Privacy Policy

Effective Date: October 2026 • Version 2.4

At AX Technologies Uganda ("we", "us", "our", or "the Company"), operating from Bushenyi, Western Uganda, we hold the privacy, integrity, and confidentiality of our clients, institutional partners, staff, students, patients, and consumers in the highest regard. This Privacy Policy outlines the standards, procedures, and legal safeguards governed by the Data Protection and Privacy Act, 2019 of the Republic of Uganda, the Computer Misuse Act, 2011 (as amended), the Electronic Transactions Act, 2011, and guidelines from the National Information Technology Authority Uganda (NITA-U).

This Policy applies to all digital applications, portals, APIs, cloud services, and enterprise software suites engineered, operated, and maintained by AX Technologies Uganda, including but not limited to SmartSchool.ug, TradeDesk POS, SmartPharma.ug, SmartCare.ug, BizBooks.ug, and bespoke web platforms developed for our enterprise clients.

1. Principles of Data Protection

In accordance with Section 3 of the Uganda Data Protection and Privacy Act 2019, AX Technologies Uganda adheres strictly to the following fundamental principles across all software engineering and data hosting operations:

• Lawfulness, Fairness, and Transparency: All personal and organizational data is collected and processed with explicit authorization, lawful purpose, and clear visibility to the institutional data controller.
• Purpose Specification and Limitation: Information collected for educational management, point of sale processing, medical records, or accounting is processed strictly within that intended functional domain.
• Data Minimization: We only collect information strictly required to operate the requested software modules, grade report cards, process payments, or maintain accounting ledgers.
• Data Quality and Accuracy: Our software architecture includes automated validation routines to prevent corrupted, duplicated, or inaccurate entries.
• Storage Limitation: Data is preserved only for the duration stipulated by educational guidelines, tax statutes, health regulations, or contractual retention terms.
• Integrity and Confidentiality: Enterprise-grade cryptography, isolated relational database instances, and role-based permissions safeguard all stored records against unauthorized breach, theft, or tampering.

2. Categories of Information We Process

Depending on the software system deployed by your institution or enterprise, we process the following categories of information:

A. SmartSchool.ug (Primary & Secondary Educational ERP)

• Student Academic Information: Student registration numbers, full names, gender, dates of birth, class streams, subject combinations, Continuous Assessment formative marks (Activities of Integration - AoI), summative examination scores, and New Lower Secondary CBC grading descriptors.
• Institutional Bursar Records: School fees collection ledgers, payment voucher reference numbers, scholarship records, and student tuition balances.
• Parent and Guardian Contacts: Telephone numbers and email addresses used solely for automated SMS broadcast alerts (end-of-term report release notifications and bursar fees payment receipts).
• Teacher and Staff Portals: Staff identifiers, subject allocations, and encrypted administrative access credentials.

B. TradeDesk POS (Wholesale & Retail Point of Sale)

• Commercial Transaction Records: Itemized invoice details, inventory product barcodes, retail vs. wholesale unit pricing, and cashier terminal shift logs.
• Digital Payment Telemetry: Mobile Money transaction reference IDs, telecom carrier timestamps (MTN MoMo and Airtel Money), and masked payment amounts. We do not store personal MoMo PINs or carrier wallet security codes.
• Supplier and Stock Ledgers: Wholesale distributor contacts, purchase order receipts, and reorder alerts.

C. SmartPharma.ug (Pharmacy Dispensing & Batch Management)

• Pharmaceutical Inventory: Drug names, batch numbers, manufacturer dates, expiry thresholds (30/60/90 days alarms), and wholesale purchase costs.
• Prescription Dispensing Data: Prescribing clinician names, verification timestamps, dosage notes, and customer purchase receipts.

D. SmartCare.ug (Hospital Information Management System & EMR)

• Patient Clinical Records: Outpatient and inpatient identifiers, triage vital signs (blood pressure, temperature, pulse), consultation clinical notes, diagnosis coding, laboratory examination requests and results, and ward bed allocations.
• Healthcare Compliance: Strict adherence to doctor-patient confidentiality and Uganda Ministry of Health ethical guidelines for Electronic Medical Records (EMR).

E. BizBooks.ug (Cloud Bookkeeping & Accounting)

• Financial Ledgers: Chart of accounts, general journal entries, accounts receivable and payable, expense receipts, cash flow analytics, balance sheets, and tax identification numbers (TIN) for URA compliance.

F. Website Inquiries & Technical Support

• Inbound Communications: Full name, organizational email address, telephone/WhatsApp contact, and specific project requirements submitted via our contact portal.

3. Multi-Tenant Architectural Isolation & Security Safeguards

Security is engineered into our core application architecture rather than applied as an afterthought:

• Tenant Database Isolation: Each school, enterprise, clinic, and merchant operates within a logically segregated database schema or partitioned container. Tenant A cannot read, query, or leak data into Tenant B's environment.
• Cryptographic Encryption: All client-to-server traffic is transmitted over Transport Layer Security (TLS 1.3 / SSL 256-bit encryption). Sensitive secrets and passwords are cryptographic hashes generated using modern salted hashing algorithms (Argon2 / Bcrypt).
• Role-Based Access Control (RBAC): Within each software system, administrative privileges are partitioned. For example, in SmartSchool.ug, a classroom teacher cannot view bursar school fees balances, and an ordinary cashier in TradeDesk POS cannot modify wholesale cost prices without administrative supervisor clearance.
• Continuous Backup Protocols: Automated database snapshots are executed every 24 hours and stored in secure, encrypted offsite cloud storage to guarantee disaster recovery.

4. Third-Party Integrations & Telecom Gateways

To deliver operational automation across Uganda, our software integrates with licensed telecommunication operators and utility gateways:

• Telecom Mobile Money APIs: TradeDesk POS integrates with MTN Mobile Money Uganda and Airtel Money Uganda. Payment transactions are executed directly through authorized telecom API gateways. We receive and store only confirmation reference codes and amounts.
• SMS Broadcast Gateways: SmartSchool.ug connects to licensed Ugandan SMS gateways (UCC-compliant shortcodes) strictly to dispatch school receipts and academic notices. Contact phone numbers are never shared with bulk advertising networks.

5. Data Subject Rights Under Uganda Law

Under Sections 24 through 30 of the Uganda Data Protection and Privacy Act 2019, individuals whose personal data is processed through our systems retain specific enforceable rights:

1. Right to be Informed: The right to know what personal data is being processed, the lawful grounds, and the retention timeframe.
2. Right of Access: The right to request a verifiable copy of all personal records held in the system.
3. Right to Rectification: The right to correct inaccurate, outdated, or incomplete academic, financial, or demographic entries.
4. Right to Erasure ('Right to be Forgotten'): The right to request deletion of personal records where there is no overriding statutory obligation (such as tax audits or official academic registry archives).
5. Right to Object: The right to object to automated data processing or specific notification dispatches.
6. Right to Data Portability: The right of an institution to export their records in standard machine-readable formats (CSV, Excel, JSON, SQL) upon offboarding.

6. Children's Educational Privacy Safeguards

SmartSchool.ug processes the academic performance records of primary and secondary school students. We recognize the heightened sensitivity of minor student data under Ugandan law:

• Educational records are processed strictly on behalf of the registered school administration acting in loco parentis.
• Student records are accessible only to authenticated teachers, headteachers, and verified parents for their own children.
• Student performance data is never indexed by public search engines or made available without authorized institutional login credentials.

7. Incident Notification & Data Breach Protocol

In the unlikely event of a security compromise or unauthorized data access affecting our infrastructure:

• AX Technologies Uganda will notify affected institutional data controllers in writing within 72 hours of confirmation.
• We will cooperate fully with institutional administrators and the Personal Data Protection Office (PDPO) under NITA-U to contain the incident, disclose the affected scope, and restore normal operations.

8. Contact the Data Protection Officer (DPO)

For inquiries regarding this Privacy Policy, data subject access requests, or regulatory audits, contact our compliance desk: