Privacy Policy

River Lantern Yard Consulting Ltd ("we", "our", or "the Company") is a coaching and consulting firm incorporated in Uganda and headquartered at Plot 56 Lumumba Avenue, Kampala, Uganda. We provide leadership development, executive coaching, organisational consulting, mentoring programmes, and related professional services to individuals and organisations primarily in East Africa.

This Privacy Policy ("Policy") governs the collection, use, storage, disclosure, and protection of personal data that we obtain through:

• Our website at www.riverlanternyard.info and any associated subdomains or digital properties;
• Direct service engagements, coaching relationships, and consulting contracts;
• Events, webinars, retreats, and other programmes we organise or co-host;
• Communications via email, telephone, social media, or in person;
• Third-party referrals, partner organisations, and publicly available professional directories.

This Policy applies to all individuals whose personal data we process, including website visitors, prospective clients, programme participants, coaches, consultants, employees, and partner representatives. It does not apply to personal data collected by third-party websites that may be linked from our own — we encourage you to review the privacy policies of any external sites you visit.

We collect personal data in several ways and across several categories, depending on how you interact with us.

2.1 Personal Data You Provide Directly

When you contact us, register for a programme, engage our services, or communicate with us, you may provide:

• Identity data: Full name, professional title, job role, employer or organisation name;
• Contact data: Email address, telephone number, postal address, country of residence;
• Professional data: Work experience, qualifications, career history, sector, and professional goals — provided in the context of coaching intake forms or consultancy onboarding;
• Financial data: Billing address, invoice details, and payment method information (processed via secure third-party payment gateways — we do not store full card details);
• Communications data: Records of your correspondence with us, including emails, enquiry forms, and feedback submissions;
• Sensitive personal data: In some coaching contexts, you may voluntarily share information about health, wellbeing, family circumstances, or other sensitive matters. This data is treated with the highest level of confidentiality and is used solely to inform your coaching support.

2.2 Usage Data Collected Automatically

When you visit our website, we automatically collect certain technical information through our web servers and analytics tools, including:

• IP address and approximate geographic location (country/city level);
• Browser type, operating system, and device type;
• Pages visited, time spent on each page, and navigation paths;
• Referral source (e.g., the website or search engine that directed you to us);
• Date and time of access, and session duration;
• Error logs and performance data.

2.3 Data from Third Parties

We may receive personal data about you from:

• Corporate clients who nominate employees for coaching or development programmes;
• Partner organisations and referral networks;
• Professional networking platforms such as LinkedIn, where information is publicly available;
• Research providers who assist us in understanding our sector and audience.

2.4 Cookie & Tracking Data

We use cookies and similar tracking technologies to operate our website and improve your experience. Please see Section 8 (Cookies Policy) for full details.

We use the personal data we collect for the following purposes:

We will not use your personal data for purposes that are incompatible with those listed above without first informing you and, where required, obtaining your consent.

Under the Uganda Data Protection and Privacy Act, 2019 (DPPA), we are required to have a lawful basis for every processing activity involving personal data. We rely on one or more of the following bases:

4.1 Consent (Section 3, DPPA)

Where we process personal data based on your consent, we will ask for your explicit agreement before doing so — for example, when subscribing you to our newsletter, or when processing sensitive personal data shared in a coaching context. You have the right to withdraw consent at any time by contacting us at contact@riverlanternyard.info.

4.2 Contract Performance

We process personal data where it is necessary to enter into or perform a contract with you, including processing data to deliver coaching or consulting services you have engaged us to provide.

4.3 Legitimate Interests

We may process personal data where it is in our legitimate business interests and those interests are not outweighed by your rights and interests. This includes improving our services, communicating with former clients about relevant offerings, and managing our business operations. We carry out a legitimate interests assessment ("LIA") for any processing on this basis.

4.4 Legal Obligation

In some cases, we are required by law to collect or retain personal data — for example, for tax, accounting, employment, or regulatory compliance purposes.

4.5 Vital Interests

In exceptional circumstances, we may process personal data to protect the vital interests of you or another individual — for example, in a safeguarding situation during an in-person retreat or event.

We do not sell, rent, or trade your personal data to any third party. We share personal data only in the following circumstances:

5.1 Service Providers

We engage a limited number of trusted third-party service providers who process data on our behalf and under our instruction. These include:

• Cloud storage and IT infrastructure providers — for secure hosting of our systems and client records;
• Payment processors — for the secure processing of financial transactions;
• Email and communication platforms — for delivering newsletters and programme-related correspondence;
• Video conferencing tools — for virtual coaching sessions and webinars;
• Accounting and payroll software — for financial administration;
• Assessment and psychometric tool providers — for delivering validated assessments within our programmes.

All service providers are bound by data processing agreements that require them to maintain appropriate security standards and prohibit them from using your data for their own purposes.

5.2 Corporate Client Reporting

Where you participate in a programme commissioned by your employer or another organisation, we may share progress reports or aggregated feedback with that commissioning organisation. Such sharing is governed by our contract with the client organisation and the terms disclosed to you at programme intake. We will never share the specific content of confidential coaching conversations with any third party, including your employer, without your explicit consent.

5.3 Legal Requirements

We may disclose personal data to law enforcement agencies, regulatory authorities, or courts where required to do so by applicable Ugandan or international law, or where we believe disclosure is necessary to protect the safety of any individual or to prevent fraud.

5.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of our business, personal data held by us may be transferred to the successor entity. We will provide notice of such a transfer and ensure that appropriate data protection obligations are maintained.

5.5 Affiliated Partners

We work with associate coaches and consultants who support delivery of our programmes under sub-contracting arrangements. These individuals are bound by confidentiality agreements and data processing obligations consistent with this Policy.

We retain personal data for only as long as is necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

At the end of the relevant retention period, personal data is securely deleted or anonymised in accordance with our Data Retention and Disposal Policy. Where anonymisation is not technically feasible, data is pseudonymised and access is strictly restricted.

Under the Uganda Data Protection and Privacy Act, 2019, and subject to applicable exemptions, you have the following rights in relation to your personal data:

1. Right of Access: You have the right to request a copy of the personal data we hold about you, together with information about how we process it (a Subject Access Request or "SAR").
2. Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you without undue delay.
3. Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent on which processing was based, among other grounds.
4. Right to Restrict Processing: In certain circumstances, you may ask us to suspend processing your personal data — for example, while you contest its accuracy.
5. Right to Data Portability: Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.
6. Right to Object: You have the right to object to processing based on our legitimate interests, and you always have the right to object to processing for direct marketing purposes.
7. Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
8. Right not to be Subject to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

To exercise any of these rights, please contact our Data Privacy Officer using the details in Section 13. We will respond to your request within 21 days of receipt, or within 30 days where the request is complex or numerous. We will not charge a fee for reasonable requests, though we reserve the right to charge a reasonable fee for manifestly unfounded or excessive requests.

If you are not satisfied with our response, you have the right to lodge a complaint with the National Information Technology Authority — Uganda (NITA-U), the supervisory authority responsible for data protection enforcement in Uganda.

Our website uses cookies and similar tracking technologies to enable core website functionality, enhance your browsing experience, and help us understand how visitors use our site. A cookie is a small text file that is placed on your device by a website you visit.

8.1 Types of Cookies We Use

8.2 Third-Party Cookies

We may embed content from third-party services on our website (such as embedded videos, social media share buttons, or map integrations). These third parties may set their own cookies when you interact with their content. We do not control these cookies and recommend reviewing the privacy policies of those third parties directly.

8.3 Managing Your Cookie Preferences

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept all cookies, reject non-essential cookies, or customise your preferences by category. You can update your preferences at any time by clicking the "Cookie Settings" link in our website footer.

You may also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. Most browsers offer guidance on managing cookies in their help sections.

8.4 Do Not Track

Some browsers include a "Do Not Track" (DNT) feature. Our website currently does not respond to DNT signals, but we honour your cookie consent choices made on our site as described above.

We take the security of your personal data seriously and implement a range of technical and organisational measures to protect it against accidental loss, unauthorised access, alteration, disclosure, or destruction.

9.1 Technical Measures

• All data transmission between your browser and our website is encrypted using TLS (Transport Layer Security) protocol;
• Sensitive personal data and financial records are stored using AES-256 encryption at rest;
• Access to personal data systems is protected by multi-factor authentication (MFA) and role-based access controls;
• Our cloud infrastructure is hosted on ISO 27001-certified data centres;
• We conduct regular vulnerability scans and penetration testing of our systems;
• Automatic session timeouts and audit logging are applied to all access to client records.

9.2 Organisational Measures

• All staff and associates who handle personal data receive regular data protection training;
• We maintain a Data Protection Policy and Information Security Policy, reviewed annually;
• Access to personal data is restricted on a strict need-to-know basis;
• Coaches are bound by professional codes of ethics including confidentiality obligations under ICF standards;
• We have a documented Data Breach Response Plan to ensure rapid detection, containment, and notification in the event of an incident.

9.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (NITA-U) without undue delay and, where the breach is likely to result in high risk to you, we will notify you directly using the most expedient means available.

River Lantern Yard Consulting Ltd is based in Uganda, and the majority of our data processing activities occur within Uganda and East Africa. However, some of our service providers (particularly cloud hosting, email, and video conferencing platforms) may process data on servers located outside Uganda.

Where personal data is transferred outside Uganda to countries that may not provide an equivalent level of data protection, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs): We implement data transfer agreements that include standard contractual clauses approved by relevant supervisory authorities, requiring the recipient to protect personal data to the standards required under Ugandan and international law;
• Adequacy Decisions: Where transfers are to countries that have been recognised as providing adequate data protection (e.g., EU/EEA member states, the United Kingdom), we rely on those adequacy determinations;
• Consent: In some limited circumstances, we may seek your explicit informed consent for specific international transfers where no other safeguard applies.

By engaging our services, you acknowledge that your personal data may be transferred to and processed in countries outside Uganda, including countries within the East African Community, the European Union, the United States, and other jurisdictions where our service providers operate. We ensure that all such transfers are conducted in accordance with applicable law and that your data remains protected throughout.

Our services are designed for working professionals, business leaders, and organisational teams. We do not knowingly collect, process, or hold personal data relating to children under the age of 18.

Our website is not directed at children under 18 and we do not knowingly allow individuals under 18 to register for accounts, submit enquiry forms, or participate in our programmes. If we become aware that we have inadvertently collected personal data from a person under 18 without appropriate parental or guardian consent, we will take immediate steps to delete that information from our records.

If you believe that we may have collected personal data from a minor, please contact us immediately at contact@riverlanternyard.info and we will investigate and act without delay.

Exceptionally, where a client organisation runs a graduate or early careers programme and nominates participants under the age of 18, we will obtain appropriate consent from a parent or legal guardian before engaging with that participant and will apply additional safeguards to the processing of their data.

We review this Privacy Policy at least annually and whenever significant changes occur in our business operations, legal landscape, or data processing activities. Any material changes will be:

• Published on this page with an updated "Last Updated" date;
• Notified to existing clients and newsletter subscribers via email where required by law or where the changes materially affect how we process their data;
• Brought to the attention of website visitors through a prominent notice on our homepage for a period of at least 30 days following any significant revision.

If you continue to use our services or website after a change to this Policy has been published, your continued use will constitute acceptance of the revised Policy to the extent permitted by applicable law. Where the changes require your consent, we will seek fresh consent before the changes take effect.

We maintain an archive of previous versions of this Privacy Policy. You may request access to a prior version by contacting us at the address below.

River Lantern Yard Consulting Ltd is the Data Controller responsible for your personal data. We have appointed a Data Privacy Officer (DPO) who is responsible for overseeing our compliance with data protection law and can be contacted with any queries, requests, or concerns relating to this Policy or our data processing activities.

If you have questions about this Privacy Policy, wish to exercise your rights, report a concern, or request further information about our data practices, please contact us using any of the methods below:

If you are not satisfied with our handling of your enquiry or request, you may also contact the supervisory authority: