Privacy Policy

Zavora Digital Company Limited is a Ugandan technology company providing digital and technology-related services, which may include:

• Website design and development
• Software and systems development
• Mobile and web applications
• AI and automation solutions
• Cybersecurity services
• Digital branding and graphic design
• Photography and video services
• Digital marketing and advertising
• Printing and signage services
• Technology consulting
• Digital platforms and other technology products

As our services develop, additional products and services may be introduced.

For privacy-related enquiries, you may contact us through:

Where a dedicated privacy or data-protection contact is established, Zavora may designate an appropriate contact person or Data Protection Officer for privacy matters.

Depending on how you interact with Zavora, we may collect different categories of information.

2.1 Information you provide directly

This may include:

• Full name
• Email address
• Telephone or mobile number
• Business name
• Physical or business address
• Job title or position
• Account information
• Login credentials
• Information contained in enquiries or messages
• Information submitted through forms
• Project requirements and specifications
• Billing and invoicing information
• Information provided when requesting a quotation
• Information provided when applying for employment or working with Zavora
• Information voluntarily provided through social media or other communication channels

We only request information that is reasonably necessary for the relevant purpose.

2.2 Information collected automatically

When you interact with our websites, applications or digital platforms, certain technical information may be collected automatically, including:

• IP address
• Browser type
• Device type
• Operating system
• Approximate location information derived from technical data
• Pages visited
• Referring website
• Date and time of access
• Device identifiers
• Usage and interaction information
• Error logs and diagnostic information

This information may be used to operate, secure, maintain and improve our services.

2.3 Information provided by clients

Where Zavora provides technology or digital services to a client, the client may provide information belonging to its customers, employees, users or other individuals.

In such circumstances, Zavora may process that information on behalf of the client.

Where appropriate, the client may remain the data controller, while Zavora acts as a data processor.

The responsibilities of each party may also be governed by a separate service agreement, data-processing agreement or other contractual arrangement.

We may use personal information for legitimate and specified purposes, including to:

• Provide and deliver our services
• Create and manage user accounts
• Respond to enquiries and requests
• Communicate with customers and prospective customers
• Prepare quotations and proposals
• Manage projects and client relationships
• Process payments and invoices
• Provide customer support
• Maintain and improve our websites, applications and systems
• Develop new products and services
• Detect, prevent and investigate fraud, abuse and security incidents
• Protect our systems and users
• Perform analytics and understand service usage
• Send service-related communications
• Send marketing communications where permitted
• Comply with legal and regulatory obligations
• Establish, exercise or defend legal rights
• Maintain business, accounting and administrative records
• Carry out other purposes communicated to you at the time information is collected

We will not knowingly collect or process more personal information than is reasonably necessary for the purpose for which it is collected.

Uganda’s Data Protection and Privacy Act requires personal data to be collected for lawful, specific and defined purposes and limits processing to information that is necessary or relevant to that purpose.

Depending on the circumstances, Zavora may process personal information where:

1. You have provided consent;
2. Processing is necessary to provide a service or perform a contract with you;
3. Processing is necessary to take steps requested by you before entering into a contract;
4. Processing is required by law;
5. Processing is necessary for legitimate business purposes where permitted by applicable law;
6. Processing is necessary to protect the rights, security or safety of individuals or our systems; or
7. Another lawful basis recognised under applicable law applies.

Where processing relies on consent, you may withdraw your consent where legally applicable. Withdrawal of consent does not affect processing that was lawfully carried out before withdrawal.

Zavora does not sell personal information to third parties.

We may share personal information where reasonably necessary with:

Service providers

We may use trusted third-party providers for services such as:

• Cloud hosting
• Website hosting
• Database hosting
• Email
• Communications
• Analytics
• Payment processing
• Authentication
• Cybersecurity
• Software infrastructure
• Customer support
• File storage
• Advertising and marketing

These providers may process personal information only as necessary to provide their services or as otherwise permitted by applicable law.

Clients

Where Zavora processes information on behalf of a client, information may be accessed or transferred according to the client’s instructions and applicable contractual arrangements.

Legal and regulatory authorities

We may disclose information where required or authorised by law, court order, regulatory requirement, or where necessary to prevent or investigate unlawful activity.

Business transactions

If Zavora undergoes a merger, acquisition, restructuring, sale of assets, financing, or similar corporate transaction, relevant information may be transferred as part of that transaction, subject to applicable legal requirements.

Our websites, applications and systems may integrate with third-party services.

Depending on the particular service, these may include providers for:

• Cloud infrastructure
• Authentication
• Artificial intelligence
• Analytics
• Payments
• Communications
• Advertising
• Social media
• Database services
• Security
• Content delivery
• Software development and monitoring

Third-party providers may have their own privacy policies and terms.

Where personal information is processed through a third-party service, Zavora will take reasonable steps to ensure that appropriate privacy and security protections are in place.

Some Zavora products and services may use artificial intelligence, machine learning or automated technologies.

Where AI or automated systems process personal information, Zavora will seek to:

• Use information only for appropriate and defined purposes;
• Apply reasonable security measures;
• Limit access to authorised persons and systems;
• Avoid unnecessary collection of personal information;
• Use appropriate third-party AI providers where required;
• Take reasonable measures to prevent unauthorised disclosure; and
• Comply with applicable data-protection requirements.

Where an important decision affecting an individual is made solely through automated processing, Zavora will provide the rights and safeguards required by applicable law.

Uganda’s Data Protection and Privacy Act contains specific protections concerning significant decisions based solely on automated processing.

Zavora may use cookies and similar technologies to:

• Keep websites functioning;
• Remember preferences;
• Understand website usage;
• Improve performance;
• Protect against abuse and fraud;
• Analyse traffic;
• Improve our services; and
• Support marketing activities where applicable.

You may be able to control cookies through your browser settings.

Disabling certain cookies may affect the functionality of some services.

Where required by applicable law, Zavora will request appropriate consent before using non-essential cookies or similar technologies.

Zavora takes reasonable technical and organisational measures to protect personal information against:

• Unauthorised access;
• Unauthorised disclosure;
• Loss;
• Destruction;
• Alteration;
• Misuse;
• Accidental disclosure; and
• Other unlawful processing.

Security measures may include access controls, authentication, encryption where appropriate, secure development practices, monitoring, backups, restricted access, security testing and other appropriate safeguards.

However, no electronic system, internet transmission or storage method can be guaranteed to be completely secure.

Uganda’s Data Protection and Privacy Act requires appropriate, reasonable technical and organisational measures to protect personal data and requires safeguards to be maintained and updated in response to risks.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law, contract, legitimate business requirements or another lawful basis.

When personal information is no longer required, Zavora may securely delete, destroy or anonymise it.

Certain information may need to be retained for accounting, legal, regulatory, dispute-resolution, security or other legitimate purposes.

Ugandan law generally requires personal information not to be retained longer than necessary for its purpose, subject to specified exceptions.

Some of our technology providers may process or store information outside Uganda.

Where personal information is transferred outside Uganda, Zavora will take reasonable steps to ensure that the transfer is carried out in accordance with applicable Ugandan data-protection requirements.

This may include using providers or jurisdictions with appropriate data-protection safeguards or obtaining consent where required.

Uganda’s Data Protection and Privacy Act contains specific requirements where personal information processed by a Ugandan controller or processor is stored or processed outside Uganda.

Subject to applicable law and relevant limitations, you may have the right to:

• Request access to personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion or destruction of personal information where legally applicable;
• Request restriction or cessation of certain processing;
• Object to certain processing, including direct marketing;
• Withdraw consent where processing is based on consent;
• Ask about how your information is being processed;
• Request information about relevant recipients or categories of recipients;
• Exercise rights concerning automated decision-making where applicable; and
• Lodge a complaint with the relevant data-protection authority.

Uganda’s legislation expressly provides rights including access, correction/deletion in certain circumstances, prevention of certain processing and protections concerning direct marketing and automated decision-making.

Where permitted by law, Zavora may communicate with customers or prospective customers about:

• Products;
• Services;
• Promotions;
• Company updates;
• Events;
• Offers;
• New technology; and
• Other relevant business information.

Where required, we will obtain appropriate consent before sending direct marketing communications.

You may opt out of marketing communications at any time by following the unsubscribe instructions provided in the communication or contacting us directly.

Our services are not intentionally designed to collect personal information from children without appropriate authorisation or consent.

Where we become aware that personal information belonging to a child has been collected unlawfully, we will take reasonable steps to address the situation in accordance with applicable law.

Clients are responsible for ensuring that they have an appropriate legal basis and authority to provide personal information to Zavora for processing.

Where Zavora processes personal information on behalf of a client, we may process that information according to the client’s instructions and our contractual obligations.

Clients should not provide Zavora with personal information that is unnecessary for the relevant service.

Where appropriate, Zavora and its clients may enter into separate data-processing agreements setting out responsibilities concerning personal information.

Zavora maintains procedures intended to identify, investigate, contain and respond to suspected or confirmed security incidents involving personal information.

Where a data breach occurs, Zavora will take reasonable steps to assess the incident, mitigate potential harm and make notifications where required by applicable law or regulatory requirements.

Our websites or services may contain links to third-party websites, platforms or services.

Zavora is not responsible for the privacy practices, security or content of third-party websites.

We encourage users to review the privacy policies of third-party services before providing personal information to them.

Personal information is not the only information we may receive from clients.

Clients may provide Zavora with confidential business information, technical documentation, source code, databases, designs, credentials, business strategies or other proprietary information.

Zavora will handle such information according to applicable contractual obligations, confidentiality agreements and reasonable security practices.

Clients should not provide passwords, private keys, authentication tokens or other highly sensitive credentials unless such disclosure is specifically required and appropriate security arrangements have been established.

We take reasonable steps to maintain accurate and relevant personal information.

You are responsible for providing information that is accurate, complete and up to date.

If you discover that information we hold about you is inaccurate or incomplete, you may contact us and request correction where applicable.

Zavora may update this Privacy Policy from time to time.

Changes may be made to reflect:

• New services;
• New technologies;
• Changes to our business;
• Changes in applicable law;
• Changes in third-party services; or
• Improvements to our privacy practices.

When we make material changes, we may update the “Last Updated” date and, where appropriate, provide additional notice.

If you have questions, concerns, requests or complaints concerning this Privacy Policy or the way Zavora handles personal information, please contact us.

When submitting a privacy request, please provide enough information for us to identify the relevant individual and understand the nature of your request.

We may request reasonable information to verify your identity before processing certain requests.

This Privacy Policy is intended to operate in accordance with the laws of the Republic of Uganda, including applicable data-protection and privacy legislation.

Nothing in this Privacy Policy limits any rights or protections available to an individual under applicable law.