured platforms without authorization and suitable safeguards.

Individuals handling TPO data must not share passwords, leave sensitive records unattended, or transmit personal information through unauthorized channels.

12. PERSONAL DATA BREACH MANAGEMENT

A personal data breach may include a lost device containing personal information, a misdirected email, unauthorized access to records, stolen documents, accidental publication of private information, compromised accounts, or unauthorized disclosure of children’s information.

12.1 Reporting a Breach Internally

Anyone who becomes aware of a suspected or actual personal data breach involving TPO must report it immediately to the designated privacy contact or another appropriate member of management.

Reports should include the known facts, the information affected, the likely individuals impacted, and any immediate action already taken.

Staff and other representatives must not conceal incidents or attempt to resolve serious breaches without notifying the appropriate person.

12.2 Response and Containment

TPO will seek to:

1. Record the incident and establish what happened.
2. Take immediate steps to contain the breach and prevent further unauthorized access or disclosure.
3. Assess the type and volume of information involved and the individuals potentially affected.
4. Evaluate risks to individuals, particularly children and people whose sensitive information may have been exposed.
5. Preserve relevant evidence and records.
6. Consult the appropriate technical, legal, or safeguarding professionals where necessary.
7. Notify the PDPO immediately in accordance with applicable legal requirements and the prescribed procedure.
8. Follow the PDPO’s directions regarding remedial action and notification to affected individuals.
9. Document the incident, actions taken, and measures introduced to reduce the risk of recurrence.

12.3 Notification and Follow-Up

TPO will follow the applicable statutory requirements governing notification of personal data breaches. Where the PDPO directs TPO to notify affected individuals or the public, TPO will do so in the manner required and provide sufficient information to help affected individuals understand the incident and take appropriate protective action.

TPO will review significant breaches to identify their causes and improve its systems, procedures, training, and safeguards.

 

13. DATA SHARING AND THIRD-PARTY PROCESSING

TPO may share personal data with third parties where necessary for a legitimate purpose and where the sharing is lawful and appropriately safeguarded.

Potential recipients may include:

1. Schools and community institutions involved in programme delivery.
2. Donors, sponsors, and funding partners requiring legitimate programme reports.
3. Auditors, accountants, legal advisers, and professional consultants.
4. Banks and payment service providers.
5. Website hosting, email, cloud storage, mailing list, and other technology service providers.
6. Relevant government authorities, regulators, law enforcement agencies, or child protection services where legally required or otherwise lawfully justified.

 

TPO will not sell personal data as a source of revenue.

Before sharing information, TPO will consider the purpose, necessity, scope, recipient, confidentiality requirements, and risks of disclosure. Only information reasonably necessary for the stated purpose should be shared.

Where a third party processes personal data on behalf of TPO, TPO will seek appropriate contractual or other documented safeguards addressing permitted use, confidentiality, security, incident reporting, retention, deletion, and any further processing or disclosure.

TPO will not authorize third parties to use personal data for unrelated purposes without an appropriate legal basis.

13.1 International Transfers

Where personal data is transferred outside Uganda, including through international cloud platforms or service providers, TPO will assess the transfer and comply with applicable legal requirements and safeguards.

TPO will consider the nature of the information, the destination, the purpose of the transfer, the recipient’s security arrangements, and any applicable restrictions or conditions.

 

14. DATA RETENTION

 TPO will retain personal data only for as long as reasonably necessary for the purpose for which it was collected, or for a longer period where required or permitted by applicable law.

Retention periods will take account of legal and regulatory requirements, contracts, donor obligations, financial accountability, programme monitoring, safeguarding, and legitimate organizational needs.

The following are proposed retention guidelines. They must be reconciled with applicable legal requirements and TPO’s actual recordkeeping obligations before adoption.

Record category	Proposed retention approach
General website enquiries	Until the enquiry is resolved and for a reasonable period afterward, unless further retention is justified
Newsletter and mailing list records	Until the person unsubscribes or the data is no longer required, with minimal suppression records retained where appropriate
Employment, internship and volunteer records	For the period required for programme administration, legal obligations, and legitimate accountability purposes
Financial and donor records	For the applicable statutory, tax, audit, grant, and financial accountability period
Programme attendance and monitoring records	For the period required for project reporting, evaluation, contractual obligations, and legitimate accountability
Children’s participation and consent records	For the period necessary to administer the activity, demonstrate permissions, meet legal obligations, and manage safeguarding risks
Photographs and videos	For as long as there is a legitimate, authorized purpose, subject to consent, safeguarding, privacy, and any applicable restrictions
Safeguarding and incident records	In accordance with applicable law, safeguarding requirements, and a restricted-access retention schedule
Recruitment records for unsuccessful applicants	For a defined period justified by recruitment, legal, and accountability requirements

TPO will establish or maintain a more detailed internal retention schedule where necessary, specifying retention periods, responsible personnel, storage locations, and disposal procedures.

15. DISPOSAL AND DELETION OF PERSONAL DATA

When personal data is no longer required and there is no lawful reason to retain it, TPO will take reasonable steps to securely delete, destroy, or anonymize it.

Depending on the format, disposal may include:

1. Securely shredding or destroying paper documents.
2. Permanently deleting electronic files where feasible.
3. Removing unnecessary copies from authorized storage locations.
4. Securely wiping or disposing of storage devices.
5. Requesting deletion or return of information from service providers where contractually and legally appropriate.
6. Anonymizing information where it is still useful for legitimate statistical or reporting purposes and individuals can no longer reasonably be identified.
7.  

Disposal must not be carried out in a manner that breaches a legal preservation obligation, compromises an ongoing investigation, or destroys records that must lawfully be retained.

 

16. ROLES AND RESPONSIBILITIES

16.1 Board of Directors

The Board is responsible for approving this policy, providing oversight of TPO’s data protection commitments, and ensuring that appropriate accountability arrangements are maintained.

16.2 Management

TPO management is responsible for implementing the policy, allocating appropriate resources, ensuring that personnel understand their responsibilities, and responding to significant privacy risks or incidents.

16.3 Designated Data Protection Contact

The designated privacy contact is responsible for coordinating privacy requests and complaints, supporting compliance activities, maintaining relevant records, coordinating breach responses, and advising management on data protection risks.

This role should be formally assigned by TPO management, with appropriate access to the information and personnel required to perform its duties.

16.4 Employees, Interns and Volunteers

All personnel must:

1. Handle personal data only for authorized purposes.
2. Maintain confidentiality and follow access controls.
3. Protect devices, documents, and accounts containing personal information.
4. Follow this policy and relevant training.
5. Report suspected breaches or inappropriate disclosures immediately.
6. Avoid sharing personal information through unauthorized channels.
7. Follow the Child Safeguarding Policy when handling children’s information.

16.5 Partners and Service Providers

Partners and service providers who receive or process TPO personal data must comply with the relevant contractual requirements and applicable law. TPO will seek appropriate safeguards before granting access to personal information.

 

17. DATA PROTECTION REGISTRATION AND COMPLIANCE

TPO maintains a registration certificate issued by the Personal Data Protection Office. TPO will maintain appropriate records of its registration status and take steps to ensure that its registration details remain accurate and current.

Management will monitor the certificate’s expiry date and ensure that a renewal application is submitted at least three months before expiry, in accordance with Regulation 23(2) of the Data Protection and Privacy Regulations, 2021.

TPO will also review whether changes to its activities, data processing purposes, systems, or organizational details require updates to its registration particulars or other compliance actions.

The registration certificate does not remove TPO’s responsibility to protect personal data or comply with applicable legal requirements.

 

18. TRAINING AND AWARENESS

TPO will communicate this policy to relevant staff, interns, volunteers, and other representatives who handle personal data.

Training and awareness activities may cover:

1. Responsible collection and use of personal information.
2. Confidentiality and secure recordkeeping.
3. Handling personal data involving children.
4. Appropriate use of photographs, videos, and social media.
5. Responding to data subject requests.
6. Recognizing and reporting personal data breaches.
7. Secure use of email, mobile devices, and digital storage.

Additional guidance will be provided where the nature of a role or activity creates increased privacy risks.

 

19. POLICY VIOLATIONS

Failure to comply with this policy may result in appropriate corrective or disciplinary action, including restriction of access to personal data, additional training, suspension of responsibilities, termination of employment or engagement, or referral to relevant authorities where warranted.

Any action will be proportionate to the circumstances and consistent with applicable law and relevant contractual or organizational procedures.

TPO will seek to address identified weaknesses promptly and take reasonable steps to prevent recurrence.

 

20. POLICY REVIEW AND AMENDMENT

This policy will be reviewed at least every two years, or earlier where necessary due to changes in applicable legislation, PDPO guidance, organizational activities, technology, identified risks, or a significant data breach.

Proposed amendments will be reviewed by TPO management and submitted to the Board of Directors for approval where required under the organization’s governance arrangements.

The latest approved version will be made available through TPO’s official communication channels.

 

21. CONTACT AND PRIVACY REQUESTS

Individuals who have questions about this policy, wish to exercise their data protection rights, or want to raise a privacy concern may contact TPO using the details below.

Treescape Planet Organization (TPO)

Website: https://treescapeplanet.org/
General email: letstalk@treescapeplanet.org

Designated Data Protection Contact: To be formally confirmed by TPO.
Dedicated privacy email: To be established or confirmed before publication.

Individuals may also contact the Personal Data Protection Office through its official website: https://pdpo.go.ug/