MMCP eLearning Platform

1. Introduction

Mbale Municipality Community Polytechnic ("MMCP," "we," "us") operates an eLearning platform used by trainees, instructors, Training of Trainers (ToTs), and administrative staff as part of the Uganda eLearning Initiative. This Policy explains what personal data the platform collects, why, how it is protected, and the rights you have over it. It applies whenever you create an account, log in, or otherwise use the platform, whether through a web browser or a mobile app.

2. Who We Are

MMCP is the Data Controller for personal data processed through the eLearning platform — we decide why and how your data is used. Cyber School Technology Solutions (CSTS) acts as our Data Processor, providing the technical infrastructure, hosting, and support for the platform under the Uganda eLearning Initiative, delivered in partnership with the Mastercard Foundation.

[Insert MMCP's registered address / physical location]

3. Information We Collect

3.1 Account & enrollment information

• Full name, email address and/or phone number, username, and password (stored in encrypted/hashed form)
• Student or staff ID, programme/course enrolled, and role on the platform (trainee, instructor, ToT, M&E focal person, safeguarding focal person, administrator)

3.2 Learning activity data

• Course access history, assignment and quiz submissions, grades, and completion status
• Progress and interaction data recorded by SCORM/xAPI-based course content packages
• Forum posts, messages, and other content you submit within courses
• Certificates issued on completion of training

3.3 Technical & usage data

• IP address, device and browser type, and login/session timestamps
• Site activity logs, including the data summarized in periodic reports (such as the Monthly Activity Completion Report) used to monitor training progress across the platform

3.4 Communications

• Messages you send through the platform's messaging or support features, and any records of help-desk or support requests

4. How We Use Your Information

• To create and administer your account and give you access to the courses you're enrolled in
• To track training progress, grade coursework, and issue certificates
• To compile monitoring & evaluation (M&E) reports — including activity-completion reporting — for CSTS and the Mastercard Foundation, generally in aggregate or de-identified form
• To maintain the security of the platform, prevent misuse, and diagnose technical or connectivity issues
• To communicate important notices about your course or account
• To meet reporting obligations under the Initiative's institutional MoU

5. Legal Basis for Processing

Under the Data Protection and Privacy Act, 2019, we process your data on one or more of the following bases:

• Consent — given when you register on the platform (and, for minors, by a parent or guardian)
• Performance of your training enrollment — processing necessary to deliver the course or programme you have joined
• Legitimate interest — administering and securing the platform
• Legal obligation — where reporting or record-keeping is required by law or by the Initiative's MoU

6. Who We Share Information With

• Instructors and institutional administrators, for grading, support, and academic administration
• CSTS, as the technical implementing partner responsible for hosting and maintaining the platform
• The Mastercard Foundation, for programme monitoring and evaluation — typically aggregate or de-identified data
• [Insert any cloud/server hosting provider name, if data is stored off-site]
• Ugandan authorities, where disclosure is required by law or a valid legal request

We do not sell personal data, and we do not share it with third parties for marketing purposes.

7. Children and Minors

Some trainees on the platform may be under 18 years of age. Where this is the case, we obtain consent from a parent or guardian before an account is created, in line with the minors' consent provisions of the Data Protection and Privacy Act, 2019, and we apply extra care in how their data is handled and disclosed.

Any concern about a minor's welfare or safety — as distinct from a data-privacy question — should be raised with the institution's safeguarding focal person in addition to, or instead of, the privacy contact in Section 13.

8. Storage, Security & Retention

• Storage location: [Insert server/hosting location]
• Security measures: encrypted/hashed passwords, role-based access permissions within the LMS, restricted administrator access, and regular backups
• Retention: account and academic records are kept for the duration of your enrollment plus [Insert retention period, e.g. 5 years] to support certificate verification and Initiative reporting requirements, after which data is securely deleted or anonymized
• Any transfer of data outside Uganda is carried out only with safeguards consistent with the Data Protection and Privacy Act, 2019

9. Your Rights Under Ugandan Law

The Data Protection and Privacy Act, 2019 gives you the following rights over your personal data:

To exercise any of these rights, contact us using the details in Section 13. If your concern isn't resolved, you may escalate it to the PDPO at NITA-U.

10. Cookies & Similar Technologies

The platform uses essential session cookies to keep you logged in and to remember your preferences while you use the site. These are required for the platform to function and are not used for third-party advertising or tracking. [Update this section if analytics or additional tracking tools are added]

11. Data Breaches

If a breach occurs that is likely to affect your personal data, we will notify affected users and the PDPO at NITA-U, in line with the breach-notification requirements of the Data Protection and Privacy Regulations, 2021.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes to the platform or to the law. The "Effective date" at the top of this page will be updated accordingly, and we will let you know about any material changes.

13. Contact Us

To ask a question, exercise a data-protection right, or raise a concern about this Policy, contact: