Privacy Policy

1
Data controller

The data controller responsible for personal data collected
through ktc.co.ug is:

Privacy enquiries may be submitted through the contact
details or contact form provided on ktc.co.ug.

2
Personal data we collect

The information we collect depends on how you interact with
KTC.

3
How we collect personal data

We may collect personal data:

• directly from you;
• from your institution or employer when it purchases or
  manages a service on your behalf;
• when you complete a website form;
• when you make a purchase or subscription payment;
• when you activate or manage a software licence;
• when you participate in a project, course, training,
  survey, interview, audit or event;
• automatically through website logs, cookies and similar
  technologies;
• from providers supporting payments, hosting, software
  delivery, communications, analytics or security;
• from public or professional sources where collection is
  lawful and relevant.

4
How we use personal data

KTC may use personal data to:

• respond to enquiries;
• prepare quotations, proposals and contracts;
• provide consultancy, research, accessibility, training,
  Moodle and e-learning services;
• process orders, subscriptions, renewals and refunds;
• issue invoices, receipts and transaction records;
• deliver software and digital resources;
• activate, authenticate, renew or deactivate licences;
• provide customer and technical support;
• maintain customer and institutional accounts;
• improve website and product functionality;
• diagnose faults and technical problems;
• prevent fraud, unauthorised access, licence misuse and
  security threats;
• conduct quality assurance and service evaluation;
• send operational notifications about orders, licences,
  security, support and service changes;
• send marketing communications where legally permitted;
• maintain financial and regulatory records;
• comply with legal obligations;
• establish, exercise or defend legal claims.

We will not use personal data for purposes that are
incompatible with the reason it was collected unless the use
is authorised or legally permitted.

5
Legal grounds for processing

Depending on the circumstances, KTC may process personal
data on the basis of:

• your consent;
• performance of a contract;
• steps requested before entering into a contract;
• compliance with a legal obligation;
• legitimate business, security and operational interests;
• an appropriate legal and ethical basis for research or
  professional activities;
• protection of the rights and interests of KTC, customers,
  users and other persons.

Where processing relies on consent, you may withdraw that
consent. Withdrawal does not invalidate processing lawfully
completed before consent was withdrawn.

6
Payments

Payments made through ktc.co.ug may be handled by
Flutterwave or another authorised payment service provider.

The payment provider may process information required to:

• authenticate the payer;
• process and confirm the transaction;
• manage refunds and payment disputes;
• detect and prevent fraud;
• comply with identity-verification, financial,
  anti-money-laundering and regulatory obligations.

7
Software licences and remote verification

KTC software licences may be authenticated online between
the customer’s authorised system and KTC’s licensing
service.

When an institution activates a KTC product such as Morska
Accessibility Suite, the authorised Moodle installation may
send:

• the licence key;
• the product identifier;
• the authorised website address;
• the software version;
• activation, verification or deactivation requests.

The licensing service may return:

• licence validity status;
• product confirmation;
• activation status;
• subscription expiry date;
• activation limits;
• order or payment reference;
• available product-version information.

8
Cookies and similar technologies

KTC may use cookies and comparable technologies to:

• keep the website functioning;
• maintain user sessions and shopping carts;
• remember user choices;
• support secure login;
• process purchases;
• prevent fraud;
• measure website performance;
• improve products and services.

Types of cookies

• Strictly necessary cookies:
  support essential website functions.
• Preference cookies:
  remember selected settings.
• Analytics cookies:
  help assess website performance.
• Payment and security cookies:
  support secure transactions and fraud prevention.

Where required, non-essential cookies will be activated only
after an appropriate choice has been provided.

9
Sharing personal data

KTC may share personal data only where necessary and lawful,
including with:

• website and hosting providers;
• cloud and storage providers;
• payment processors;
• accounting and financial-service providers;
• email and communications providers;
• software licensing and delivery systems;
• professional advisers;
• project partners and subcontractors working under
  confidentiality obligations;
• courts, regulators, government authorities or law
  enforcement where legally required;
• organisations involved in a lawful business transfer,
  merger or restructuring.

10
International data transfers

Some service providers may process or store information
outside Uganda.

Where personal data is transferred internationally, KTC
will take reasonable steps to ensure that:

• the transfer is lawful;
• the recipient applies appropriate security and
  confidentiality safeguards;
• only necessary information is transferred;
• contractual, technical or organisational safeguards are
  applied where appropriate.

11
Data retention

KTC retains personal data only for as long as reasonably
necessary for the purpose for which it was collected.

Information may be retained to:

• provide contracted services;
• maintain active subscriptions and licences;
• support customers;
• comply with tax, accounting, contractual and regulatory
  obligations;
• resolve disputes;
• prevent fraud and security incidents;
• maintain appropriate consultancy, training, research and
  project records.

At the end of the applicable retention period, personal data
will be deleted, anonymised or securely archived where
continued retention is legally required.

12
Data security

KTC applies reasonable administrative, organisational and
technical measures to protect personal data against:

• unauthorised access;
• accidental loss;
• alteration;
• improper disclosure;
• destruction;
• misuse.

Security measures may include:

• access controls;
• secure passwords and authentication;
• encryption in transit;
• restricted administrative access;
• system updates and maintenance;
• backups;
• security monitoring;
• staff confidentiality obligations;
• incident-response procedures.

13
Children and young users

KTC’s commercial website and institutional software
purchasing services are primarily directed to adults,
professionals, educational institutions and organisations.

Some KTC learning services and products may be used by
students, including children, through an authorised school,
institution, parent or guardian.

In those circumstances:

• the institution is responsible for obtaining any required
  permissions;
• only information reasonably necessary for the educational
  purpose should be collected;
• children’s data should not be used for unrelated
  marketing;
• safeguards should reflect the learner’s age, risk and
  context;
• consent from a parent, guardian, institution or authorised
  person may be required.

14
Marketing communications

KTC may send information about:

• products;
• consultancy opportunities;
• training programmes;
• software updates;
• events;
• publications;
• offers and related professional services.

Marketing communications will be sent only where legally
permitted. You may unsubscribe through the option provided
in the message or by contacting KTC.

Operational notices about orders, contracts, licences,
security incidents, service interruptions and support
requests are not marketing communications.

15
Your data-protection rights

Subject to applicable law and appropriate identity
verification, you may request:

• confirmation of whether KTC holds personal data about you;
• access to your personal data;
• correction of inaccurate or incomplete information;
• deletion where there is no lawful reason to retain the
  information;
• restriction of or objection to certain processing;
• withdrawal of consent;
• cessation of direct marketing;
• information about how your data has been used or shared;
• review of a significant decision based solely on automated
  processing;
• transfer of information where applicable and technically
  feasible.

KTC may request information necessary to verify your identity
and locate the relevant records.

16
Complaints

Please contact KTC first so that we can investigate and
respond to your concern.

You may also submit a complaint to Uganda’s Personal Data
Protection Office, which oversees implementation and
enforcement of Uganda’s data-protection framework.

17
Third-party links

The KTC website may link to Moodle sites, payment services,
partner platforms, social networks, external resources and
independent websites.

KTC is not responsible for the privacy practices of
independent third parties. Visitors should review the
relevant privacy policy before submitting personal data to
an external service.

18
Changes to this Privacy Policy

KTC may update this policy to reflect:

• changes in law;
• new products or services;
• changes in payment or licensing systems;
• new website functions;
• changes in data-processing practices;
• security and operational improvements.

The updated policy will be published on ktc.co.ug with a
revised effective date. Significant changes may also be
communicated through email, an account dashboard, a product
notice or the website.