Privacy Policy

The statutory data controller responsible for your personal information is TuDu Uganda Limited, a company incorporated under the laws of the Republic of Uganda and registered with the Personal Data Protection Office (PDPO) pursuant to the Data Protection and Privacy Act 2019. Registered Corporate Name: TuDu Uganda Limited Company Registration Number: 80034912903 Uganda Revenue Authority TIN: 1018492041 Registered Corporate Office: Plot 14 Lumumba Avenue, Nakasero, Kampala, Uganda Data Protection Officer Contact: dpo@tudu.ug Supervisory Authority: Personal Data Protection Office (PDPO), National Information Technology Authority Uganda TuDu Uganda Limited operates the TuDu marketplace at tudu.ug and associated digital interfaces. This Privacy Policy sets out our processing standards, statutory legal bases, security safeguards, and your enforceable individual privacy rights.

We collect and process personal information across three operational categories: First, information provided directly by buyers and merchants during account setup, checkout, and merchant onboarding. This includes legal names, mobile phone numbers, email addresses, delivery district, physical delivery landmarks, and business tax details. We never store raw debit card numbers or mobile money wallet PINs. Second, technical telemetry captured automatically when you navigate the platform. This encompasses IP addresses, browser specifications, operating system versions, referring URLs, geofence delivery verification coordinates, and session timestamps. Third, merchant identity credentials collected under our strict Zero Unverified Selling mandate. Natural person sellers provide a Ugandan National Identification Number or valid passport and photographic liveness verification. These credentials are transmitted over encrypted tunnels to accredited verification authorities. TuDu retains solely an irreversible cryptographic hash of the National Identification Number alongside compliance audit timestamps. Plaintext identification numbers and biometric selfie photographs are never stored on TuDu servers.

TuDu processes personal data strictly in accordance with Section 7 of the Uganda Data Protection and Privacy Act 2019, Regulation 12 of the Data Protection and Privacy Regulations 2021, and Article 6 of the General Data Protection Regulation for international cardholders: Contractual Performance: Processing necessary to validate buyer orders, hold funds in statutory escrow trust accounts, instruct couriers, compute zone based delivery tariffs, and transfer merchant payouts upon verified completion PIN entry. Legal and Regulatory Compliance: Processing mandated by Ugandan statutory law, including the National Payment Systems Act 2020 (trust fund accounting), the Anti Money Laundering Act 2013 (customer due diligence records), the Tax Procedures Code Act 2014 (fiscal invoice issuance and VAT records), and Electronic Transactions Act 2011. Legitimate Commercial Interests: Processing necessary to maintain platform infrastructure security, prevent doorstep fraud, compute seller fulfillment reliability metrics, protect copyright intellectual property, and optimize catalog performance without overriding fundamental privacy rights. Affirmative Consent: Processing for optional product recommendation newsletters, referral campaign attribution, and non essential analytics cookies. You may revoke consent at any moment with prospective effect.

Your personal information is deployed exclusively for legitimate marketplace operations: 1. Facilitating order fulfillment, sub order splitting across multiple merchants, delivery routing, and real time tracking alerts via SMS, email, and WhatsApp. 2. Managing escrow lifecycles, dispute investigation, return to origin package bailment, and anti extortion doorstep verifications. 3. Transmitting transaction confirmation records, URA EFRIS fiscal receipts, and Bank of Uganda escrow settlement certificates. 4. Monitoring system reliability, mitigating distributed denial of service attempts, and authenticating administrative staff actions. 5. Providing sovereign customer support, warranty dispute mediation, and order defect remediation. TuDu does not sell, lease, rent, or trade personal data to third party marketing brokers or unauthorized commercial intermediaries.

We disclose personal data strictly on a need to know basis to authorized service providers bound by comprehensive data processing agreements: Merchant Sellers: Receive order recipient name, delivery district, physical landmark, and contact telephone number solely to package and label parcels. Merchants are legally prohibited from using customer data for external marketing or unauthorized off platform communication. Logistics and Delivery Partners: Authorized couriers, regional transport carriers, and partner pickup station personnel receive dispatch instructions, delivery addresses, and telephone contacts solely to complete delivery and verify completion PINs. Payment and Banking Gateways: Licensed financial institutions, including MTN Mobile Money, Airtel Money, and card processing through Flutterwave, receive payment reference amounts and phone numbers to clear funds into segregated trust accounts. Technical Cloud Infrastructure: Database hosting and encrypted object storage are maintained on ISO 27001 and SOC 2 certified server infrastructure located in secure European and regional facilities. Regulatory Authorities: Data is disclosed to the Uganda Revenue Authority, Bank of Uganda, Personal Data Protection Office, or judicial authorities solely when compelled by enforceable statutory mandates or court orders.

TuDu serves international diaspora buyers purchasing goods for delivery to recipients across Uganda. Cross border data transfers to cloud service providers outside Uganda are conducted in compliance with Section 19 of the Data Protection and Privacy Act 2019. We enforce standard contractual clauses providing equivalent data protection safeguards to those mandated under Ugandan law and European data protection regulations. International cardholders in the United Kingdom, European Union, and North America benefit from identical privacy safeguards, encrypted transit, and verifiable data erasure options.

Personal data is maintained according to strict statutory retention schedules: Customer Account Information: Maintained throughout active account tenancy and for 24 months following account closure or inactivity. Financial and Escrow Records: Order invoices, tax settlement certificates, seller payout ledgers, and transaction proofs are retained for ten years to satisfy statutory requirements under the Tax Procedures Code Act and Anti Money Laundering Act. Dispute and Evidence Files: Packaging photographs, unboxing evidence, and communication logs are retained for 36 months following dispute resolution to support warranty claims and appeals. Delivery Geofence Logs: Courier delivery verification coordinates and timestamps are retained for 90 days following completed delivery, after which coordinates are anonymized or purged. Upon expiry of retention mandates, personal data is irreversibly erased or anonymized through cryptographic data sanitization procedures.

TuDu enforces enterprise security measures designed to protect personal data against accidental loss, unauthorized access, alteration, or disclosure: 1. Mandatory 256 bit TLS encryption for all data in transit across public and internal networks. 2. Advanced cryptographic hashing for authentication tokens and merchant identification numbers. 3. Role based access controls and segregation of duties limiting data access to vetted staff members requiring operational clearance. 4. Two person authorization rules for high value escrow adjustments and administrative refunds. 5. Continuous automated vulnerability scanning, route guard instrumentation, and tamper evident audit logging.

Under the Uganda Data Protection and Privacy Act 2019, you possess sovereign statutory rights regarding your personal data: Right to Access: You may request confirmation of whether TuDu processes your personal information and receive an itemized copy of all stored records. Right to Rectification: You may update inaccurate, obsolete, or incomplete personal details directly within your account settings or via our support desk. Right to Erasure: You may request the permanent deletion of your account and personal data, subject to statutory financial retention requirements. Right to Restriction: You may request the temporary suspension of data processing during dispute investigations or accuracy verification. Right to Data Portability: You may request your order history and account data in a structured, commonly used, machine readable JSON format. Right to Object: You may object at any time to the processing of personal data for direct marketing or promotional notifications. To exercise your statutory rights, submit a privacy request through our Contact page or email dpo@tudu.ug. TuDu will evaluate and respond to verified statutory requests within thirty calendar days.

TuDu is an adult commercial marketplace. In accordance with Section 8 of the Data Protection and Privacy Act 2019 of Uganda, individuals under eighteen years of age are not permitted to register accounts, list merchant goods, or initiate financial transactions. We do not knowingly collect personal information from individuals under eighteen. If we determine that data of a minor has been gathered without verifiable parental consent, we take immediate steps to terminate the account and erase the information. Parents or guardians may report minor accounts directly to dpo@tudu.ug.

If you have concerns regarding our personal data handling practices, you are encouraged to contact our Data Protection Officer at dpo@tudu.ug. You also maintain the statutory right to submit a formal complaint directly to the Personal Data Protection Office of Uganda: Personal Data Protection Office (PDPO) National Information Technology Authority Uganda Statistics House, Plot 9 Colville Street, Kampala, Uganda Website: pdpo.go.ug Email: info@pdpo.go.ug General inquiries regarding this policy may be delivered to TuDu Uganda Limited, Plot 14 Lumumba Avenue, Nakasero, Kampala, Uganda.