Privacy policy

Who we are

This website belongs to Rwobuyenje Family Resort (the Resort) in Mbarara, Uganda. The Resort decides why and how the personal data collected through this website is used, so under the Data Protection and Privacy Act, 2019 of Uganda it is the data controller.

This policy explains what we collect, why we collect it, who handles it, how long we keep it and the rights you have. To contact us about this policy or about your personal data, please use the contact page.

What we collect

When you send a booking, event or contact form, we collect what you type: your name, your email address, an optional phone number, your dates and number of guests, details about your event and any message or notes you add. If you join our updates, we collect your email address.

When you visit the website, our hosting and analytics providers receive technical information from your device, such as your network address, browser type, the pages you view and your approximate location.

If you choose to message us on WhatsApp, the Resort sees your phone number and the messages you send. WhatsApp handles them under its own terms.

The website does not ask for any banking or money details, and it does not create accounts. Please do not put sensitive details, such as health information, in your messages unless we have asked for them.

How we use it

We use your details to reply to your enquiry, to plan and confirm your stay or event, to keep a record of what we agreed, and to send you updates if you asked for them. We use technical information to keep the website secure, to stop spam and to see how the website is used so we can improve it.

We process your details with your consent, which you give when you send a form or subscribe, and where it is needed to deal with the request you made. We do not sell your details, we do not use them for unrelated marketing, and we do not make automated decisions about you.

Who handles it

When you send a form, the website delivers it to the Resort team by email through Resend, our email delivery provider. The website is hosted on Vercel, photos are delivered by Cloudinary, and visits are measured with Google Analytics.

We may also share your details when the law requires it, for example if a court or a public authority in Uganda lawfully asks for them. We do not share them with anyone else.

Sending data outside Uganda

The providers named above may store or process data on servers outside Uganda. We share only what is needed to deliver your message and run the website. By sending a form or subscribing, you agree to your details being handled in this way.

Cookies, analytics and maps

This website sets no cookies of its own. It uses Google Analytics to see how the site is used. Google Analytics sets cookies and sends Google information about how you use the site, such as the pages you view and your approximate location.

You can stop this by blocking cookies or analytics in your browser settings, or with a tracking blocker. The site works the same either way, and Google's own privacy policy applies to the data it collects.

The contact page shows a map from Google Maps. When you open that page, your browser contacts Google to load the map, and Google's own privacy policy applies to it.

How long we keep it

We keep your details only for as long as we need them to deal with your enquiry, to keep a record of your stay or event and to meet our legal duties. After that we delete them or make them anonymous. If you subscribe to updates, we keep your email address until you ask us to stop.

Keeping it safe

Forms are sent over an encrypted connection, and we limit access to your details to the people at the Resort who need them to reply. To limit spam, the website briefly keeps your network address in memory to count how many forms come from it. This is not stored permanently.

No method of sending data over the internet is completely secure, so we cannot promise absolute security.

Children

This website is meant for adults. If you are under 18, please ask a parent or guardian to send forms for you. We do not knowingly collect the personal data of a child without the consent of a parent or guardian. If you think a child has sent us details, tell us and we will delete them.

Your choices and rights

Under the Data Protection and Privacy Act, 2019 you can ask us what personal data we hold about you, ask us to correct it, ask us to delete it, object to how we use it and withdraw your consent. You can also ask us to stop sending you updates at any time. Please use the contact page to make a request. We may ask you to confirm who you are before we act on it.

If you are not satisfied with how we handle your data, you can complain to the Personal Data Protection Office, which is part of the National Information Technology Authority, Uganda (NITA-U).

Changes to this policy

We may update this policy, for example if we change the services the website uses. The version on this page is the current one, and the date at the top shows when it was last updated.