Privacy Policy

1. Who we are and which laws apply

Harvest Bible University ("HBU", "we", "us", "our") is a theological institution based in Kampala, Uganda, operating in affiliation with Harvest Bible University, Los Angeles, and run by Harvest Teaching Ministries. We are the data controller for the personal data described here: we decide why and how it is used.

This policy covers this website, our online application, the student and staff portal, and any service that links to it, wherever in the world you use it. Our home law is Uganda's Data Protection and Privacy Act (Cap. 97, first enacted in 2019) and its 2021 Regulations, supervised by the Personal Data Protection Office (PDPO). Because our students and applicants come from many countries, section 12 also sets out the extra rights you have under the laws of other places. Where a law gives you a stronger right than this policy, that law controls.

2. What we collect at each stage, and why

We only ask for what that stage needs. Here is the full journey:

• Visiting the website. Your IP address and browser details are logged by our servers for security and fault-finding. We use two strictly necessary cookies and nothing for advertising or tracking (see the Cookie Policy). Basis: our legitimate interest in keeping the service secure.
• Sending an enquiry. Your name, email and message, which our staff read in order to reply. Basis: your request. Kept for up to 2 years after the enquiry is closed.
• Applying. Full name, date of birth, gender, nationality, country of residence, phone, email, postal address, prior education, programme and study-mode choice, the name of your local church and pastor, and documents you upload (passport photo, ID or passport, certificates, recommendation letters). Supplying the form details is required to assess you; refusing means we cannot process the application. Basis: your consent and steps you ask us to take before enrolling you.
• Being admitted and enrolled. We create your portal login, registration number and academic record, and send you notices by email and SMS. Basis: our contract with you as a student.
• First sign-in or profile completion. If you were registered by us rather than through the online form, we ask you to confirm the same biographical details, and we record the date and the version of this policy you agreed to.
• Studying and sitting exams. Course registrations, marks, grades and progress. During online exams we also record your answers, start and submit times, IP address, browser and device details, and whether the exam window lost focus, to protect the integrity of results. This is reviewed by staff; it never fails you automatically. Practical ICT exams are delivered by a partner ICT assessment platform, to which we send only what is needed to identify you for that sitting, and which sends your score back. Basis: our contract with you and our legitimate interest in fair assessment.
• Paying fees. Invoices, amounts, dates and transaction references. Card and mobile-money details are handled by our payment processor (Pesapal); we never see or store your card number or PIN. Basis: contract and legal accounting duties.
• Asking for help. Helpdesk tickets, correction requests and replies, plus anything you attach.
• Graduating and afterwards. Transcripts, certificates and testimonials. Each carries a QR code and link; anyone who opens it can see the document's details (your name, programme and award) to confirm it is genuine. Alumni records are kept so you can always prove your qualification.
• Staff and lecturers. Contact details, role, attendance, payroll and payslip information, and records of the actions you take in the system. A separate staff confidentiality undertaking applies.
• Public pages. Photos and names of Guild Council members are published only with the person's agreement.

3. Sensitive information

Under Ugandan law, information about religious belief and financial information is sensitive. The name of your church and pastor reveals your religious affiliation, and your fee payments are financial information. We collect them only because you give them freely and consent (or, for fee records, because they are needed to run your account), we use them only for the purpose you gave them, and we do not disclose them to anyone outside the institution except as section 5 describes. We do not collect health, political or biometric data.

4. Automated processing

Grades are calculated by the system from the marks entered by your lecturers, and the system checks whether you have met the unit, fee and other requirements for progression and graduation. These checks are always open to human review: if you believe a result or an eligibility outcome is wrong, raise a correction request or a Privacy request on the Helpdesk and a member of staff will reconsider it (and, where the law gives you the right, within the time it sets).

5. Who we share it with

We do not sell your personal data. We share it only as needed, and only with:

• Service providers acting on our instructions and bound by confidentiality: our payment processor (Pesapal), our SMS provider (EgoSMS), our transactional email provider (Brevo), our hosting provider, and the partner ICT assessment platform described above.
• Harvest Teaching Ministries and, for academic affiliation, Harvest Bible University, Los Angeles.
• Regulators, accreditation bodies and authorities, where Ugandan law or a valid legal process requires it.
• People you ask us to share with, such as a sponsoring church or employer, or someone you give your document-verification link.

6. Sending data outside Uganda

Some of the providers above store or process data on servers outside Uganda (for example email delivery, hosting and payments). Ugandan law allows this only where the destination protects personal data to at least an equivalent standard, or where you have consented. We choose providers with contractual and technical protections, and by ticking the consent box when you apply (or complete your profile) you agree to this transfer. You may withdraw consent, but we then may not be able to continue providing an online account.

7. How long we keep it

• Academic records (registration, results, transcripts, certificates): kept permanently. Graduates need to prove their qualification for life, and the law allows retention for historical purposes.
• Unsuccessful or abandoned applications and their documents: up to 2 years after the decision, then deleted or anonymised.
• Financial records (invoices, payments, payroll): at least 7 years, then deleted.
• Exam integrity logs (IP, device, focus events): up to 2 years after the results are released, so that disputes can be resolved.
• Helpdesk tickets and enquiries: up to 2 years after closing.
• Security and audit logs: up to 7 years.

When a retention period ends, data is deleted or de-identified so that it cannot be reconstructed. Where the law requires us to keep a record, a deletion request cannot override it, and we will tell you why.

8. Your rights, and how to use them

Subject to the law that applies to you, you may:

• ask whether we hold data about you, get a description and a copy of it, and learn who has had access to it (we answer within 30 days);
• have inaccurate, incomplete, misleading or out-of-date data corrected, or data we no longer have authority to keep deleted;
• object to, or ask us to stop, processing that causes you unwarranted damage or distress, or stop using your data for direct marketing (we answer within 14 days);
• ask for a human to reconsider a decision made only by automated means (we answer within 21 days);
• withdraw consent at any time, where we rely on consent (this does not undo what was lawfully done before);
• claim compensation through the courts if a breach of the law causes you damage or distress.

To make a request: sign in and raise a Helpdesk ticket in the category Privacy request, or write to the contact in section 10. We will check your identity first (to protect you from someone else asking for your data), will not charge for a reasonable request, and will tell you if we cannot comply and why.

9. Children

Our programmes are for adults. In Uganda a child is anyone under 18, and we do not knowingly collect a child's data without the prior consent of a parent or guardian. If you are under 18 you must have a parent or guardian contact us before applying. If you believe a child has given us data without that consent, tell us and we will deal with it.

10. Security, breaches and our contact point

We protect your data with encrypted connections (HTTPS), role-based access so staff see only what their job needs, private storage for uploaded documents, activity logging and regular backups. No system is perfectly secure. If personal data is accessed by someone without authority, we notify the PDPO immediately and tell affected people as the PDPO directs, or sooner where the risk to you is serious.

Data Protection Officer: info@harvestbibleuniversity.org.
Harvest Bible University
P.O. Box 104211, Kampala, Uganda
Email: info@harvestbibleuniversity.org
Phone: 0702843584

11. Complaints

Please contact us first and we will do our best to put things right. You also have the right to complain to the Personal Data Protection Office, Plot 32 Lumumba Avenue, Kampala, Uganda (pdpo.go.ug), or to the data protection authority where you live (section 12).

12. If you live outside Uganda

We apply the same protections to everyone. In addition, where these laws apply to you, you also have the rights they give:

• European Union and United Kingdom (GDPR / UK GDPR): access, rectification, erasure, restriction, portability of data you gave us, and objection; the right to withdraw consent; and the right to complain to your national supervisory authority (in the UK, the Information Commissioner's Office). Our legal bases are listed in section 2 (consent, contract, legal obligation and legitimate interests). Transfers to Uganda and other countries rely on your consent and the safeguards in section 6.
• Kenya (Data Protection Act, 2019), Tanzania (Personal Data Protection Act, 2022), Rwanda (Law No. 058/2021), Nigeria (Data Protection Act, 2023), Ghana (Data Protection Act, 2012) and South Africa (POPIA): the rights to be informed, to access, correct and delete, to object, and to complain to your national regulator (respectively the Office of the Data Protection Commissioner, the Personal Data Protection Commission, the National Cyber Security Authority, the Nigeria Data Protection Commission, the Data Protection Commission, and the Information Regulator).
• United States, Canada and Australia: we do not sell or share personal data for advertising. You may ask us to access or correct your data, and complain to your regulator (in Canada the Office of the Privacy Commissioner; in Australia the OAIC).

13. Changes to this policy

We will update this policy when our systems or the law change. The version and date at the top show the current text. Where a change needs your fresh consent, we will ask for it the next time you sign in; we keep a record of the version you agreed to.