This Privacy Policy explains how the Institute of Forensics & ICT Security ("IFIS", "we", "us" or "our") collects, uses, shares, stores and protects personal data when you visit forensicsinstitute.org (the "Site"), create an account, take a course, register for an event, apply for membership, subscribe to our newsletter or otherwise deal with us. Please read it carefully. If you do not agree with it, please do not use the Site.

1. Who we are

IFIS is the specialised training arm of Summit Consulting Ltd, based in Kampala, Uganda. For the purposes of the Data Protection and Privacy Act, 2019 of Uganda (the "Act"), its regulations, and any other applicable data protection law, IFIS is the data controller of the personal data described in this policy.

Address: Strategy Place, Trinity Building, Block 216, Plot 2475, Kayondo Road, off Ntinda-Kiwatule Road, Kalinabiri, Ntinda, P.O. Box 40292, Kampala, Uganda.
Telephone: +256 783 373 637 and +256 782 610 333.
Email for all privacy matters: admissions@forensicsinstitute.org (please put "Data protection" in the subject line).

2. What this policy covers

This policy applies to everyone whose personal data we handle in connection with the Site and our services: visitors, learners, event attendees, members, newsletter subscribers, people who write to us or comment on our articles, representatives of organisations that sponsor or buy training, and faculty or speakers whose details we publish. "Personal data" means any information that identifies you or can reasonably be used to identify you, such as your name, email address, phone number, an identifier or information about your activity linked to you.

3. The personal data we collect

3.1 Account and profile data

When you create or are given an account we collect your first and last name, email address, a password (which we never store in readable form; it is stored only as a salted hash), and optionally your phone number, organisation, job title, country, short biography and profile photo. If you are a member of staff or faculty, we also record your role.

3.2 Learning records

We record the courses you enrol in, the lessons and assessments you complete and when, your quiz attempts, answers and scores, your overall progress and completion status, and any certificates issued to you.

3.3 Certificates

A certificate records your name as shown on your account, the programme title, credential, hours, issue date and a unique certificate number. See section 7 about public verification.

3.4 Events and tickets

When you register for an event we collect the attendee name, email address, telephone number, organisation and job title for each ticket, the ticket type, your order reference and your check-in status (for example, whether and when a ticket was scanned at the door).

3.5 Orders and payments

We keep a record of what you bought, the amount, currency, date and status, the payment reference and the outcome reported by our payment provider. We do not see or store your full card number, card security code or mobile-money PIN. Those details are entered directly on the secure pages of our payment provider (see section 10).

3.6 Membership applications

If you apply for membership we collect the details you provide on the application (such as your name, contact details, organisation, professional background, country and membership category) and any supporting documents you upload. Membership applications are reviewed by IFIS and, once approved, a membership number and validity period are recorded.

3.7 Communications

If you use our contact form, email or telephone us, we keep your message, contact details and our replies. If you comment on an article, we keep your name, email address (which is not published), the comment and the time it was posted. If you subscribe to our newsletter, we keep your email address, name (if given), subscription status and the source of your subscription.

3.8 Technical and security data

When you use the Site our servers automatically record your IP address, the pages requested, the date and time, the browser or device type and similar technical information. We use this to run the Site, prevent fraud and abuse, and investigate security incidents. Failed sign-in attempts are recorded to protect accounts from password guessing.

3.9 Photographs and recordings

We may photograph or record events, conferences, training sessions and awareness activities for reporting, promotion and our event galleries. See section 8.

3.10 Special categories of data

We do not ask for and do not intend to collect sensitive personal data (such as health, religion, ethnicity, political opinions, biometric data or criminal records). Please do not include such information in forms, comments or messages. Where an event or course requires accessibility or dietary information, we use it only to make appropriate arrangements.

4. How we collect personal data

Directly from you, when you register, enrol, buy, apply, subscribe, comment, take assessments or contact us.
From your organisation, where an employer or sponsor enrols you on a programme or buys tickets for you.
Automatically, through the Site as you use it (see sections 3.8 and 9).
From our payment provider, which tells us whether a payment succeeded, failed or was cancelled.
From our existing records, including records carried over from our previous website when we moved to this platform. Your account, course progress and certificates were migrated so that you do not lose your learning history.

5. Why we use your personal data

We use personal data only for specified, lawful purposes. The table below describes each purpose and the lawful ground we rely on under the Act.

To create and manage your account and let you sign in. Ground: performance of our agreement with you; your consent.
To deliver courses, assessments and certificates, track your progress and issue and verify credentials. Ground: performance of our agreement with you; our legitimate interest in maintaining the integrity of our certifications.
To register you for events, issue tickets, manage attendance and (where applicable) issue certificates of attendance. Ground: performance of our agreement with you.
To process payments, issue receipts, prevent fraud and keep accounting records. Ground: performance of our agreement with you; compliance with legal obligations.
To assess and administer memberships. Ground: performance of our agreement with you; our legitimate interests.
To respond to enquiries, comments and requests, and to provide support. Ground: our legitimate interests; your consent.
To send service messages such as account, password-reset, enrolment, payment, ticket and certificate emails. Ground: performance of our agreement with you.
To send newsletters and information about training and events to people who have subscribed. Ground: your consent, which you can withdraw at any time.
To keep the Site and our systems secure, prevent spam, abuse and unauthorised access, and diagnose faults. Ground: our legitimate interests; compliance with legal obligations.
To improve our courses, events and Site using aggregated or de-identified information. Ground: our legitimate interests.
To comply with the law, respond to lawful requests from authorities and establish, exercise or defend legal claims. Ground: compliance with legal obligations; our legitimate interests.

We will not use your personal data for a purpose that is incompatible with the purpose for which it was collected unless we have a lawful basis to do so and, where required, we have told you or obtained your consent.

6. Sponsors and employers

Where your employer or another organisation pays for, enrols you in or sponsors your training, we may share with them your enrolment status, progress, assessment outcome and certificate details, so that they can confirm your attendance and results. We do this under our agreement with that organisation and, where appropriate, with your knowledge. Please tell us if you do not want this and we will explain what is possible.

7. Certificates and public verification

Each certificate we issue carries a unique number and a QR code that links to a public verification page. Anyone who has the certificate number or scans the QR code can see the recipient's name, the programme title, the credential and hours, the issue date and whether the certificate is valid or has been revoked. We do this so that employers and other third parties can confirm that a credential is genuine. The page does not show your email address, contact details, scores or other account information. If you want your certificate details to be withheld from the public page, please contact us; we will consider each request, bearing in mind the purpose of verification.

8. Event photography and recordings

We may take photographs and video at our events and publish them in event galleries, on our website and social channels, in reports and in promotional material. Notices at the venue will tell you when this is happening. If you do not want to be photographed, tell a member of our team or contact us beforehand. If you appear in a published photograph and wish it to be removed, write to us with the event name and a description or link and we will remove it promptly. Photographs we publish are resized and stripped of embedded metadata such as camera location data.

9. Cookies and similar technologies

Cookies are small text files stored on your device. We keep our use of them to the minimum needed to run the Site.

Essential session cookie. After you visit or sign in we set a cookie (named ifis_sid) that identifies your session so that you stay signed in, keep your place in a course and your forms stay protected from forgery. It is a first-party cookie, flagged HttpOnly and, on our secure site, Secure. It is not used to track you across other sites.
Security check. Our forms are protected by Cloudflare Turnstile, a service that distinguishes people from automated programs. When it runs, Cloudflare receives technical information from your browser (such as your IP address and browser characteristics) and may set or read a small amount of data on your device for this purpose. Cloudflare acts as our service provider; its handling of that data is described in Cloudflare's own privacy documentation.
Embedded media. Some lessons or articles may embed videos from services such as YouTube or Vimeo. When you play an embedded video, that provider may set its own cookies. We do not control them.

We do not use advertising cookies, cross-site tracking or sell data to advertisers. You can block or delete cookies in your browser settings, but if you block the essential session cookie you will not be able to sign in.

We do not sell your personal data. We share it only as described below, and only to the extent necessary.

Payment provider. Online payments are processed by our payment provider, which is responsible for the security of card and mobile-money details you enter on its pages. We send it the order reference, amount, currency and your name, email address and phone number so that the payment can be processed and receipted, and we receive the payment result.
Service providers. Companies that help us run the Site and our services, acting on our instructions: web hosting and server providers, email delivery providers, and Cloudflare (security checks).
Sponsors and employers, as described in section 6.
The public, for certificate verification (section 7), published event photographs (section 8), and your name and comment where you post a comment on an article.
Professional advisers and auditors, such as lawyers, accountants and insurers, who are bound by confidentiality.
Authorities and regulators, where we are required to do so by law, court order or a lawful request, or to protect our rights, safety or property or those of others.
Successors. If IFIS or the Summit Consulting group is reorganised, merged or transferred, personal data may be transferred to the successor, which will be bound by this policy or must notify you of any change.

11. International transfers

Some of our service providers (including payment, email and security providers) operate in or store data in other countries, which may not offer the same level of data protection as Uganda. Where we transfer personal data outside Uganda we do so in accordance with the Act, which requires that the recipient country has adequate measures for protecting personal data at least equivalent to those in Uganda or that you have consented, and we use contractual and other safeguards where appropriate.

12. How long we keep personal data

We keep personal data only for as long as we need it for the purposes described in this policy, and for as long as the law requires. In general:

Account and profile data: while your account is open, and for a reasonable period afterwards so that we can respond to queries and defend claims.
Learning records and certificates: for as long as we need to confirm your credentials. Because a certificate must remain verifiable, certificate records are normally kept indefinitely, although we will anonymise or remove personal details where the law requires us to.
Orders, invoices and payment records: for the period required by Ugandan tax and accounting law.
Event registrations and ticket records: for a reasonable period after the event for attendance verification, certificates of attendance, reporting and audit.
Membership records: for the duration of membership and a reasonable period afterwards.
Contact messages and comments: for as long as needed to deal with your request, and comments for as long as the article is published unless you ask us to remove them.
Newsletter subscriptions: until you unsubscribe, after which we keep a minimal record to make sure we do not email you again.
Security and server logs: for a limited period, usually not more than 12 months, unless needed to investigate an incident.

When personal data is no longer needed it is deleted or irreversibly anonymised.

13. How we protect personal data

We take appropriate technical and organisational measures to protect personal data against unauthorised or accidental access, loss, alteration or disclosure, in line with the Act. These include encrypted connections (HTTPS), salted password hashing, protection against cross-site request forgery, parameterised database queries, rate-limiting and automated-abuse checks on sign-in and forms, verification of payment notifications with our payment provider, role-based access controls for staff, restricted storage for private documents and uploads, and regular backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please protect your own account by choosing a strong, unique password, not sharing it, and signing out on shared devices.

14. Your rights

Subject to the Act and other applicable law, you have the right to:

Be informed about how your personal data is collected and used (this policy).
Access the personal data we hold about you and obtain a copy.
Correct inaccurate, outdated or incomplete personal data. You can update most details yourself under My learning, Profile.
Request deletion of personal data we no longer have a lawful reason to keep.
Object to or request restriction of processing, including to prevent processing likely to cause damage or distress.
Opt out of direct marketing at any time, using the unsubscribe link in any email or by contacting us.
Withdraw consent where we rely on it. Withdrawal does not affect processing carried out before you withdrew.
Not be subject to decisions based solely on automated processing that significantly affect you. We do not make such decisions.
Lodge a complaint with the regulator (section 19).

To exercise a right, email admissions@forensicsinstitute.org. We may ask you to verify your identity before acting. We will respond within the time required by law and in any event within 30 days where practicable. We will not charge a fee unless the law permits one for repeated or manifestly unfounded requests. We may be unable to delete data we must keep by law or need to establish or defend legal claims; if so we will tell you why.

15. Children

Our courses and events are intended for adults and working professionals. The Site is not directed at children under 18, and we do not knowingly collect their personal data without the consent of a parent or guardian as the Act requires. If you believe a child has given us personal data, please contact us and we will delete it.

16. Personal data breaches

If a personal data breach occurs that is likely to affect your rights, we will take immediate steps to contain it and, as the Act requires, notify the Personal Data Protection Office and, where appropriate, the people affected, explaining what happened and what we are doing about it.

17. Links to other sites

The Site may link to websites and services run by others, including our social media pages and partner organisations. We are not responsible for their privacy practices or content. Please read their policies before you give them personal data.

18. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology or the law. The "last updated" date at the top of the page shows when it last changed. If the changes are significant we will take reasonable steps to tell you, for example by a notice on the Site or by email. Continued use of the Site after an update means you accept the updated policy.

19. Contact and complaints

If you have any question about this policy or how we handle your personal data, please write to admissions@forensicsinstitute.org or to Institute of Forensics & ICT Security, Strategy Place, Trinity Building, Plot 2475 Kayondo Road, Ntinda, P.O. Box 40292, Kampala, Uganda. We will do our best to resolve it. If you are not satisfied, you have the right to complain to the Personal Data Protection Office, which is established under the Act and hosted by the National Information Technology Authority, Uganda (NITA-U).

Privacy policy