Privacy Policy

1. Data Controller Information

Company Name: Outlyz Technologies Ltd
Address: Kampala, Uganda
Email: kimaswa@outlyz.com
Phone: +256 (700) 123-456

Data Protection Officer: kimaswa@outlyz.com

2. Information We Collect

2.1 Personal Information

We collect the following types of personal information:

• Account Information: Name, email address, phone number, password (encrypted)
• Business Information: Business name, location, tax identification number
• Transaction Data: Sales records, inventory data, customer purchase history
• Payment Information: Payment method details (processed by third-party providers)
• Technical Data: IP address, browser type, device information, usage analytics
• WhatsApp Ordering Data: when you order by messaging a business's connected WhatsApp number, we process your phone number, your message content, the delivery location you share, and your order details

3. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contractual Necessity

  To provide our services and fulfill our contractual obligations

• Legitimate Interests

  To improve our services, prevent fraud, and ensure platform security

• Legal Obligations

  To comply with tax laws, accounting requirements, and regulatory obligations

• Consent

  For marketing communications (where required)

4. How We Use Your Information

• Provide, maintain, and improve our services
• Process transactions and manage your account
• Generate reports and analytics for your business
• Communicate with you about updates, security alerts, and support
• Comply with legal obligations and prevent fraud
• Send marketing communications (with your consent)

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Service Providers

  Cloud hosting, payment processors, analytics providers, and an AI provider (Google Gemini) used to interpret WhatsApp order messages, all under data processing agreements and, for the AI provider, on a no-retention basis

• Legal Authorities

  When required by law or to protect our rights and safety

• Business Transfers

  In connection with a merger, acquisition, or sale of assets

6. Data Storage and Security

6.1 Data Storage (Uganda Compliance)

In line with Uganda's Data Protection and Privacy Act, 2019, we store your core account and business data within Uganda or the East African region. Some features require processing outside Uganda, for example AI interpretation of WhatsApp order messages (see International Data Transfers below) and certain infrastructure providers. Where that happens, we rely on the safeguards described in that section.

6.2 Security Measures

• End-to-end encryption for data transmission
• Encrypted storage of sensitive data
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Employee training on data protection

7. Data Retention

• Account Data

  Retained while your account is active and for 7 years after closure (tax compliance)

• Transaction Records

  Retained for 7 years (Uganda tax and accounting requirements)

• Marketing Data

  Until consent is withdrawn or 2 years of inactivity

8. Your Rights (GDPR & Uganda DPA)

• Right of Access

  Request copies of your personal data

• Right to Rectification

  Correct inaccurate or incomplete data

• Right to Erasure

  Request deletion of your data (subject to legal obligations)

• Right to Restrict Processing

  Limit how we use your data

• Right to Data Portability

  Receive your data in a machine-readable format

• Right to Object

  Object to processing based on legitimate interests or direct marketing

• Right to Withdraw Consent

  Withdraw consent at any time (does not affect prior processing)

To exercise these rights, contact us at kimaswa@outlyz.com. We will respond within 30 days.

You also have the right to lodge a complaint with Uganda's Personal Data Protection Office (PDPO) if you believe your personal data has been mishandled.

9. Data Breach Notification (Uganda DPA)

In accordance with the Uganda Data Protection and Privacy Act, 2019, we will notify the Uganda Personal Data Protection Office and affected individuals within 72 hours of becoming aware of a data breach that poses a risk to your rights and freedoms.

10. International Data Transfers

Some processing happens outside Uganda, for example AI interpretation of WhatsApp order messages by Google Gemini, and certain cloud infrastructure. Under the Data Protection and Privacy Act, 2019, we only do this where you have consented to the transfer or the destination provides protection at least equal to the Act. We keep records of the basis for each transfer, do not allow onward transfer to a further country without your consent, and use providers on a no-retention basis where they handle message content. For users in the European Union, we additionally rely on Standard Contractual Clauses or an adequacy decision where applicable.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance user experience, analyze usage, and improve our services. You can manage cookie preferences through your browser settings.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on our website and updating the "Last Updated" date.

13. Contact Us

Email: kimaswa@outlyz.com
Address: Outlyz Technologies Ltd, Kampala, Uganda