Data Protection Policy

1. Preamble

1.1 Commitment to data protection and privacy

We take our data protection and information security responsibilities seriously. The effective management of all personal data — including its security and confidentiality — lies at the heart of our business. This is required by Applicable Data Protection Laws and driven by our commitment to clients who trust us with access to their premises, systems, and people.

1.2 Applicable law

For the purposes of this Policy, "Applicable Law" means the Data Protection and Privacy Act, 2019 of Uganda, the Data Protection and Privacy Regulations made under it, and any other Ugandan laws on data privacy enacted under the Constitution. Where our services touch data subject to foreign data protection laws, those laws apply to that processing too. If any provision of Applicable Laws conflicts with this Policy, the Applicable Laws take precedence.

1.3 Responsibility to protect personal data

The Company, its employees, consultants, and subcontractors share responsibility for safeguarding the confidentiality of all personal information collected, held, or processed by or on behalf of the Company. Everyone working for or representing us is personally responsible for maintaining its security, and for handling client-site data (CCTV footage, access logs, survey photographs) with the same care as our own records.

2. Principles for data collection

Personal data must be processed in line with the principles in the Applicable Law. Information must be:

• fairly and lawfully processed;
• processed for limited, disclosed purposes and not in any manner incompatible with those purposes;
• adequate, relevant, and not excessive;
• accurate and kept up to date;
• kept no longer than necessary;
• processed in accordance with the individual's rights;
• kept secure; and not transferred to countries without adequate protection except with lawful safeguards.

These principles cover the personal information of staff, clients, website visitors, support contacts, and individuals captured on systems we install or maintain.

3. Application

This Policy applies to personal information held in electronic records (workstations, servers, cloud systems, CCTV recorders, access control panels, and the website) and in manual filing systems (survey notes, sign-in sheets, printed reports) wherever individuals are identifiable.

4. Definitions

Processingis broadly defined and includes obtaining, recording, holding, using, organising, altering, retrieving, disclosing, erasing, or destroying personal information — including configuring a client's CCTV or access system that stores it.

Personal information is any information relating to an identifiable living individual, including: names and contact details; support ticket histories and chat transcripts; site survey notes and photographs in which people are identifiable; CCTV footage and stills; biometric enrolment data (fingerprints, facial templates) on access systems we deploy; employee records; and any description from which a person can be identified.

Sensitive personal information, subject to Applicable Law, includes racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexuality, criminal proceedings or convictions, physical or mental health — and, in our line of work most importantly, biometric data.

These definitions guide interpretation and yield at all times to the Act and Regulations.

5. The rules

5.1 Fairly and lawfully processed

Individuals must be told who processes their information and why, whether providing it is obligatory or voluntary, and — where obligatory — what follows from refusing. Website forms, support channels, site surveys, and access enrolment all carry or link that notice. Processing must never breach copyright, confidence, or any other Applicable Law duty.

5.2 When processing is fair

Processing is fair where the individual has consented; or Applicable Law permits or exempts it; or it is necessary to perform a contract (installations, support agreements); or to comply with a legal obligation; or for our legitimate interests (site security, network administration) unless those prejudice the individual; or to carry out a public function; or to protect vital interests.

5.3 Sensitive personal information

Biometric enrolment and similar sensitive data are processed only with the individual's explicit consent or where Applicable Law permits or exempts it — including employment-law obligations, protection of vital interests, and the administration of justice. We collect biometrics only where the access-control purpose requires it, explain retention at enrolment, and delete templates when the purpose ends.

5.4 Processed for limited purposes

Personal information is processed only for specific lawful purposes disclosed to the individual (or obvious in context, or permitted by law), never incompatibly with them. Our purposes include: responding to enquiries and quoting projects; surveying, installing, and documenting client sites (including photographs needed for handover records); providing support and keeping tickets, chat transcripts, and call notes; operating access control and CCTV systems we manage for clients; administering staff; and — only with a working opt-out — telling existing contacts about directly relevant services.

We do not share personal information with non-affiliated third parties except: with the individual's direction or consent; as necessary to process or administer a transaction or case; in providing our services; in operating our business; or as Applicable Law permits or exempts. Disclosure beyond this needs prior authorisation.

Some processing runs through service providers acting on our direction — cloud hosting, email delivery, messaging platforms, and analytics. They process only for our specified purposes under contract. Disclosures to government, law enforcement, or regulators happen only as Applicable Law requires or permits, and any such request received by staff must go to the Data Protection Officer first — nothing is disclosed that way without proper authorisation.

5.5 Adequate, relevant, not excessive

We hold what the purpose needs and no more: a support ticket needs contact details and a fault description, not life histories; a camera aims at the gate, not the neighbour's windows. Periodic audits prune the irrelevant and excessive.

5.6 Accurate

Stored information must be accurate and current, checked on a cycle set by its sensitivity and purpose. Individuals should tell us of material changes (addresses, names, contacts); staff records get an annual accuracy reminder.

5.7 Not kept longer than necessary

Information lives only as long as its purpose, then is destroyed — including backups and archives on schedule. Our standard retention periods, reviewed annually:

• Sales enquiries and quotes: 24 months;
• Support tickets and chat transcripts: 36 months;
• Client CCTV footage we manage: 30 days rolling, or the period in the client contract;
• Access logs: 12 months;
• Site survey records: life of the client relationship;
• Staff records: as employment law requires;
• Backups: 90-day rotation.

5.8 Processed in accordance with individual rights

Where Applicable Law confers rights — access, correction, deletion, objection, restriction, withdrawal of consent — we honour them within statutory timelines, subject to lawful exemptions (which we will explain if we rely on one). Staff exercise rights through their line manager; everyone else through the Data Protection Officer below.

5.9 Security

We protect information with strict access control (least privilege, immediate revocation on role change or exit), encryption in transit and at rest where feasible, endpoint protection, secure coding and configuration practices, regular backups, staff training, and an incident response plan. Databases and documents open only to people with a work reason; passwords rotate; client systems we manage inherit the same discipline, including default-credential replacement on every deployment.

5.10 Transfers outside Uganda

Email delivery, messaging, analytics, and some cloud hosting mean personal information may be processed outside Uganda, whose laws may protect it less. Transfers happen only with Applicable Law safeguards — contract terms, and where needed, consent. CCTV footage we manage for clients stays in-country unless the client's contract says otherwise.

6. Individual rights in practice

To exercise a right, write to the Data Protection Officer with: enough information to identify you, your contact details, what you are asking for, and a signature (or equivalent electronic confirmation). We respond within the timelines Applicable Law sets, and if we must withhold anything under an exemption, we will say so and explain why. Staff may alternatively approach their line manager; complaints about our handling go to the Officer first, then to the Personal Data Protection Office.

7. Compliance, Data Protection Officer, breaches

Processing outside these guidelines is not permitted. Anyone who unlawfully obtains, discloses, or sells personal information may commit an offence and will face disciplinary action up to and including dismissal. Anyone who knows of — or suspects — unauthorised access, use, disclosure, or loss must report it immediately; failure to report is itself a disciplinary matter.

Our designated Data Protection Officer coordinates compliance, training, audits, and regulator liaison. Contact: info@backspace.ug. Suspected breaches involving personal information are assessed immediately and notified to the Personal Data Protection Office and affected individuals as Applicable Law requires.