PRIVACY POLICY

Last update: 27 August 2026

The purpose of this Privacy Policy is to explain how Njuyera Innovision Company Limited (trading as Sharp Island Lodge / Sharp Island Gorilla Lodge, hereinafter: “we”, “us” or “our”) processes personal data of visitors to the website www.sharpislandlodge.com (hereinafter: the “Website”). The protection of your personal data is important to us.

We process personal data in accordance with the Uganda Data Protection and Privacy Act, 2019 (DPPA) and its regulations. Because we offer accommodation and related services to visitors in the European Union, we also apply the EU General Data Protection Regulation (GDPR) where it applies to EU/EEA data subjects.

1. Data Controller Details

  • Company: Njuyera Innovision Company Limited
  • Trading name(s): Sharp Island Lodge / Sharp Island Gorilla Lodge
  • Registered address: Sharp Island on Lake Bunyonyi, Mukoni (Trading Center), Kabale (City), Ndorwa West (County), Rubaya (Sub-County), Kitooma (Parish), Mukoni (Village), Uganda
  • Company Registration Number: 80034131379850
  • Tax Identification Number (TIN): 1046394856
  • Email: infosharpisland@gmail.com
  • Phone: +256 785 142754
  • Website: www.sharpislandlodge.com

2. Data Processors

The IT background, hosting, server supervision and maintenance of the Website are provided by contracted technical partners (data processors). To ensure system security, the hosting provider and the technical operator may have access to technical data (such as log files) stored on the servers, solely for the purposes of hosting, security and maintenance.

Technical operator:

Hosting provider:

Personal data processed via the Website may be stored on Hostinger’s servers in the European Economic Area. Access by Boabo Webstudio from the United Kingdom is limited to technical operation. Such transfers are carried out for hosting and maintenance, with appropriate safeguards under the DPPA and, where applicable, the GDPR (including the EU–UK adequacy framework).

3. Purpose and Legal Basis of Data Processing

On this Website, we collect personal data primarily through the contact / booking enquiry form.

  • Purpose of data processing: Responding to enquiries, providing information about stays and activities, and professional communication prior to a possible booking.
  • Scope of processed data: Full name, e-mail address, selected stay type, number of guests, message content, and the record of your consent given via the form checkbox.
  • Legal basis: Your voluntary consent (DPPA; GDPR Article 6(1)(a)) and, where you request information with a view to a stay, taking steps at your request prior to entering into a contract (GDPR Article 6(1)(b)). We also have a legitimate interest in keeping records of business correspondence.
  • Duration of data processing: Until the purpose is achieved, or until you request deletion, unless a longer retention period is required by law or needed to establish, exercise or defend legal claims.

Bookings and payments: Guest reservations, payment processing and the collection of booking data (including payment details) are handled exclusively through Booking.com. This Website does not collect or store credit card numbers or home addresses for bookings. Booking.com is an independent data controller for that processing. We may receive limited information from Booking.com (for example guest name and stay dates) solely to fulfil the accommodation. In that case Booking.com remains the primary controller of the booking data, and we process the data we receive only to provide the stay.

4. Data Transfer and Marketing

  • Marketing: We do not use marketing tools on this Website. We do not employ Google Analytics (GA4), Google Tag Manager (GTM) or Facebook Pixel.
  • Profiling: We do not perform profiling or automated decision-making.
  • Data transfer: Personal data is not sold, rented or traded. It is shared only with the technical partners named above, with Booking.com where you book through that platform, or where we are required to do so by law or a competent authority.
  • External links: The Website contains links to third-party sites (including Booking.com, Facebook, Instagram and documents on Google Drive). Those sites have their own privacy practices, for which we are not responsible.

5. Data Security

The data controller takes reasonable technical and organisational measures to keep personal data secure and to protect it against unauthorised access, alteration, loss or disclosure, in line with Section 20 of the DPPA and Article 32 of the GDPR. The Website is served over HTTPS (SSL/TLS).

6. Cookies

We inform our visitors that this Website does not use marketing cookies, does not employ visitor tracking systems (such as Google Analytics or Facebook Pixel), and does not profile visitors.

Technical cookies (strictly necessary): While you view the Website, only technical data packages (cookies) that are strictly necessary for serving the Website, server stability and a secure connection may be placed in your browser (for example a language preference). These technical cookies are not used for advertising or analytics.

Why is there no cookie consent banner? Under the DPPA and the ePrivacy rules applied with the GDPR, cookies that are strictly necessary for the operation of the website do not require prior consent. Because we do not collect data for advertising or analytics, we do not display a cookie banner. Details are covered in this Privacy Policy.

7. Rights of the Data Subject

Under the DPPA and, where applicable, the GDPR, you may:

  • Request information about, and access to, your personal data
  • Request the rectification of inaccurate or incomplete data
  • Request erasure (deletion) where there is no longer a legal basis to keep the data
  • Object to, or request restriction of, processing
  • Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
  • Request data portability, where the GDPR applies and the legal conditions are met
  • Object to processing for direct marketing

To exercise these rights, contact us at infosharpisland@gmail.com. We will respond within thirty (30) days of receipt, or within the period required by applicable law.

If you believe our processing infringes your rights, please contact us first. You may also lodge a complaint with:

Personal Data Protection Office (PDPO), National Information Technology Authority – Uganda (NITA-U): https://www.pdpo.go.ug

EU/EEA visitors: you may lodge a complaint with your national supervisory authority. See: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We may update this Privacy Policy from time to time. The current version is always published on this page with the “Last update” date above. Further identification of the website operator is available in our Imprint.