Privacy Notice

1. Who this notice applies to

This Privacy Notice applies to people who browse MotherHelp, donate, share cases, register or work as community agents, participate in verification, are beneficiaries, provide consent on behalf of a beneficiary, communicate with MotherHelp, or otherwise use our website and related services.

MotherHelp may process information about a beneficiary through a community agent or another authorised person. Where information about another person is submitted, the person submitting it must have the authority or lawful basis to do so and must follow the MotherHelp consent and safeguarding process.

2. MotherHelp as a data controller

For personal data processed for MotherHelp's own platform purposes, MotherHelp or the legal entity operating the platform acts as the data controller. MotherHelp may also engage data processors, such as hosting, technology, communications and payment-service providers, to process information on its behalf.

Under Uganda's Data Protection and Privacy Act, 2019, organisations that collect or process personal data have duties concerning lawful processing, transparency, security, retention, data-subject rights and appropriate arrangements with processors. MotherHelp intends to operate in accordance with those requirements and applicable regulations.

3. Information we collect

Depending on how you use MotherHelp, information may include:

• Account information: name, email address, telephone number, login information, role and agent profile information.
• Beneficiary information: name, contact details, age/date of birth where needed, location, household circumstances, economic or assistance needs, and case-related information.
• Case information: case title, description, assistance category, urgency, amount requested, verification information, updates and outcome information.
• Evidence and consent: photographs, documents, consent records and other evidence supplied for verification. Some evidence may contain sensitive personal data.
• Donation and payment information: donation amount, currency, payment method, transaction/reference identifiers and information needed to reconcile a payment. Where a donor chooses to provide them, MotherHelp may store the donor name, email address, phone number and message. Donors do not need to create an account. A donor may separately choose whether MotherHelp may contact them about their donation or verified impact. Payment credentials such as mobile-money PINs are not requested by MotherHelp.
• Communications: enquiries, feedback, reports, complaints and other messages sent to MotherHelp.
• Technical information: browser/device information, page activity and privacy-preserving traffic measurements where you have enabled optional analytics cookies.
• Referral, sharing and Help Circle information: information about how a MotherHelp case link was shared or reached, and whether a confirmed donation was associated with a Help Circle, where optional analytics or the relevant donation workflow applies. Referral tokens are signed and stored in privacy-conscious form rather than as a donor-facing identity.

4. Sensitive personal data and vulnerable people

Some MotherHelp cases may involve health information, financial hardship, identification information, photographs, information about children or other information requiring increased care. We treat such information as high-risk and limit access and publication according to the purpose for which it was collected.

Public case pages are designed to show enough information for supporters to understand and trust a case without exposing unnecessary private information. Verification documents and private evidence are not intended to be publicly accessible.

Where a case involves a child, MotherHelp expects the community agent or other submitting person to have appropriate parental or guardian authority and to follow safeguarding requirements. We do not intend for children to operate MotherHelp accounts independently.

5. Why we use personal information

MotherHelp may use personal information to:

• register and authenticate community agents and other account holders;
• identify beneficiaries and document genuine assistance needs;
• verify cases, evidence, consent and eligibility;
• publish approved cases and provide appropriate case updates;
• receive, reconcile and confirm donations and disbursements;
• record beneficiary payout destinations, verify ownership/name matching and keep a locked payout reference for settlement purposes;
• support the community-agent-led referral and case-registration process;
• prevent fraud, abuse, impersonation, money laundering and other misuse;
• provide support, follow-up, accountability and impact reporting;
• operate, secure, troubleshoot and improve the platform;
• measure traffic and campaign performance when optional analytics is enabled;
• respond to complaints, legal requests and regulatory requirements; and
• protect the rights, safety and property of beneficiaries, donors, agents, MotherHelp and the public.

6. Lawful processing in Uganda

Uganda's Data Protection and Privacy Act generally requires prior consent for collection or processing, subject to specified exceptions including processing authorised or required by law, necessary for certain public duties or law-enforcement purposes, performance of a contract, medical purposes and compliance with a legal obligation. MotherHelp will identify an appropriate lawful basis for the processing it performs rather than treating consent as the only possible basis.

Where processing is based on consent, MotherHelp aims to obtain consent that is freely given, specific, informed and unambiguous. Where the law permits or requires processing without consent, MotherHelp may continue that processing to the extent necessary for the relevant lawful purpose.

7. Information collected from another person

MotherHelp's community-agent model sometimes requires information about a beneficiary to be collected by an agent rather than directly by the beneficiary. Uganda's law permits specified circumstances in which personal data may be collected from another source. MotherHelp therefore requires agents to use the consent and beneficiary-registration process, explain the purpose of collection in a language the person understands, avoid unnecessary information and respect any applicable restrictions.

MotherHelp may also process settlement allocation records showing beneficiary assistance, community-agent field support and platform operations allocations. These records are used for financial accountability and are not published with private payout account details.

8. Public case pages

MotherHelp is a fundraising platform, so some approved case information is intentionally public. A public case may contain a story, first name or public reference, general location, assistance need, images and fundraising progress. Public information may be copied, shared, indexed by search engines or viewed by people outside MotherHelp.

Before publishing a case, MotherHelp should obtain the consent or other lawful authority required for the particular publication. Users should never upload identity documents, private medical records, mobile-money PINs, passwords or other unnecessary confidential information to a public case.

9. Donations and payment providers

MotherHelp may use third-party payment providers, including mobile-money or other payment services, to process donations. These providers may process personal and transaction information under their own privacy notices and regulatory obligations. MotherHelp receives and stores the information reasonably needed to create, reconcile and audit the donation.

MotherHelp does not ask donors to give MotherHelp staff their mobile-money PIN, OTP, banking password or similar secret authentication credential. If someone asks for such information while claiming to represent MotherHelp, do not disclose it and report the incident.

10. When we share information

MotherHelp may disclose information where reasonably necessary to provide the service or comply with law, including to:

• community agents and authorised reviewers who need information to manage or verify a case;
• beneficiaries or authorised representatives, where appropriate;
• payment providers and financial-service partners for transaction processing;
• hosting, security, email, SMS, technical and other service providers acting on MotherHelp's instructions;
• professional advisers or auditors where reasonably necessary;
• courts, law-enforcement agencies, regulators or the Personal Data Protection Office where legally authorised or required; and
• other persons where the data subject has provided appropriate consent or another lawful basis applies.

MotherHelp does not intend to sell personal information. We also do not currently operate a targeted-advertising cookie programme.

11. Data processors

Where MotherHelp appoints a service provider to process personal data on its behalf, MotherHelp will seek appropriate contractual and technical safeguards, including confidentiality, security and purpose limitations. Processors should only receive the information reasonably required for the service.

12. Security

MotherHelp uses technical and organisational safeguards appropriate to the risks of the information it processes. These include access controls, authentication protections, CSRF protection, secure-session settings, restricted evidence storage, security headers and privacy-conscious traffic attribution. No internet system can guarantee absolute security.

If MotherHelp becomes aware of a personal-data security incident, it will assess and respond to the incident and make notifications required by applicable Ugandan law and regulatory guidance.

13. Retention

MotherHelp retains personal information only for as long as reasonably necessary for the purpose for which it was collected, accountability, dispute handling, security, fraud prevention, legal obligations and legitimate operational needs, subject to applicable law. Different records may therefore have different retention periods.

For example, a published case may need to retain sufficient records to demonstrate verification and donation accountability even if some public content is later removed. Where information is no longer required and there is no lawful reason to retain it, MotherHelp may delete, anonymise or securely destroy it.

14. Processing or storage outside Uganda

MotherHelp may use service providers whose infrastructure is located outside Uganda. Uganda's Data Protection and Privacy Regulations, 2021 contain requirements for processing or storing personal data outside Uganda, including requirements concerning adequate protection or appropriate consent. MotherHelp will assess relevant cross-border arrangements and apply the safeguards required by applicable law.

15. Your privacy rights in Uganda

Subject to the conditions, exceptions and procedures in Ugandan law, a data subject may have rights including:

• Access: to request confirmation about whether MotherHelp holds personal data about you, a description of that data and information about relevant third-party access. Uganda's Act provides for compliance with an access request promptly and, in any event, within 30 days after receipt, subject to the Act.
• Correction and deletion: to request correction or deletion of personal data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, subject to lawful retention requirements. The 2021 Regulations provide for a written decision within seven days on a request under Regulation 29.
• Prevention of harmful processing: to require processing to stop where the statutory conditions for preventing processing that causes or is likely to cause unwarranted substantial damage or distress are met.
• Direct-marketing objection: to prevent processing for direct marketing where the applicable statutory right applies.
• Automated decision-making protections: to require reconsideration where a decision significantly affecting you is based solely on automated processing, as provided by Ugandan law.
• Consent choices: where processing is based on consent, to withdraw consent, subject to the legal consequences of withdrawal and any other lawful basis for continued processing.
• Complaint: to complain to the Personal Data Protection Office if you believe your rights have been infringed or an organisation has failed to comply with data-protection requirements.

These rights are not absolute. For example, MotherHelp may need to verify your identity, protect another person's privacy, retain information required by law, preserve evidence or continue processing where a lawful exception applies.

View your privacy choices & make a request

16. Cookies and similar technologies

MotherHelp uses a small number of cookies and similar technologies. Essential cookies support sessions, security and privacy choices. Functional cookies can remember preferences such as language. Optional analytics cookies help us understand whether the platform is reaching people and whether shared cases lead to useful action.

You can change optional analytics preferences at any time from the Cookie settings control in the footer. See our Cookie Policy for the cookie categories and purposes.

17. Children

MotherHelp may process information about children because some assistance cases concern families with children. This does not mean children should create accounts or submit cases themselves. Information about a child should be provided only by a person with appropriate authority and should be limited to what is necessary for the assistance purpose. We encourage agents to avoid publishing a child's full name, exact location, school details, identity documents or unnecessary photographs.

18. Third-party links and services

MotherHelp may link to or use services operated by third parties. Their privacy practices are governed by their own notices. A translated version of a MotherHelp page may also be provided through an external translation service selected by the user; the external service may process the page URL and content needed to provide the translation.

19. Privacy complaints and requests

For a MotherHelp privacy request, correction, deletion request, objection or privacy complaint, contact us using the details below. We may ask for reasonable information to verify identity before releasing or changing personal data.

If you are not satisfied with how a personal-data issue is handled, you may contact Uganda's Personal Data Protection Office. The PDPO provides a complaint process for data-protection concerns.

PDPO Uganda complaint portal · PDPO Uganda

20. Legal references

This notice is intended to reflect the MotherHelp service and the Uganda context. Key legal references include:

• Uganda Data Protection and Privacy Act, 2019
• Uganda Data Protection and Privacy Regulations, 2021
• Constitution of the Republic of Uganda — privacy protections

21. Changes to this notice

MotherHelp may update this Privacy Notice when the platform, payment arrangements, data practices, security measures or legal requirements change. We will update the effective date and publish the revised notice on this page. Where appropriate, we may also provide additional notice through the platform.

22. Important legal note