Privacy Policy

1. Statutory Compliance

Swap Africa collects, processes, and protects personal data in strict compliance with the Data Protection and Privacy Act, 2019 of Uganda and the Data Protection and Privacy Regulations, 2021.

2. Information We Collect

• Buyers (Guest Sessions): 24-hour guest session tokens stored solely as SHA-256 cryptographic hashes, payment phone numbers, and delivery drop-off addresses.
• Sellers: Phone numbers (authenticated via OTP), profile information, government-issued KYC verification documents (National ID/Passport), and shop logos.
• Riders / Couriers: Vetting credentials, contact details, payout destination phone numbers (used for account holder name verification and mobile money earnings disbursement), and real-time location data transmitted during active delivery gigs.

3. Data Security & Storage Safeguards

Data is encrypted in transit (TLS 1.3 / HTTPS) and at rest (AES-256). Private KYC files are stored securely in isolated storage and are accessed by authorized administrators strictly via short-lived 60-second signed URLs. Raw session tokens, security PINs, and authorization secrets are never stored in plain text or logged in system traces.

4. Information Sharing & Third Parties

Personal data is shared strictly as required to process transactions:

• Licensed Mobile Money Operators (MTN Mobile Money, Airtel Money) for account holder verification, funding collections, refunds, and earnings payouts.
• SMS delivery partners for transaction One-Time Passwords (OTPs) and notifications.
• Assigned delivery riders (receiving buyer contact name and drop-off coordinates during active delivery).
• Regulatory authorities (Financial Intelligence Authority, Bank of Uganda) when mandated by statutory law.

5. Retention, In-App Account Deletion & Your Rights

Financial ledger records and audit logs are retained for 7 years as required under statutory financial laws. Temporary guest session records expire and are deleted after 24 hours.

In-App Account Deletion: Registered users and riders can delete their accounts at any time directly within the application under Account / Settings > Delete Account. Deleting your account permanently revokes your authentication credentials, terminates active sessions, and deletes or anonymizes non-statutory personal data.

Under the Data Protection and Privacy Act, 2019, you have the right to access, correct, or request deletion of your personal data, and to object to processing. Contact our privacy team at privacy@swapafrica.online to submit a request.