Privacy Policy

1. Who we are

Open Sigma Data Solutions Limited(“OpenSigma”, “we”, “us”, or “our”) is a company incorporated in Uganda (registration number 80034453556861) with its principal office at Kawuku, Entebbe Road, Kampala. We provide custom software, ICT equipment, computer training, and technical support services.

This policy explains how we collect, use, store, and protect personal data in line with the Uganda Data Protection and Privacy Act, 2019 (“DPPA”) and related regulations.

2. Data we collect

We collect personal data only when you provide it to us or when our systems record it automatically as you use our services.

• Identity and contact data — name, email address, phone number, organisation name, and job title when you create an account, submit a contact form, or request a quote.
• Business information — details about your organisation, sector, and requirements that you share through our client brief wizard or during project scoping.
• Uploaded files — logos, photos, and documents you upload through our portal or brief wizard, stored securely on our object-storage infrastructure.
• Account credentials — a hashed (never plain-text) password when you register with email. We do not store your raw password at any point.
• Usage data — pages visited, features used, and device or browser type, collected automatically through our analytics system to help us improve the service.
• Payment information — we do not store card numbers or bank details. Payments processed through PayPal or mobile money are handled entirely by those providers under their own privacy policies.

3. How we use your data

• To deliver and manage the services you have requested from us.
• To communicate with you about your projects, orders, or account.
• To send transactional messages such as password-reset links, brief reminders, and document attachments.
• To generate proposals, invoices, and contracts that reference your contact and business details.
• To improve our website and services through aggregated, anonymised analytics.
• To comply with our legal obligations under Ugandan law.

We do not use your data for automated decision-making that produces significant legal effects, and we do not sell your personal data to third parties.

4. Legal basis for processing

Under the DPPA, we process your personal data on the following grounds:

• Contract — processing is necessary to perform a contract you have entered into with us, or to take steps at your request before entering one.
• Consent — where you have explicitly agreed, for example by subscribing to marketing communications.
• Legitimate interests — to improve our services and prevent fraud, where our interests do not override your rights.
• Legal obligation — where required by Ugandan law or a lawful order.

5. Sharing your data

We do not sell, rent, or trade your personal data. We may share it only in the following circumstances:

• Service providers — carefully selected third parties who help us operate our platform (e.g., email delivery, cloud hosting, payment processing). They are bound by confidentiality obligations and may not use your data for their own purposes.
• Legal requirements — if required by law, court order, or a competent authority in Uganda.
• Business transfers — in the event of a merger, acquisition, or asset sale, personal data may be transferred as part of that transaction. We will notify affected users beforehand.

6. Data retention

We keep your personal data only as long as necessary for the purposes described in this policy, or as required by law. In practice:

• Account data is retained while your account is active and for a reasonable period afterwards to handle any follow-up queries.
• Project and billing records are kept for seven years to meet our statutory accounting obligations under Ugandan law.
• Marketing consent records are kept for three years from your last interaction.

When data is no longer needed, we delete or anonymise it securely.

7. Your rights

Under the DPPA you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data where we no longer have a lawful basis to retain it.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time where processing is consent-based.
• Lodge a complaint with the Personal Data Protection Office (PDPO) of Uganda.

To exercise any of these rights, contact us at support@opensigma.cc. We will respond within 21 days.

8. Security

We apply industry-standard technical and organisational measures to protect your data against unauthorised access, loss, or disclosure. These include encrypted connections (TLS), hashed passwords, and role-based access controls. No system is completely secure, and we cannot guarantee absolute security, but we take all reasonable steps to protect your information.

9. Children’s data

Our services are not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy from time to time. When we make material changes we will update the “Last updated” date at the top and, where appropriate, notify you by email. Continued use of our services after the effective date constitutes acceptance of the updated policy.

11. Contact us

For any questions about this policy or your personal data, contact our data protection lead at: