Privacy Policy

1. Data Controller Information

Company Name: Outlyz Enterprises Limited
Address: Lumuli, Misindye Ward, Goma Division, Mukono, Uganda
Email: [email protected]
Phone: +256 780 784 870

Data Protection Officer: [email protected]

2. Information We Collect

2.1 Personal Information

We collect the following types of personal information:

• Account Information: Name, email address, phone number, password (encrypted)
• Business Information: Business name, location, tax identification number
• Transaction Data: Sales records, inventory data, customer purchase history
• Payment Information: Payment method details (processed by third-party providers)
• Technical Data: IP address, browser type, device information, usage analytics
• WhatsApp Ordering Data: when you order by messaging a business's connected WhatsApp number, we process your phone number, your message content, the delivery location you share, and your order details

3. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Contractual Necessity

  To provide our services and fulfill our contractual obligations

• Legitimate Interests

  To improve our services, prevent fraud, and keep the software secure

• Legal Obligations

  To comply with tax laws, accounting requirements, and regulatory obligations

• Consent

  For marketing communications (where required)

4. How We Use Your Information

• Provide, maintain, and improve our services
• Process transactions and manage your account
• Generate reports and analytics for your business
• Communicate with you about updates, security alerts, and support
• Comply with legal obligations and prevent fraud
• Send marketing communications (with your consent)

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Service Providers

  Cloud hosting, payment processors, and an AI provider (Google Gemini) used to interpret WhatsApp order messages, all under data processing agreements and, for the AI provider, on a no-retention basis

• Legal Authorities

  When required by law or to protect our rights and safety

• Business Transfers

  In connection with a merger, acquisition, or sale of assets

6. Data Storage and Security

6.1 Data Storage (Uganda Compliance)

In line with Uganda's Data Protection and Privacy Act, 2019, we store your core account and business data within Uganda or the East African region. Some features require processing outside Uganda, for example AI interpretation of WhatsApp order messages (see International Data Transfers below) and certain hosting providers. Where that happens, we rely on the safeguards described in that section.

6.2 Security Measures

• Your data is encrypted while it travels between you and us
• Encrypted storage of sensitive data
• Regular security audits and vulnerability assessments
• Access controls and authentication mechanisms
• Employee training on data protection

7. Data Retention

• Account Data

  Retained while your account is active and for 7 years after closure (tax compliance)

• Transaction Records

  Retained for 7 years (Uganda tax and accounting requirements)

• Marketing Data

  Until consent is withdrawn or 2 years of inactivity

8. Your Rights (GDPR & Uganda DPA)

• Right of Access

  Request copies of your personal data

• Right to Rectification

  Correct inaccurate or incomplete data

• Right to Erasure

  Request deletion of your data (subject to legal obligations)

• Right to Restrict Processing

  Limit how we use your data

• Right to Data Portability

  Receive your data in a machine-readable format

• Right to Object

  Object to processing based on legitimate interests or direct marketing

• Right to Withdraw Consent

  Withdraw consent at any time (does not affect prior processing)

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

You also have the right to lodge a complaint with Uganda's Personal Data Protection Office (PDPO) if you believe your personal data has been mishandled.

9. Data Breach Notification (Uganda DPA)

In accordance with the Uganda Data Protection and Privacy Act, 2019, we will notify the Uganda Personal Data Protection Office and affected individuals within 72 hours of becoming aware of a data breach that poses a risk to your rights and freedoms.

10. International Data Transfers

Some processing happens outside Uganda, for example AI interpretation of WhatsApp order messages by Google Gemini, and some of our hosting. Under the Data Protection and Privacy Act, 2019, we only do this where you have consented to the transfer or the destination provides protection at least equal to the Act. We keep records of the basis for each transfer, do not allow onward transfer to a further country without your consent, and use providers on a no-retention basis where they handle message content. For users in the European Union, we additionally rely on Standard Contractual Clauses or an adequacy decision where applicable.

11. Cookies

We use only strictly necessary cookies that are required for the software to work, such as keeping you signed in and protecting your session. We do not use advertising, analytics, or third-party tracking cookies. Because these cookies are essential to providing the service, they do not require consent, but you can block or delete cookies through your browser settings.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on our website and updating the "Last Updated" date.

13. Contact Us

Email: [email protected]
Address: Outlyz Enterprises Limited, Kampala, Uganda