Privacy Policy

This site is published by Manuela P. Mulondo, based in Kampala, Uganda. Where this policy says we, us or our, it means Manuela and the small team who run the site on her behalf.

It covers manuelapmulondo.com and everything you can do on it: reading, creating an account, buying books, courses, products and downloads from The Academy, booking tickets for The Gatherings and the Annual Personal Planning Getaway, answering a survey, and sending an enquiry through the Work with Me pages.

We handle personal data in line with the Data Protection and Privacy Act, 2019 of Uganda.

You give us information when you check out, create an account, or write to us. Depending on what you are doing, that is:

• Your name, email address and phone number, taken at checkout so we can send your receipt, your download or your ticket.
• Your account password, stored only as a one-way hash. Nobody on our side can read it.
• Your billing country, which the payment gateway needs in order to process the transaction.
• Whatever you choose to write in an enquiry, a booking request or a survey response.
• The details of people you are booking for, when you buy separate tickets for a group.

You do not need an account to browse the site or to read anything on it.

• Standard server records: the pages you request, the date and time, your IP address, your browser and device type, and the site that referred you.
• Download records: each time you open a file from your library we log the file, the time, your IP address and your browser. This is how the download allowance on a purchase is enforced and how we notice an account being shared.
• Ticket records: when a ticket is checked at an event we log the time and who checked it.
• Measurement from analytics and advertising tools, described in PP-08.

Payments are processed by Pesapal, a licensed payment service provider. Your card number, your mobile money PIN and any one-time code are entered on Pesapal's own secure page. They do not pass through this site and we never see or store them.

What we do keep against your order is:

• The amount, the currency and the item you paid for.
• The payment method you chose, for example a card or a mobile money network.
• A masked reference for the account used and the confirmation code the gateway returns.
• The merchant reference, the order tracking id and the status of the transaction.

We keep these so we can confirm your payment, issue a receipt, restore your access when something goes wrong, and meet our accounting obligations.

• To take and fulfil your order and to send you a receipt.
• To grant and maintain access to what you bought: your library, your course, your downloads.
• To issue, deliver and verify tickets, and to run entry on the day.
• To reach you about something you hold, such as a change of venue, a rescheduled session or a joining link.
• To answer enquiries and booking requests.
• To keep the site secure, prevent fraud and abuse of download allowances, and resolve disputes.
• To understand, in aggregate, which parts of the site are useful.
• To meet legal, tax and accounting requirements.

We do not sell your personal data. We have not done so and we do not intend to.

There are two kinds, and they behave differently.

• Transactional email, sent because of something you did: receipts, download links, tickets, password resets and notices about an event you booked. You cannot unsubscribe from these while you hold an active order or ticket, because they carry information you need.
• Optional email, such as invitations, teaching and announcements. These go only to people who asked for them and every one carries an unsubscribe link. Unsubscribing takes effect immediately and does not touch anything you have already bought.

We record whether a message was delivered and whether it was opened, so that we can tell when a receipt or a ticket has failed to reach someone and resend it.

We share the minimum needed to run the service, with:

• Pesapal, to process payments and confirm their status.
• Our email provider, to deliver the messages described in PP-06.
• Cloudinary, which hosts the images, video and files this site serves.
• Google Analytics and the Meta pixel, as set out in PP-08.
• Event partners, venues and stewards, where a name or a ticket code is needed to admit you to an event you booked.
• Professional advisers and the authorities, where the law requires it or where we need to establish or defend a legal claim.

Everyone we work with is bound to use your information only for the task we gave them.

The site sets a small number of cookies:

• A session cookie, which keeps you signed in and holds your basket while you check out. Checkout and sign in do not work without it.
• Google Analytics, which tells us in aggregate how the site is used and which pages are worth keeping.
• The Meta pixel, which measures whether an advert led to a purchase.

If you install this site to your home screen, your browser also stores files locally so that pages open quickly and work offline. Clearing your browser data removes them.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics using Google's browser add-on. Blocking the session cookie will stop you from signing in or checking out.

• Account details: while your account is open, and for one year after you close it.
• Orders, payment records and receipts: seven years, which is what tax and accounting rules require.
• Entitlements and download logs: while the entitlement is active, and 24 months after it ends.
• Ticket records: through the event and for 12 months afterwards, for reconciliation and disputes.
• Enquiries and booking correspondence: 24 months from the last message.
• Survey responses: identifying details are removed once the survey closes and only the aggregate is kept.
• Marketing contacts: until you unsubscribe.

When a period ends we either delete the record or strip out everything that identifies you.

Passwords are stored as one-way hashes, never as readable text. The site is served over HTTPS. Password reset links are single use and expire. Every ticket carries a unique code and a separate verification token, so a ticket cannot be guessed or forged. Administrative access is limited to named people and granted by role.

No system is perfectly secure. If a breach affects your personal data we will tell you and the relevant authority without undue delay, and we will tell you what to do about it.

You may ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything that is wrong or out of date.
• Delete your data, where we are not required to keep it under PP-09.
• Stop using your data for a particular purpose, or withdraw a consent you gave.
• Send your data to you or to another provider in a portable format.

Write to info@manuelapmulondo.com. We acknowledge every request and respond within 30 days. We may need to confirm your identity first, so that nobody else can make a request in your name.

If you are not satisfied with how we handled your request, you may complain to the Personal Data Protection Office of Uganda.

This site is written for adults. You must be 18 or older to create an account or buy anything here. Young people are welcome at our events when they come with a parent or guardian, who makes the booking and holds the ticket.

If we learn that we hold personal data belonging to a child, we delete it.

When we change this policy we update the version and the effective date in the record at the top of this page. Where a change materially affects how we use your data we will say so on the site and, where we are able to, tell you by email.

Continuing to use the site after a change means you accept the version then in force.

A question about your data, a request under PP-11, or a concern about how we have handled something goes to info@manuelapmulondo.com and reaches a person, not a queue.

Manuela P. Mulondo, Kampala, Uganda.