Privacy Policy
Last updated: August 2026 · Version 2.0
Intellectual Clothing Ltd (“we”, “us”, “our”) is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we process and protect it, who we share it with, and your rights under the Uganda Data Protection and Privacy Act 2019 (the “Act”).
This policy applies to all users of the Platform: Customers, Vendors, Riders, and visitors. By using Intellectual Clothing you consent to the data practices described in this policy.
1. Data Controller
The data controller responsible for your personal data is:
Intellectual Clothing Ltd
Plot 12, Kampala Road, Nakasero, Kampala, Uganda
Email: sales@intellectualwear.africa
Phone: +256 700 123 456
2. Personal Data We Collect
2.1 Data You Provide Directly
| Category | Examples | Purpose |
|---|---|---|
| Identity | Full name, National ID number, date of birth, gender | Account creation, verification, legal compliance |
| Contact | Phone number, email address, WhatsApp number | Communication, OTP, delivery coordination |
| Financial | MoMo phone number, MoMo name, bank details (Vendors/Riders) | Payout processing |
| Address | Delivery address, area, city, landmark, GPS coordinates | Order delivery, zone pricing |
| Business (Vendors) | Business name, TIN, registration number, permits | Vendor verification, tax compliance |
| Vehicle (Riders) | Vehicle type, plate number, license, insurance | Rider verification, assignment |
| Documents | National ID scan, business permit, driving license | KYC verification |
2.2 Data Collected Automatically
| Category | Examples | Purpose |
|---|---|---|
| Device & Browser | IP address, browser type, OS, screen size, device type | Security, analytics, responsive design |
| Usage | Pages visited, search queries, products viewed, time spent | Platform improvement, personalisation |
| Transaction | Order history, payment references, amounts | Order fulfilment, accounting, disputes |
| Location (Riders) | Real-time GPS coordinates during active deliveries | Live tracking, delivery verification, safety |
| Communications | Chat messages, support tickets, email correspondence | Customer support, dispute resolution |
3. Legal Basis for Processing
Under the Uganda Data Protection and Privacy Act 2019, we process your data on the following legal grounds:
- Consent: You consent to processing when you create an account, place an order, or enable location sharing.
- Contract: Processing is necessary to perform the contract between you and us (order fulfilment, delivery, payment).
- Legal obligation: We are required to retain certain financial records for tax and regulatory purposes.
- Legitimate interest: Platform security, fraud prevention, service improvement, and analytics.
4. GPS & Location Data
For Riders: When you have an active delivery, your device's GPS location is collected every 30 seconds and transmitted to our servers. This data is used to: (a) provide real-time tracking to Customers; (b) calculate delivery distances for payment; (c) verify delivery completion; (d) send “rider nearby” notifications. GPS tracking is ONLY active during deliveries and stops immediately when a delivery is marked complete.
For Customers: If you grant location permission, we may use it to auto-fill your delivery address or suggest nearby vendors. This is optional and you can deny or revoke location access at any time.
Retention: Rider GPS data is automatically purged after 72 hours. Only aggregated distance statistics are retained long-term for payout calculations.
5. Mobile Money & Payment Data
We NEVER store your Mobile Money PIN, card number, CVV, or full card details. Payment processing is handled by PCI-DSS-Level-1-compliant third parties:
- Flutterwave: Processes card and MoMo payments. Only transaction reference IDs are stored on our systems.
- Mobile Money Providers (MTN, Airtel): Payment prompts are sent directly by the provider. We receive only a success/failure callback.
For Vendor/Rider payouts, we store the registered MoMo phone number and name for disbursement purposes only.
6. Data Sharing & Third Parties
We do NOT sell your personal data. We share data only as follows:
| Recipient | Data Shared | Purpose |
|---|---|---|
| Vendors | Delivery area (before acceptance), full address (after acceptance), contact phone | Order preparation and coordination |
| Riders | Customer delivery address, phone, order items summary | Delivery execution (active delivery only) |
| Flutterwave | Payment amount, customer phone/email, transaction details | Payment processing |
| Africa's Talking | Phone number, SMS content | OTP verification, delivery notifications |
| Supabase (hosting) | All platform data (encrypted at rest) | Database infrastructure |
| Vercel (hosting) | Request logs, IP addresses | Application hosting, CDN |
| Law enforcement | As required by valid court order or subpoena | Legal compliance |
7. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data | Active account + 2 years after closure | Regulatory, dispute resolution |
| Order & transaction records | 7 years | URA tax compliance requirement |
| Chat messages | 1 year | Dispute resolution |
| Rider GPS data | 72 hours (raw), aggregated stats retained | Delivery verification, payouts |
| Activity/analytics events | 12 months | Platform improvement |
| Audit logs | 3 years | Security, compliance |
| KYC documents | Duration of account + 2 years | Anti-fraud, AML compliance |
| Support tickets | 2 years after resolution | Quality assurance |
8. Cookies & Tracking Technologies
We use:
- Essential cookies: Session management, authentication tokens, CSRF protection. Required for the Platform to function.
- Functional cookies: Cart persistence (guest users), language preference, recently viewed products.
- Analytics: Anonymous usage statistics (page views, event counts) to improve the Platform. No personal identification.
We do NOT use third-party advertising cookies or trackers. We do not participate in cross-site tracking or serve personalised ads.
9. Data Security
We implement the following security measures:
- All data transmitted over HTTPS (TLS 1.3)
- Database encryption at rest (AES-256)
- Row Level Security (RLS) — users can only access their own data
- Password hashing (bcrypt with salt)
- Rate limiting on all API endpoints
- Service-role key protection (never exposed to client)
- Regular security audits and dependency updates
- Principle of least privilege for staff access
While we take reasonable measures to protect your data, no system is 100% secure. In the event of a data breach affecting your personal data, we will notify you and the National Information Technology Authority – Uganda (NITA-U) within 72 hours as required by law.
10. Your Rights
Under the Uganda Data Protection and Privacy Act 2019, you have the right to:
- Access: Request a copy of all personal data we hold about you.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Request deletion of your data (subject to legal retention requirements).
- Portability: Receive your data in a structured, machine-readable format (JSON/CSV).
- Objection: Object to processing for marketing purposes or based on legitimate interest.
- Restriction: Request that we limit how we use your data while a dispute is resolved.
- Withdraw consent: You may withdraw consent at any time. This does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, email sales@intellectualwear.africa with the subject “Data Rights Request”. We will verify your identity and respond within 21 days. If we cannot comply (e.g., legal retention requirement), we will explain why.
11. Children's Privacy
Our Platform is not directed at persons under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us immediately and we will delete it within 48 hours.
12. International Data Transfers
Your data is primarily stored on servers operated by Supabase (AWS infrastructure) which may be located outside Uganda. Any international transfer is conducted with appropriate safeguards including encryption in transit and at rest, and contractual commitments from service providers to maintain equivalent data protection standards.
13. Automated Decision-Making
We may use automated processes for: (a) fraud detection scoring on COD orders; (b) delivery zone pricing calculation; (c) rider assignment based on proximity. You have the right to request human review of any automated decision that significantly affects you.
14. Third-Party Links
The Platform may contain links to third-party websites (payment providers, social media). We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies.
15. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email and/or in-app notification at least 14 days before taking effect. The “Last updated” date at the top indicates the most recent revision.
16. Complaints
If you believe your data protection rights have been violated, you may:
- Contact us at sales@intellectualwear.africa
- Lodge a complaint with the National Information Technology Authority – Uganda (NITA-U), the supervisory authority under the Data Protection and Privacy Act 2019
17. Contact
Intellectual Clothing Ltd
Data Protection Contact
Plot 12, Kampala Road, Nakasero
Kampala, Uganda
Email: sales@intellectualwear.africa
Phone: +256 700 123 456