Terms of use

1. Introduction

Rwenzori Keystone Ltd ("we," "us," or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website or interact with us through our digital platforms.

This Policy is issued in compliance with the Data Protection and Privacy Act, 2019 (Cap. 97) and the Data Protection and Privacy Regulations, 2021 of the Republic of Uganda . We are regulated by the Personal Data Protection Office (PDPO) established under the National Information Technology Authority – Uganda (NITA-U) .

By using our website, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our website.

2. Definitions

For the purposes of this Privacy Policy:

·         "Personal Data" means any information about an identifiable individual, including but not limited to name, contact details, identification numbers, nationality, age, marital status, education level, occupation, and identity data .

·         "Special Personal Data" means data relating to religious or philosophical beliefs, political opinions, sexual life, financial information, health status, or medical records .

·         "Data Subject" means the individual to whom personal data relates.

·         "Data Controller" means Rwenzori Keystone Ltd, which determines the purposes and means of processing personal data.

·         "Data Processor" means any person or entity that processes personal data on our behalf.

·         "Processing" means any operation performed on personal data, including collection, storage, use, disclosure, and deletion.

·         "PDPO" means the Personal Data Protection Office. 

We generally do not collect Special Personal Data through our website. However, if such data is provided in connection with a project inquiry or consultancy engagement, we will obtain your explicit consent and process it only as permitted by law .

5. Lawful Basis for Processing

We process personal data only when we have a lawful basis to do so. Under the Data Protection and Privacy Act, the primary lawful basis is consent, which must be freely given, specific, informed, and unambiguous .

We may also process personal data on the following bases:

·         Contract: Processing is necessary for the performance of a contract with you or to take steps at your request before entering a contract ;

·         Legal Obligation: Processing is necessary for compliance with a legal obligation to which we are subject ;

·         Public Duty: Processing is necessary for the proper performance of a public duty by a public body ;

·         National Security or Law Enforcement: Processing is necessary for national security or for the prevention, detection, investigation, or prosecution of an offence ;

·         Vital Interests: Processing is necessary to protect your vital interests or those of another person;

·         Legitimate Interests: Processing is subject to our legitimate interests or those of a third party, provided your rights do not override those interests .

Where consent is our lawful basis, you have the right to withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal .

6. How We Use Personal Data

We use personal data for the following purposes:

·         Responding to Inquiries: To respond to your questions, requests, and project inquiries;

·         Service Delivery: To provide consultancy services, including mineral exploration, geological surveys, prospecting, technical assessments, and IT consultancy;

·         Business Development: To communicate with you about our services and potential business engagements;

·         Legal Compliance: To comply with applicable laws, regulations, and regulatory requirements, including the Mining and Minerals Act, 2022;

·         Website Improvement: To analyze website usage and improve our digital presence;

·         Security: To protect our website, systems, and users from unauthorized access, misuse, or harm.

We will only use your personal data for the specific purposes for which it was collected, unless we reasonably determine that another purpose is compatible with the original purpose .

7. Consent

7.1 Obtaining Consent

We will obtain your prior consent before collecting or processing your personal data, unless another lawful basis applies . Consent is obtained through clear affirmative action, such as checking a box on a contact form or submitting an inquiry with an acknowledgment of this Policy.

7.2 Withdrawal of Consent

You may withdraw your consent at any time by contacting us at [Insert contact email]. Upon withdrawal, we will cease processing your personal data, unless we have another lawful basis to continue .

8. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law .

·         Inquiry Data: Retained for [Insert period, e.g., 12 months] after the last communication, unless a business relationship is established;

·         Client Data: Retained for the duration of the engagement and thereafter as required by legal or regulatory obligations;

·         Website Technical Data: Retained for [Insert period, e.g., 24 months] for analytics and security purposes.

When personal data is no longer needed, we will securely delete, destroy, or anonymize it in a manner that prevents reconstruction .

9. Data Security

We implement appropriate technical and organizational measures to protect personal data against loss, unauthorized destruction, unauthorized processing, and unlawful access .

Our security measures include:

·         Access Controls: Limiting access to personal data to authorized personnel who need it for their work;

·         Encryption: Protecting data in transit and at rest where appropriate;

·         Secure Storage: Maintaining personal data in secure systems with appropriate safeguards;

·         Regular Review: Periodically verifying the effectiveness of our security measures and updating them as needed ;

·         Staff Training: Ensuring personnel involved in data processing are aware of their obligations under the Data Protection and Privacy Act .

While we take reasonable steps to protect personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.

10. Data Breach Notification

In the event of a data breach where there is reason to believe that personal data has been accessed or acquired by an unauthorized person, we will:

·         Notify the PDPO: Report the breach to the Personal Data Protection Office as required by law ;

·         Notify Affected Individuals: Inform affected data subjects by registered mail, email, website posting, or mass media publication, as appropriate .

11. Sharing and Disclosure of Personal Data

We do not sell, rent, or trade personal data. We may share personal data in the following circumstances:

·         Service Providers: With trusted third-party service providers who assist us in operating our website or delivering services, subject to confidentiality and data protection obligations;

·         Legal Requirements: Where required by law, regulation, court order, or governmental authority;

·         Business Transfers: In connection with a merger, acquisition, or sale of assets, where personal data may be transferred as a business asset;

·         With Your Consent: Where you have given us explicit consent to share your data for a specific purpose.

Where we engage data processors, we ensure they implement appropriate security measures and comply with the Data Protection and Privacy Act before permitting them to process personal data on our behalf .