In this policy, “Nova Academy”, “we”, “us”, and “our” refer to the Nova Academy team that operates this website and delivers our programs. We are the data controller responsible for the personal information described here.

Our registered contact details are:

• coding@novageneration.tech
• +256 741 004 466
• Bandali Rise, Studio House, Level 4, Kampala, Uganda

We collect information in the following ways:

Information you give us directly

• Registration details when you sign up for a program: student name, age, email address, phone number, school, parent or guardian name and phone number, program and track, experience level, learning goals, mode of study, level, area of interest, location, laptop availability, payment preference, and any message or consent you provide.
• Contact form details when you send us a message: your name, email address, phone number, and message.
• Partnership inquiries from schools, organisations, and individuals: contact person, organisation name, email address, phone number, website, partnership type, preferred meeting date, and your message.
• Newsletter signups: the email address you subscribe with.
• Enrolment and payment records such as your student number, program fees, discounts, amounts paid, payment dates, and payment references.
• Correspondence when you email, call, or message us, including the content of those conversations.

Information collected automatically

• Technical information such as your IP address, browser type, device type, operating system, and approximate location derived from your IP address.
• Usage information such as the pages you visit, the links you click, and how long you spend on the site.
• Information collected through cookies and similar technologies, as explained in the cookies section below.

Information from other sources

We may receive information from schools, parents or guardians, partner organisations, and event or program partners where you have agreed to that sharing. We may also combine information you give us with records we already hold, for example to recognise a returning student.

We use personal information to:

• Process registrations, confirm places, assign student numbers, and manage enrolment.
• Deliver classes, bootcamps, clubs, and events, including communicating schedules, materials, and changes.
• Communicate with students, parents, guardians, and enquirers about programs, applications, and support requests.
• Manage fees, discounts, invoices, payments, and financial records.
• Issue certificates and maintain accurate student records.
• Keep our website, systems, and learners safe, and prevent fraud or misuse.
• Improve our programs, website, and services using aggregated and de-identified information.
• Send updates and marketing about programs and events where you have asked for them or where the law allows.
• Comply with legal obligations and respond to lawful requests from authorities.

We will not use your information for materially different purposes without telling you first and, where required, obtaining your consent.

Under the Data Protection and Privacy Act, 2019, we rely on one or more of the following bases, depending on the activity:

• Consent - for example, when you submit a form, subscribe to updates, or agree to photos being used at events.
• Contract - where processing is needed to provide a program you or your child has registered for.
• Legal obligation - for example, keeping financial records or responding to lawful requests.
• Legitimate interests - for example, improving our services, securing our systems, and communicating with prospective students, balanced against your rights.

Many of our learners are children and teenagers. We take extra care with their information:

• Registration for a learner under 18 must be made or approved by a parent or legal guardian.
• We collect parent or guardian names and phone numbers so we can communicate about the learner's participation.
• We only use children's information for the purposes described in this policy and do not use it for targeted advertising.
• We limit access to children's records to staff and instructors who need them to deliver our programs.
• If you believe a child's information was submitted to us without appropriate consent, contact us and we will delete it promptly.

We do not sell personal information. We share it only where needed, including with:

• Service providers who help us operate, such as website hosting, database, email delivery, and analytics providers. They may only use information to provide services to us.
• Instructors and program partners involved in delivering a program you have registered for.
• Schools and guardians where a program is delivered in partnership with a school or where a guardian is responsible for the learner.
• Professional advisers such as accountants, auditors, and lawyers, where necessary.
• Authorities where we are required by law, a court order, or a lawful request, or where necessary to protect someone's safety or our legal rights.
• A successor organisation if we merge, restructure, or transfer part of our operations, subject to this policy continuing to apply.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

Some of our service providers, such as email delivery and analytics providers, may process information outside Uganda. Where information is transferred across borders, we take reasonable steps to ensure it receives an adequate level of protection, consistent with Ugandan data protection law, and we limit transfers to what is necessary for the service.

We keep personal information only for as long as we need it for the purposes described in this policy:

• Registration and student records are kept while the learner is active with us and for a reasonable period afterwards so we can provide references, certificates, and continuing support.
• Financial and payment records are kept for the period required by Ugandan law, including tax and accounting requirements.
• Contact, partnership, and newsletter records are kept until the enquiry is resolved or you ask to be removed, unless we need to keep them for a legal reason.
• Website analytics data is kept in aggregated form and for the retention periods set by our analytics providers.

When information is no longer needed, we delete it or anonymise it securely.

We use reasonable technical and organisational measures to protect personal information, including:

• Encrypted connections (HTTPS) between your browser and our website.
• Access controls so that only authorised administrators and staff can view student and registration records.
• Hashed storage of administrator passwords.
• Ongoing review of our systems and service providers.

No method of transmission or storage is completely secure. If a data breach affects your information and poses a risk to your rights, we will notify you and the relevant authority as required by law.

Subject to applicable law, you have the right to:

• Be informed about how your personal information is used.
• Access the personal information we hold about you and request a copy.
• Correct inaccurate or incomplete information.
• Request deletion of information we no longer need or are not entitled to keep.
• Object to or request restriction of certain processing.
• Withdraw consent where processing is based on consent, without affecting processing that already took place.
• Lodge a complaint with the relevant authority.

To exercise any of these rights, contact us using the details below. We may need to verify your identity, and where the request concerns a child, we may need to confirm that you are the parent or guardian. We will respond within a reasonable period and in line with statutory timelines.

If you are not satisfied with our response, you can complain to Uganda's Personal Data Protection Office under the National Information Technology Authority (NITA-U).

We use cookies and similar technologies to keep the website working and to understand how it is used:

• Essential storage - remembering preferences such as light or dark mode. This is stored in your browser and is not used for advertising.
• Google Tag Manager - helps us manage analytics and marketing tags. Google may set cookies or collect device and usage information according to its own policies.
• Vercel Analytics - provides aggregated information about website traffic and performance.

When you first visit the website, a banner lets you accept all cookies or continue with essential cookies only. Analytics and tag management tools are loaded only after you accept; if you reject them, they stay off the page. You can change your choice at any time from our Cookie Policy.

You can block or delete cookies through your browser settings. Blocking some cookies may affect how parts of the website work. You can also use browser controls, ad settings, and provider opt-out tools to limit analytics.

For more detail, see our Cookie Policy.

Our website links to third-party sites and services, including social media platforms and partner websites. We are not responsible for their privacy practices. We encourage you to read the privacy policy of any site you visit.

We may update this policy from time to time to reflect changes in our practices, services, or the law. When we do, we will revise the “last updated” date at the top of this page. If the changes are significant, we will take reasonable steps to let affected people know, for example by email or a notice on the website.

If you have questions about this policy, want to exercise your rights, or have a privacy concern, please contact us: