Privacy notice

Who we are

Casita Orphans Foundation (“we”, “us”), a charity working in Uganda, is responsible for the personal information described here. We follow Uganda’s Data Protection and Privacy Act, 2019, and for visitors in the European Union and the United Kingdom, the GDPR.

For anything about your personal information, email or use our data request form.

What we collect and why

When you give

We record your name, email, phone number and country, the amount, what the gift is for and any message you add. We use them to process your gift, send your receipt, keep the accounts the law requires, and send you news about the work you support.

Card and mobile money details go straight to Pesapal, our payment provider. We never see or store them.

When you write to us

Forms send us what you type: usually your name, email, phone and message.

Sent automatically

With each form or gift your browser sends your IP address and browser type. We use them only to stop fraud and spam, and remove them after a short period.

Our legal basis

Processing your gift and receipt: needed to do what you asked.
Keeping accounts: required by law.
Protecting forms and payments from abuse: our legitimate interest.
Analytics: only if you allow analytics cookies.

We don’t sell or rent donor information, or use it for advertising.

Who we share it with

Only our own team sees donor and message details. Some service providers handle information for us, under our instructions:

Pesapal, which processes payments;
our website host and email provider;
Google, for analytics, only if you allow it;
Cloudflare, if a form uses its Turnstile check.

Some of these process information outside your country. Where they do, we rely on safeguards such as standard contractual clauses, as the law requires.

Children’s safety comes first: we show children’s photos only with their guardians’ consent, and never their dates of birth or exact whereabouts.

How long we keep it

We keep personal information only as long as we need it. These periods apply automatically:

Information	How long we keep it
Messages sent through our forms	24 months
Donations and sponsorships	7 years after your last gift, as tax law requires, then your name and contact details are removed. Amounts stay in our accounts.
Messages identified as spam	30 days
IP addresses and browser details sent with forms	30 days
Record of your cookie choice	24 months

Your rights

You can ask us to send you a copy of your information, correct it, delete it when we no longer need it, limit how we use it, or stop sending you updates. You can withdraw consent to analytics cookies with “Cookie settings” at the bottom of any page.

Use our data request form or email . We reply within one month, and it’s free.