Privacy Policy

Jdiobe STEM Foundation (“the Foundation”, “we”, “us” or “our”) is a non-profit organisation recognised as tax-exempt under section 501(c)(3) of the United States Internal Revenue Code. We provide STEM education, scholarships, mentorship and related programmes to students, principally in Uganda and South Sudan.

This Privacy Policy (“Policy”) explains what personal information we collect through jdiobestem.org and any page, form or service that links to this Policy (together, the “Site”), why we collect it, who we share it with, how long we keep it, and the rights available to you.

This Policy applies to information collected through the Site. It does not apply to information collected offline, to information collected by third parties whose services we link to, or to the internal records the Foundation keeps about programme participants under separate programme agreements.

If you do not agree with this Policy, please do not use the Site or submit information through it.

The Foundation is the party responsible for the personal information described in this Policy (the “data controller”, where that term applies). You may contact us about this Policy or about your information at:

Please mark any privacy request “Privacy Request” in the subject line so that it reaches the right person promptly.

In this Policy:

“Personal information”

means information that identifies, relates to, describes, or can reasonably be linked to an identified or identifiable individual. It does not include aggregated or de-identified information that cannot reasonably be used to identify you.

“Processing”

means any operation performed on personal information, including collection, storage, use, disclosure, transfer and deletion.

“Service provider”

means a third party that processes personal information on our behalf and on our instructions, such as our payment processor or hosting provider.

“Student information”

means personal information about a student submitted to us in connection with a programme, competition or registration, including information about a student who is under the age of 18.

4.1 Information you provide to us

We collect the information you enter into forms on the Site. We collect only the fields listed below; we do not ask for government identification numbers, financial account details or health information through the Site.

1. Contact enquiries. When you use our contact form we collect your name, email address, the subject you select, and the content of your message.
2. Volunteer and mentor enquiries. When you apply to volunteer we collect your name, email address, telephone number, the area of interest you select, and the content of your message.
3. Newsletter subscriptions. When you subscribe to updates we collect your email address.
4. Science Fair project registration. When a project is registered we collect the student’s name, gender, age, class or stream, school, district and region; the student’s email address and telephone number; a parent or guardian’s contact details; the names of the supervising teacher or mentor and the head teacher; and details of the project itself, including its title, category, type, keywords, duration, team size and summary. Section 7 explains how we treat this information.
5. Donations. When you make a donation we collect your name and email address, together with the amount, currency and frequency of the gift. Payment card details are collected and processed by our payment processor and are never received or stored by us — see section 8.
6. Other correspondence. If you email, telephone or write to us, we keep a record of that correspondence and of our response.

4.2 Information collected automatically

Our web servers and hosting provider automatically record technical information when the Site is accessed. This ordinarily includes your Internet Protocol (IP) address, the date and time of the request, the page or file requested, the referring page, and your browser and operating system type. These records are generated as part of operating and securing any website and are used for the purposes described in section 5(f).

The Site does not use third-party advertising networks, behavioural advertising trackers, or third-party web analytics services. Section 15 describes the limited use of cookies and similar storage.

4.3 Information from third parties

Our payment processor confirms to us the outcome of a donation and returns the donor name, email address and gift details necessary to acknowledge and receipt the gift. Where you reach us through a social media platform, we receive the information that platform makes available to us in accordance with its own terms and your settings on it.

We use personal information for the following purposes:

1. To respond to you. To answer enquiries, volunteer applications, partnership proposals and other correspondence.
2. To administer our programmes. To register, assess, organise and run competitions, scholarships, mentorship placements and other programmes, and to communicate with participants, schools, teachers, mentors and guardians about them.
3. To process and acknowledge donations. To take payment, issue receipts and acknowledgements, keep the records required of a tax-exempt organisation, and administer recurring gifts.
4. To send updates you have asked for. To send newsletters and programme updates where you have subscribed, until you unsubscribe.
5. To report on our work. To prepare aggregated and de-identified statistics for donors, partners, funders and the public. We do not identify individuals in these reports without their consent (and, for a minor, the consent of a parent, guardian or school as described in section 7).
6. To operate, secure and improve the Site. To keep the Site available, diagnose faults, detect and prevent fraud, abuse and unauthorised access, and improve how the Site works.
7. To comply with law. To meet our legal, regulatory, tax, audit and reporting obligations, and to establish, exercise or defend legal claims.

We do not sell personal information, and we do not share personal information with third parties for their own direct marketing or for cross-context behavioural advertising.

Where data protection law requires us to identify a legal basis for processing (including under the EU and UK General Data Protection Regulation, and Uganda’s Data Protection and Privacy Act, 2019, to the extent either applies to us), we rely on the following:

1. Consent — for newsletter subscriptions, for optional information you choose to give us, and for any use of a photograph or testimonial identifying you. You may withdraw consent at any time, without affecting processing already carried out.
2. Performance of a contract or steps taken at your request — for processing a donation, administering a scholarship or programme place, and responding to an enquiry you have initiated.
3. Legitimate interests — for operating and securing the Site, keeping records of our activities, preventing fraud and abuse, and reporting on our charitable work. We balance these interests against your rights and freedoms.
4. Legal obligation — for tax, accounting, audit and regulatory recordkeeping.

Parts of our work necessarily involve information about children. We treat that information as the most sensitive information we hold.

7.1 Registrations are made through a school

The Science Fair project registration form is designed to be completed by, or under the supervision of, a supervising teacher, mentor, head teacher, parent or guardian. The online form is one step only; a formal entry additionally requires a signed Proposal Workbook carrying a mentor’s evaluation, a head teacher’s endorsement and a school stamp. By submitting a registration, the person submitting it confirms that they are authorised to provide the student’s information and, where the student is under 18, that a parent, guardian or the student’s school has consented.

7.2 What we do with student information

We use student information only to administer the programme it was submitted for, to contact the student through the school, teacher or guardian contact provided, to judge and record entries, and to report on the programme in aggregate. We do not send marketing to a child and we do not condition participation on giving us more information than the programme requires.

7.3 No accounts for children

The Site does not offer accounts, profiles, messaging or public posting to children. No part of the Site invites a child to make personal information publicly available.

7.4 Guardian rights

A parent or guardian may ask us to confirm what information we hold about their child, to correct it, to stop further use of it, or to delete it. Deleting information may mean a registration can no longer be processed. Requests should be sent to info@jdiobestem.org and we may ask for proof of the relationship before acting.

7.5 Photography

Where we photograph or film at an event and a child is identifiable, we seek consent through the child’s school, parent or guardian before publishing the image. If an image of your child has been published and you want it removed, contact us and we will remove it from material we control.

Donations made through the Site are processed by Stripe, Inc. (“Stripe”), an independent payment processor. When you proceed to give, you are taken to a checkout page hosted by Stripe.

1. We never receive your card details. Card numbers, expiry dates and security codes are submitted directly to Stripe. They do not pass through, and are not stored on, our servers.
2. What we receive. Stripe confirms the result of the transaction and returns the donor name, email address, amount, currency and frequency, so that we can record and acknowledge the gift.
3. Stripe’s own role. Stripe processes your payment information as an independent controller under its own privacy policy, which we do not control. Please read it at stripe.com/privacy.

We disclose personal information only as set out below.

1. Service providers. To providers who process information on our behalf and on our instructions — our payment processor, hosting and database providers, and email delivery providers. They are permitted to use the information only to provide those services to us.
2. Programme partners. To schools, universities, partner organisations, mentors and judges, where necessary to run a programme a person has entered, and limited to the information that programme requires.
3. Professional advisers. To our auditors, accountants, insurers and lawyers, where required for them to advise us.
4. Legal and safety disclosures. Where we are required to do so by law, court order, or a lawful request by a public authority; or where disclosure is reasonably necessary to enforce our terms, to protect the rights, property or safety of the Foundation, our participants (including a child at risk of harm) or the public, or to investigate fraud or a security incident.
5. Organisational changes. In connection with a merger, affiliation, reorganisation or transfer of the Foundation’s assets or programmes, subject to the recipient continuing to honour this Policy.
6. With your consent. For any other disclosure, on your instruction or with your consent.

We do not sell or rent personal information.

We keep personal information only for as long as it is needed for the purpose it was collected for, and then for any further period required by law. In practice:

1. Enquiries and volunteer applications — for the duration of the correspondence and for a reasonable period afterwards, so that we can pick up a conversation where it left off.
2. Newsletter subscriptions — until you unsubscribe, after which we retain a suppression record so that we do not contact you again in error.
3. Programme and competition records — for the programme cycle and for as long as needed to administer alumni relationships, verify awards, and report to funders.
4. Donation records — for the period required by tax and charity recordkeeping obligations applicable to a 501(c)(3) organisation.
5. Server and security logs — for a short operational period, unless retained longer for the investigation of a specific incident.

When information is no longer needed we delete it or de-identify it so that it can no longer be linked to you.

We maintain administrative, technical and physical safeguards designed to protect personal information against loss, misuse, and unauthorised access, disclosure, alteration or destruction. These include transmission of the Site over encrypted connections (HTTPS), access controls limiting staff access to what their role requires, authentication tokens held in cookies that scripts on the page cannot read, and keeping payment card data entirely outside our systems.

No method of transmission over the internet and no method of electronic storage is completely secure. While we work to protect your information, we cannot guarantee its absolute security. Please do not send us sensitive information by email. If we become aware of a breach of security affecting your personal information, we will notify you and any regulator to the extent required by applicable law.

Depending on where you live, you may have some or all of the following rights in respect of your personal information:

1. Access — to be told whether we hold personal information about you and to receive a copy of it.
2. Correction — to have inaccurate or incomplete information corrected.
3. Deletion — to have your information deleted, where we have no overriding obligation or legitimate ground to keep it.
4. Restriction and objection — to ask us to limit how we use your information, or to object to processing carried out on the basis of legitimate interests.
5. Portability — to receive information you gave us in a structured, commonly used, machine-readable format.
6. Withdrawal of consent — to withdraw consent at any time where we rely on it.
7. Non-discrimination — not to receive discriminatory treatment for exercising any of these rights.

12.1 How to exercise a right

Send your request to info@jdiobestem.org. We will acknowledge it and respond within the period required by the law that applies to you. We may need to verify your identity before acting, and we may decline a request where an exemption applies — in which case we will explain why. An authorised agent may make a request on your behalf with proof of authorisation.

12.2 Complaints

If you are unhappy with our response you may complain to your local data protection or privacy regulator. We would appreciate the chance to address your concern first.

Every newsletter and bulk update we send carries an unsubscribe link, and unsubscribing takes effect promptly. You may also unsubscribe by emailing info@jdiobestem.org.

Unsubscribing does not stop administrative messages we must send you — for example, a donation receipt, a reply to your enquiry, a notice about a programme you have entered, or a change to this Policy.

The Foundation is based in the United States and delivers programmes in Uganda and South Sudan. Personal information you give us may therefore be transferred to, stored in, and processed in the United States, Uganda, South Sudan, or any other country in which we or our service providers operate.

The data protection laws of these countries may differ from those of your own country and may offer a different level of protection. Where we transfer personal information out of a jurisdiction that restricts such transfers, we take steps required by that law to protect it, which may include standard contractual clauses or obtaining your consent.

A cookie is a small text file stored on your device by your browser. The Site uses cookies and similar browser storage only where they are necessary for it to function:

1. Authentication. Staff signing in to the Foundation’s administrative area receive a session cookie. It is marked httpOnly, so no script running on the page can read it. It is not set for ordinary visitors.
2. Local browser storage. A small amount of data may be stored in your browser to remember a setting between visits. It stays on your device and is not transmitted to us.
3. Payment. Our payment processor sets cookies on its own checkout pages for fraud prevention and to operate the checkout, governed by its privacy policy.

We do not use advertising cookies, cross-site tracking pixels, or third-party analytics cookies. You can block or delete cookies in your browser settings, though blocking necessary cookies may prevent parts of the Site from working.

Because we do not track visitors across third-party websites, we do not respond differently to a “Do Not Track” browser signal.

The Site links to websites and services operated by others, including partner organisations, social media platforms and our payment processor. We do not control those sites and are not responsible for their content or their privacy practices. This Policy does not apply to them. Please read the privacy policy of any site you visit from ours.

We may update this Policy from time to time to reflect changes to our practices, our services, or the law. When we do, we will revise the “Last updated” date at the top of this page. Where a change is material, we will provide a more prominent notice, which may include emailing subscribers. Your continued use of the Site after a change takes effect means you accept the revised Policy.

Questions, requests and complaints about this Policy or about your personal information should be addressed to:

See also our Terms of Use, which govern your use of the Site.