Privacy notice

NBOOG Collective Welfare ("NBOOG", "we") operates this member portal for savings, welfare, loans, attendance, and related committee administration. We act as a data controller for member and officer personal data processed through the portal.

Depending on your role, we may process:

• Identity and membership data (name, member number, status)
• Contact details (email you provide for notices and recovery)
• Authentication data (login credentials; passwords are stored only as a hash)
• Financial ledger entries (savings, welfare, loans, penalties, repayments)
• Attendance and fine records
• Guarantor and loan-agreement records
• Audit and security logs (role actions, login rate limits, recovery events)

We process data to:

• Perform membership and welfare administration (contract / membership rules)
• Keep accurate financial and attendance records for the collective
• Secure the portal (fraud prevention, abuse detection, audit)
• Send operational emails (login invites, password reset, email verification, chair-assisted recovery)
• Comply with applicable law and respond to lawful requests

Under Uganda's Data Protection and Privacy Act, Cap. 97 (DPPA), processing is limited to adequate, relevant, and not excessive data for these purposes. Where consent is required (for example, optional contact email for recovery), we ask you to provide it and you may update or revoke it through Settings or the General Secretary where appropriate.

NBOOG is the data controller. The controller decides why member and officer data is processed.

Some of that work is done by processors. A processor handles data only on NBOOG's instructions. A processor is not the controller and does not decide membership, office, balances, loans, attendance, or who may sign in. A processor is not a party to those decisions.

The categories of recipients are:

• a sign-in and database host
• a website host
• an email delivery service
• a security check on the member password-reset form

Member data is stored outside Uganda, in the European Union. Section 19 of the Data Protection and Privacy Act allows that where the place of storage has protection at least equivalent to the Act, or the member has been informed. Using the portal for membership is that notice.

The names of those recipients are not published on this page. A member may ask the General Secretary for them. The committee keeps the processor contracts and the list used for registration with the Personal Data Protection Office. Those records are not published here.

A question about a balance, a role, or a member record goes to the General Secretary. A complaint under the Act may also go to the Personal Data Protection Office.

After a successful sign-in, we may email a security notice to your verified contact address (members) or officer login email (admins). The notice includes time, approximate network, and device type. It never includes your password. This supports account-takeover awareness (OWASP-style secure notifications) and is processed for security of the portal under Uganda DPPA principles.

Financial and membership history is retained for the life of the collective's accounting and dispute needs, including after a member is soft-deactivated (records stay; portal login is revoked). Authentication tokens and email verification tokens expire automatically. Security audit rows are retained for accountability.

Subject to the DPPA and membership rules, you may request access, correction of inaccurate data, restriction of certain processing, and objection where the Act allows. Ledger integrity may limit erasure of historical transactions; instead we may annotate, correct via controlled workflows, or deactivate access. Contact the General Secretary or designated data protection contact for the collective. You may also complain to the Personal Data Protection Office (PDPO) of Uganda.

We apply role-based access, encrypted transport (HTTPS / TLS) to our processors, database row level security, session timeouts, rate limits on sensitive auth actions, and audit logging. Transactional email is delivered through our email processor so that processor (and, where applicable, your mailbox provider) can process message content to deliver it. That is TLS and contractual safeguards, not end-to-end encryption that excludes those operators. No method of transmission or storage is perfectly secure; report suspected incidents to the Chairperson and Treasurer immediately.

The portal is for adult collective members and officers. It is not directed at children.

For privacy requests, contact the NBOOG General Secretary through the committee channels you already use for membership affairs, or write via the contact published on nboogcollective.com.