Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

In accordance with Section 6 of the Act, we have designated a Data Protection Officer who is responsible for ensuring our compliance with the Act. For any data protection enquiries, please contact us using the details above.

2. Personal Data We Collect

In line with Section 12 (collection for a specific purpose) and Section 14 (data minimality) of the Act, we only collect personal data that is necessary for and directly related to our business functions. This may include:

• Identity data: Full name, job title, and organisation name.
• Contact data: Email address, telephone number, and physical address.
• Project data: Information you provide in relation to software development engagements, such as project requirements and business processes.
• Technical data: IP address, browser type, and usage data collected automatically when you visit our website.
• Communication data: Records of correspondence between you and Eirmond.

We do not collect special personal data (as defined in Section 9 of the Act) — including data relating to religious beliefs, political opinions, sexual life, financial information, or health status — unless explicitly required for a specific engagement and with your express consent.

3. How We Collect Your Data

In accordance with Section 11 of the Act, we collect personal data directly from you through:

• Email correspondence and phone calls.
• Meetings and consultations (in-person or virtual).
• Project onboarding and contractual engagement forms.
• Your use of our website (via cookies and similar technologies).

As required by Section 13 of the Act, we inform you of the nature, category, and purpose of data collection before or at the time of collection.

4. Purpose and Legal Basis for Processing

Under Section 7 of the Act, we process your personal data only where we have a lawful basis to do so. Our processing activities and their legal bases include:

We do not process your personal data for purposes beyond those for which it was originally collected, unless we obtain your consent or are permitted to do so under Section 17 of the Act.

5. Consent

Where our processing of your personal data is based on consent, that consent must be freely given, specific, informed, and unambiguous, as defined in Section 2 of the Act.

You have the right to withdraw your consent at any time by contacting us at info@eirmondserv.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

6. Children's Data

In accordance with Section 8 of the Act, we do not knowingly collect personal data from children without the consent of a parent or guardian. Our services are directed at businesses and organisations, not at children. If we become aware that we have collected a child's personal data without proper consent, we will take steps to delete it promptly.

7. Data Sharing and Disclosure

We may share your personal data with the following categories of recipients:

• Service providers: Third-party vendors who assist in hosting, cloud infrastructure, analytics, or communication services, under contractual obligations to protect your data (Section 21 of the Act).
• Legal and regulatory authorities: Where required by law, court order, or lawful request from a government authority.
• Professional advisors: Accountants, auditors, and legal counsel, as necessary for our business operations.

We do not sell, rent, or trade your personal data to any third party (Section 37 of the Act makes the sale of personal data a criminal offence punishable by imprisonment of up to 10 years).

8. Cross-Border Data Transfers

In the course of providing our services, your personal data may be transferred to and stored in countries outside Uganda — for example, where we use cloud-based infrastructure or third-party tools hosted internationally.

In accordance with Section 19 of the Act, we ensure that any country to which your data is transferred has adequate data protection measures in place that are at least equivalent to those provided under the Act. Where adequacy has not been established, we will obtain your specific consent for the transfer, taking into consideration the nature of the personal data involved.

9. Data Retention

Under Section 18 of the Act, we retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Specifically:

• Active client data: Retained for the duration of the contractual relationship and for a period of six (6) years thereafter for legal, tax, and audit purposes.
• Enquiry and correspondence data: Retained for two (2) years from the date of the last communication.
• Website usage data: Retained for twelve (12) months.

Once the retention period expires, personal data is securely deleted or de-identified in accordance with the Act.

You may request the deletion of your personal data at any time by emailing us at info@eirmondserv.com with the subject line "Data Deletion Request". We will process your request within thirty (30) days. Please note that we may be required to retain certain data where there is a legal or regulatory obligation to do so, in which case we will inform you accordingly.

10. Data Security

In compliance with Section 20 of the Act, we implement appropriate technical and organisational measures to protect your personal data against loss, damage, unauthorised destruction, or unlawful access. These measures include:

• Encryption of data in transit and at rest.
• Access controls and role-based permissions.
• Regular security assessments and vulnerability testing.
• Employee training on data protection and privacy.
• Secure backup and disaster recovery procedures.

We also ensure that any third-party processors we engage maintain adequate security safeguards as required by Section 21 of the Act.

11. Data Breach Notification

In the event that your personal data is accessed or acquired by an unauthorised person, we will immediately notify the Personal Data Protection Office (PDPO) as required by Section 23 of the Act, together with a description of the remedial actions taken.

Where the PDPO determines that you should be notified, we will inform you via email or other appropriate means, providing sufficient information for you to take protective measures against the potential consequences of the breach.

12. Your Rights as a Data Subject

Under Part V of the Data Protection and Privacy Act, 2019, you have the following rights:

To exercise any of these rights, please contact us at info@eirmondserv.com. If we reject your request, we will provide written reasons as required by the Act.

13. Complaints

If you believe that your data protection rights have been infringed, you have the right to lodge a complaint with:

Under Section 31 of the Act, the PDPO is required to investigate your complaint within 21 days of receipt. You also have the right to seek compensation through the courts under Section 33 if you suffer damage or distress due to non-compliance.

14. Cookies and Similar Technologies

Our website may use cookies — small text files stored on your device — to improve your browsing experience and analyse website usage. You can control cookie settings through your browser preferences. Disabling cookies may affect the functionality of certain features on our website.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page indicates when the policy was most recently revised. We encourage you to review this page periodically.

16. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights under the Data Protection and Privacy Act, 2019, please contact us: