Overview & scope#
In shortThis policy explains how Digitel Africa handles personal data when you use our website, platforms, and services.
Digitel Africa ("we", "us", or "our"), operated under the laws of the Republic of Uganda by CYPERACE GROUP UGANDA LIMITED, provides digital infrastructure to African businesses, including business email, DNS, web hosting, our cloud and app platform, managed databases, domain registration, SSL certificates, VPN, and related professional services such as DevOps, support, monitoring, security, software development, consulting, and training.
This policy applies to personal data we process as a Data Controller (under Uganda's Data Protection and Privacy Act, 2019 and the GDPR; POPIA calls this a "responsible party") — for example, information about individuals who visit our website, register accounts, subscribe to services, or contact our support team. It sets out the categories of data collected, lawful bases, third-party sharing, and your statutory rights.
Two distinct legal roles
When we handle account, billing, contact, and support data, we act as the Data Controller (responsible party). When you store customer data on our platforms — hosted emails, websites, database records, and server logs — we act as a Data Processor (an "operator") handling that data strictly on your behalf under your instructions and our service agreement.
We are governed primarily by Uganda's Data Protection and Privacy Act, 2019 (Act No. 9 of 2019) and the Data Protection and Privacy Regulations, 2021, under the statutory authority of the Personal Data Protection Office (PDPO). Where we offer services to, or process data from, individuals in South Africa, we comply with the Protection of Personal Information Act, 2013 (POPIA); and where we process data of individuals in the EU or EEA, the General Data Protection Regulation (GDPR) applies.
Information we collect#
In shortWe collect the account, billing, technical, and support information needed to run our services, plus we host the content and data you choose to store with us.
We collect information you give us directly, information generated as you use our services, and a limited amount from third parties such as payment and fraud-prevention providers. The table below summarises the categories.
| Category | Examples | Why we collect it |
|---|---|---|
| Account & contact data | Name, work email, phone number, company name, role, username, authentication credentials | To create and secure your account, provide the service, and communicate with you |
| Billing & transaction data | Billing name and address, VAT/tax details, invoices, plan and usage records, partial card details and payment references handled by our payment processor | To process payments, prevent fraud, and meet tax and accounting obligations |
| Customer content & stored data | Emails, hosted website files, database records, DNS records, domain and certificate details, and any personal information about third parties that you choose to store on our services | To deliver the services you have purchased; we handle this as your operator under your instructions |
| Technical & usage data | IP address, device and browser type, log files, timestamps, pages and features used, diagnostic and performance metrics | To operate, secure, troubleshoot, and improve the services — see our security practices |
| Support & communications data | Support tickets, chat and email correspondence, call notes, feedback and survey responses | To respond to requests, resolve issues, and improve our support |
| Cookies & similar identifiers | Cookie IDs and similar signals set when you use our website | See Cookies & similar technologies for detail |
We do not deliberately seek out special personal information (such as health, religion, or biometric data) to run our services. If such information reaches us because you store it on the platform, we handle it as your operator under your contract, not for our own purposes.
How we use your information#
In shortWe use your information to deliver and secure the services, bill you, support you, comply with the law, and — on clear bases — improve and market our services.
Under Section 7 of Uganda's Data Protection and Privacy Act, 2019, South Africa's POPIA, and the GDPR, every processing activity must have a recognised lawful basis. We rely on the following:
- To provide the services you have signed up for — provisioning, authentication, delivery, and account management. *Basis: performance of our contract with you (Section 7(2)(b) of the Uganda Act; POPIA §11; GDPR Art 6(1)(b)).*
- To bill you and prevent fraud — invoicing, payment processing, tax compliance, and detecting abuse. *Basis: contract performance and compliance with legal and tax obligations (Section 7(2)(c) of the Uganda Act; GDPR Art 6(1)(c)).*
- To secure and maintain our platform — monitoring, logging, backups, and incident response. *Basis: legitimate interests in keeping digital infrastructure safe, resilient, and reliable (Section 7(2)(e) of the Uganda Act; GDPR Art 6(1)(f)).*
- To support you — responding to tickets and communicating about outages, service changes, and security. *Basis: contract performance and legitimate operational communications.*
- To comply with law — responding to lawful court orders and meeting regulatory reporting duties. *Basis: legal obligation.*
- To improve our services — analysing aggregated usage metrics and diagnostics. *Basis: legitimate interests, with technical safeguards to limit impact on you.*
- To send marketing about relevant products — where permitted, and always with an immediate opt-out. *Basis: explicit consent where required by statute (Section 7(1) of the Uganda Act), otherwise legitimate commercial interests.*
Where we rely on consent (for example, certain cookies or marketing), you can withdraw it at any time without affecting processing already carried out.
International data transfers#
In shortWhen data moves outside South Africa, we make sure it stays protected to POPIA and GDPR standards.
Some of our sub-processors are located outside South Africa, so your information may be transferred and processed in other countries. We only make such transfers where the law allows and appropriate safeguards are in place.
- Under POPIA section 72, we transfer personal information across borders only when the recipient is subject to comparable protection, the transfer is necessary to perform our contract with you, or you have consented.
- Under GDPR, transfers out of the EEA rely on an adequacy decision or on appropriate safeguards such as Standard Contractual Clauses, together with any additional measures needed to protect the data.
- Where you can select a hosting region for your services, we honour that choice for the customer content stored there.
How long we keep data#
In shortWe keep personal information only as long as needed for the purpose it was collected, then delete or anonymise it.
Retention periods depend on the type of data and our legal obligations. The following are our general guidelines; specific periods may vary where the law requires.
| Data | Retention period |
|---|---|
| Account & contact data | For the life of your account, then up to 12 months after closure unless a longer period is legally required |
| Customer content & stored data | For as long as your service is active; deleted or returned after termination according to your contract, subject to a short backup rotation window |
| Billing & tax records | Up to 5 years (or longer) as required by South African tax and company law |
| Support communications | Up to 24 months after a ticket is resolved |
| Technical & security logs | Typically 12 months, with security-relevant logs kept longer where needed for investigations |
| Marketing preferences | Until you unsubscribe, plus a suppression record so we honour your opt-out |
When a retention period ends, we securely delete or irreversibly anonymise the information.
Your privacy rights#
In shortYou can access, correct, delete, object to, and export your personal information, and complain to a regulator if you are unhappy.
Subject to Uganda's Data Protection and Privacy Act, 2019, South Africa's POPIA, and the GDPR where applicable, you have the following statutory rights over your personal data:
- Access
- Ask whether we hold personal data about you and obtain confirmation and a copy without charge (Section 24 of the Uganda Act; POPIA §23; GDPR Art 15).
- Rectification
- Require us to correct, update, or complete inaccurate or misleading personal data (Section 16 of the Uganda Act; POPIA §24; GDPR Art 16).
- Erasure & Blocking
- Request the deletion, destruction, or blocking of personal data that is unwarranted, outdated, or no longer necessary for the lawful purpose collected (Section 26 of the Uganda Act; POPIA §24; GDPR Art 17).
- Prevention & Objection
- Require us to cease processing likely to cause unwarranted damage or distress (Section 25 of the Uganda Act), object to legitimate-interest processing, and object unconditionally to direct marketing at any time (Section 27 of the Uganda Act).
- Portability
- Where technically feasible and provided by applicable regulation, receive data you provided in a structured, commonly used machine-readable format.
- Withdraw consent
- Withdraw any previously granted consent at any time without affecting lawful processing conducted prior to withdrawal.
- Complain
- Lodge a statutory complaint with the Personal Data Protection Office (PDPO) in Uganda (Form 6 under Regulation 32), the Information Regulator in South Africa, or your national supervisory authority.
To exercise any of these rights, email our privacy team. We will verify your identity and respond within the timeframes set by applicable law. These rights are free to use, though we may decline or charge a reasonable fee for requests that are clearly excessive or repetitive, and some rights have legal limits.
If you are an end user of our customer
If your data sits on our platform because you deal with one of our business customers (for example, you email an address they host with us), that customer is the responsible party. Please direct your request to them; we will support them in responding.
How we protect your data#
In shortWe use layered technical and organisational safeguards to keep your information secure.
We apply encryption in transit, access controls, network security, monitoring, and regular backups, and we limit access to personal information to staff who need it. No system is perfectly secure, but we work continuously to reduce risk and to respond quickly to incidents.
For a fuller description of our controls and how to report a vulnerability, see our security practices. If a security compromise affects your personal information, we will notify you and the Information Regulator as required by POPIA.
Information and Privacy Security#
In shortTechnical and organisational safeguards enforced under Section 20 of the Data Protection and Privacy Act, 2019.
Pursuant to Section 20 of the Data Protection and Privacy Act, 2019 (Uganda) and the Data Protection and Privacy Regulations, 2021, Digitel Africa implements and maintains technical and organisational measures to ensure the security, integrity, and confidentiality of personal data against unlawful access, alteration, loss, or destruction.
- Access Control & Authentication — Administrative and production access requires Multi-Factor Authentication (MFA). Access is granted strictly on the basis of Role-Based Access Control (RBAC) and least privilege, and is revoked promptly upon role change or departure.
- Data Encryption — Data in transit across public, API, and web interfaces is encrypted using TLS (TLS 1.2+). Customer data at rest, including database volumes and backups, is encrypted using AES-256. Encryption keys are managed and rotated separately from stored data.
- Network Isolation — Production systems operate in segmented networks. Databases reside in private subnets with default-deny firewall configurations and zero direct public internet ingress.
- Data Retention & Secure Disposal — Personal data is retained only for the duration necessary to deliver contracted services, satisfy contractual commitments, or meet statutory obligations. Data is securely deleted upon contract completion.
- Statutory Breach Notification — In accordance with Section 23 of the Act, if personal data is confirmed or suspected to have been accessed or acquired by an unauthorized person, written notification is submitted immediately to the Personal Data Protection Office (PDPO) and affected data subjects are notified without delay.
- Cross-Border Data Safeguards — Pursuant to Regulation 30, personal data is not transferred or stored outside Uganda without adequate safeguards or requisite legal basis.
- Data Protection Officer — Statutory compliance is overseen by the designated Data Protection Officer, contactable at [email protected].
Children's privacy#
In shortOur services are built for businesses and are not directed at children.
Our services are intended for businesses and the professionals who work in them. We do not knowingly collect personal information from children under 18, and we do not target our services at children.
If you believe a child has provided us with personal information without appropriate consent, please contact our privacy team and we will take steps to delete it.
Changes to this policy & how to contact us#
In shortWe will tell you about material changes, and you can reach our privacy team or the Information Regulator with any concerns.
We may update this policy as our services, the law, or our practices change. When we make material changes, we will update the version and dates at the top of this page and, where appropriate, notify you by email or an in-product notice. The current version is 2.2, effective 2026-08-01 and last updated 2026-10-14.
Contact us
For general privacy inquiries or to exercise your rights, contact our Privacy team at [email protected]. For statutory inquiries under the Data Protection and Privacy Act, 2019, contact our Data Protection Officer directly at [email protected].
Complaints to the regulator
In Uganda, complaints may be lodged with the Personal Data Protection Office (PDPO) via email at [email protected] or through the official portal at pdpo.go.ug.
In South Africa, complaints may be lodged with the Information Regulator (South Africa) via inforegulator.org.za. If GDPR applies to you, you may complain to the competent data protection authority in your country of residence.
Questions about this privacy policy?
Our data protection officer is here to help. Email us and a real person will get back to you.