Effective Date: June 15, 2026

Last Updated: August 5, 2026

Entity Name: Mirika Foundation Ltd

Website: https://www.mirikafoundation.org

1. Introduction & Overview

Welcome to Mirika Foundation Ltd (“Mirika Foundation,” “we,” “us,” or “our”). At Mirika Foundation Ltd, our mission is to power PhD research by providing professional mentoring, academic coaching, consultation, capacity building and guidance services to PhD candidates, postgraduate scholars and researchers worldwide.

We take the security of your personal data seriously and are committed to processing your information in a fair, transparent, ethical and lawful manner. This Privacy Policy describes how we collect, use, disclose and protect your personal data when you visit our website, engage with our online tools, sign up for mentoring sessions, purchase our services and communicate with our team.

This policy aligns with our internal Data Protection and Information Security Measures Policy and complies with relevant statutory requirements, including the Uganda Data Protection and Privacy Act (DPPA), the General Data Protection Regulation (GDPR) and other global data privacy standards.

2. Information We Collect

We principle-bind our data collection to collect only the data necessary to fulfill our academic mentoring and operational requirements, ensuring that data is destroyed or anonymized once its retention purpose expires.

Depending on how you interact with our website and services, we may collect the following categories of information:

A. Personal & Academic Identity Information

• Contact Details: Full name, email address, postal address, phone number, and physical location/residence.
• Academic & Professional Profile: University affiliation, department, field of study, research focus/discipline, degree status, academic history, and institutional enrollment proof.
• Demographic Information: Date of birth, national ID or refugee ID (where applicable for specific research grant/sponsorship programs), gender, or disability status (if provided voluntarily to facilitate accessible service delivery).

B. Payment & Billing Information

• Payment card details, billing address, tax identification (where applicable), transaction history, and financial account details required to process service fees, invoice billing, or grant disbursements. (Note: All credit card transactions are processed securely via PCI-DSS compliant third-party payment gateways; we do not store full credit card numbers on our WordPress servers).

C. Account & Service Registration Data

• WordPress user profile credentials, username, password hash, session tokens and preferences related to your mentoring plan or dashboard.

D. Communication & Interactive Data

• Content of emails, inquiry forms, feedback submissions, appointment scheduling details, chat logs, forum posts, submitted draft documents, proposals, or research multimedia shared for mentoring feedback.

E. Technical & Usage Data

• Internet Protocol (IP) address, browser type and version, operating system, device parameters, language settings, referring/exit pages, access timestamps, clickstream data, geospatial data and website usage statistics.

3. How We Collect Information

We collect information through various transparent touchpoints on our website with your full cooperation, knowledge and consent:

1. WordPress Forms & Plugins: Information submitted via contact forms, application forms, research intake questionnaires, and feedback submissions.
2. Account Registration & User Profiles: Details provided when creating an account on our platform to access member resources or client portals.
3. Booking & Scheduling Systems: Data entered into embedded calendar tools (e.g., Calendly, Amelia, or Bookly) to schedule mentoring sessions, discovery calls, or consultations.
4. Newsletter & Educational Subscriptions: Name and email collected via subscription pop-ups or opt-in forms for research newsletters, guides, and webinar invitations.
5. Payment Gateways: Financial information collected securely during checkout via integrated processors (e.g., Stripe, PayPal, Flutterwave).
6. Cookies and Automated Tracking Technologies: Passive data collected as you navigate through our pages using cookies, tags, and web analytics tools.
7. Direct Communications: Correspondence via direct email, virtual meeting platforms (e.g., Zoom, Google Meet, Microsoft Teams), or live web chat.

4. Purpose of Data Processing & Lawful Bases

We collect and process your personal data for clear, lawful and legitimate operational purposes. Below are the primary purposes along with our lawful bases under applicable privacy laws (such as GDPR and Uganda DPPA):

Purpose of Processing	Categories of Data Involved	Lawful Basis for Processing
Delivering Academic Mentoring & Coaching	Identity, Academic Profile, Communication Data	Contractual Necessity (to perform our service agreement with you)
Scheduling Consultations & Appointments	Identity, Contact Info, Booking Details	Contractual Necessity / Legitimate Interests
Processing Fees & Invoicing	Billing & Financial Data, Contact Info	Contractual Necessity / Legal Obligation
Sending Newsletters, Guides & Promotional Content	Name, Email Address	User Consent (can be withdrawn at any time)
Improving Website Functionality & User Experience	Technical Data, Cookies, Usage Analytics	Legitimate Interests / Consent (for non-essential cookies)
Responding to Inquiries & Customer Support	Identity, Contact Info, Message Content	Legitimate Interests
Legal Compliance, Audits & Dispute Resolution	All Relevant Categories	Legal Obligation

5. Cookies and Tracking Technologies

A. What Are Cookies?

Cookies are small text files stored on your computer or mobile device when you visit a website. They help the website recognize your device, remember preferences, and enhance browsing performance.

B. Types of Cookies We Use

• Essential / Strictly Necessary Cookies: Required for core website functions, such as user authentication, session security, and database connectivity. These cannot be disabled.
• Functional Cookies: Remember your settings, preferences (such as language or login state), and customize your experience.
• Performance & Analytics Cookies: Collect aggregated, anonymous data on how visitors interact with our site (e.g., page views, session duration, error messages) using tools like Google Analytics.
• Marketing & Targeting Cookies: Used to track visitor engagement across websites to deliver relevant announcements or measure campaign effectiveness.

C. Managing and Disabling Cookies

You can manage or revoke cookie preferences at any time:

• Cookie Banner: Adjust your selections via the cookie preference banner upon visiting our website.
• Browser Settings: Most web browsers allow you to decline or delete cookies via settings (typically under “Privacy” or “Security”). Please note that disabling essential cookies may impact website functionality.

6. Data Sharing and Third-Party Disclosures

Mirika Foundation Ltd does NOT sell, rent, or trade your personal information to third parties for commercial marketing purposes.

We may share your data with trusted third-party service providers solely to operate our website and deliver our mentoring services. All service providers are contractually obligated to maintain data confidentiality and security:

• Hosting & Infrastructure Providers: WordPress web hosts, database providers, and cloud backup systems.
• Payment Processors: Secure merchant platforms for processing card or electronic payments.
• Scheduling & Communication Tools: Integrated tools used to coordinate appointments, send transactional emails, or host video calls.
• Email Marketing Service Providers: Platforms used to distribute newsletters, academic guides, and updates.
• Analytics Providers: Services (e.g., Google Analytics) assisting us in evaluating site traffic and performance.
• Legal Authorities: Regulatory agencies, law enforcement, or legal entities when strictly required by applicable law, court order, or subpoena.

7. Data Security Safeguards

In accordance with Section 5.0 through Section 16.0 of our internal Data Protection and Information Security Measures Policy, Mirika Foundation Ltd maintains comprehensive technical, administrative and physical measures to protect your data from unauthorized access, loss, misuse, or alteration:

1. Encryption: All electronic data transmitted over public wired or wireless networks is encrypted using industry-standard protocols (SSL/TLS encryption with strong cryptographic keys).
2. Strict Access Controls & Least Privilege: Access to sensitive personal data is restricted strictly to authorized staff on a “need-to-know” basis under the Principle of Least Privilege (PoLP). Account sharing is strictly prohibited; all personnel use unique, individual credentials.
3. Multi-Factor Authentication (MFA): Remote access to networks and administration accounts processing personal data requires mandatory two-factor authentication (2FA/MFA).
4. Password Security Policy: Strong password parameters are enforced, including minimum length, complexity requirements, periodic forced updates, and account lockouts after failed login attempts.
5. Malware & Cyber Defense: Our web servers and administrative gateways run enterprise-grade antivirus and firewall software with definition updates applied within 24 hours of release. Real-time scanning and scheduled system checks protect against unauthorized intrusions.
6. Vulnerability Assessments: We conduct internal and external network vulnerability scans quarterly and after any major configuration change. Critical vulnerabilities are remediated promptly.
7. Personnel Security: Employees, contractors, and mentors undergo background reviews, sign strict confidentiality agreements, and receive regular security and privacy awareness training.
8. Physical Security: Physical locations housing servers or printed records are secured with access logging, restricted authorization protocols, and physical controls.

8. Data Retention & Destruction

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, academic reporting, or contractual requirements.

• Account & Mentoring Records: Retained for the duration of your active mentoring relationship plus a standard retention period (e.g., 3 to 7 years) to fulfill accounting and legal requirements.
• Marketing & Subscription Data: Retained until you withdraw consent or unsubscribe.
• Temporary Technical Logs: Deleted or anonymized on a regular routine schedule (e.g., every 30 to 90 days).

When data is no longer required, it is securely destroyed via digital purging, secure overwrite algorithms, or physical shredding for hard-copy documents.

9. International Data Transfers

As an organization operating globally to support PhD students, Mirika Foundation Ltd may store or process personal data on servers located outside your country of residence (for example, cloud servers hosted in Europe, the United States, or Africa).

Where cross-border data transfers occur, we ensure that adequate data protection safeguards are in place in compliance with Section 4.0 of our policy and applicable laws (such as GDPR Standard Contractual Clauses or equivalent adequacy assessments), ensuring your personal data receives a level of protection comparable to your home jurisdiction.

10. Your Data Privacy Rights

Under applicable privacy regulations (including GDPR, CCPA/CPRA, and the Uganda Data Protection and Privacy Act), you possess specific rights regarding your personal data held by Mirika Foundation Ltd:

• Right to Access: Request confirmation of whether we process your data and obtain a copy of your personal data.
• Right to Rectification: Request correction of inaccurate, incomplete, or outdated personal information.
• Right to Erasure (“Right to be Forgotten”): Request the deletion or removal of your personal data when it is no longer needed or where processing relies on revoked consent.
• Right to Restrict or Object to Processing: Request that we limit how we use your data or object to processing based on legitimate business interests or direct marketing.
• Right to Data Portability: Request a copy of your data in a structured, commonly used, machine-readable format for transfer to another controller.
• Right to Withdraw Consent: Where processing is based on consent (e.g., email newsletters), you may withdraw consent at any time without affecting prior lawful processing.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority or the Personal Data Protection Office (PDPO) in Uganda if you believe your privacy rights have been infringed.

To exercise any of these rights, please contact our Data Protection Officer using the details provided in Section 15.

11. Security Incident Response & Breach Notification

In the event of a confirmed security incident or data breach impacting your personal information, Mirika Foundation Ltd will execute its documented Security Incident Response Plan.

Under the oversight of our Data Protection Officer, we will contain, investigate, and secure our infrastructure. We will notify affected users and applicable regulatory bodies as soon as reasonably practicable and in compliance with statutory notice windows mandated by law.

12. Children’s Privacy

Our services, website content, and academic coaching programs are intended exclusively for university students, postgraduate researchers, academic professionals, and adults. We do not knowingly collect or solicit personal data from children under the age of 18 (or the applicable legal age of majority). If we learn that we have inadvertently collected data from a minor, we will delete that information immediately.

13. Third-Party Links & External Resources

Our WordPress site may contain hyperlinks to external academic journals, university websites, research repositories, funding institutions, or third-party tools. Mirika Foundation Ltd is not responsible for the privacy practices, content, or security measures of external third-party sites. We encourage you to read the privacy policies of any third-party website you visit.

14. Amendments to This Privacy Policy

Mirika Foundation Ltd reserves the right to update or modify this Privacy Policy periodically to reflect changes in our operational practices, technical infrastructure, or legal requirements.

When updates are made, we will revise the “Last Updated” date at the top of this policy. For material changes affecting your rights or data use consent, we will provide prominent notice on our website or notify registered users directly via email.

15. Contact Information & Data Protection Officer

If you have any questions, concerns, requests, or complaints regarding this Privacy Policy or our data handling practices, please contact our Data Protection Officer (DPO):

Mirika Foundation Ltd

Attn: Data Protection Officer

General Inquiries: [email protected]

Website: https://www.mirikafoundation.org