Privacy Policy.

Tuku-Tuku Innovation Labs (“Tuku-Tuku”, “Tuku”, “we”, “our” or “us”) develops and operates websites, mobile applications, software platforms, APIs, artificial intelligence services and related digital products.

This Privacy Policy explains how we collect, use, share, store, protect, retain and delete personal information when you use a Tuku-Tuku product or interact with us.

1. Scope of this Policy

This policy applies across the Tuku-Tuku product ecosystem, including current and future websites, Android and other mobile applications, software platforms, APIs, AI features, dashboards, programme tools and related services. We refer to these collectively as the “Tuku Services”.

Depending on the functionality used, Tuku Services may include products for business management, financial operations, business intelligence, mapping, mobility, logistics, lending, impact and programme management, traceability, resilience, opportunity discovery, productivity, prediction and AI-assisted analysis.

Some products or features may provide additional privacy notices or in-app disclosures. Those notices supplement this policy and explain any product-specific processing that requires additional detail.

2. Who is responsible for your information

Unless another organisation is identified to you as the controller of particular information, Tuku-Tuku Innovation Labs is responsible for personal information collected directly through the Tuku Services.

Tuku-Tuku operates from Uganda and processes personal data in accordance with applicable law, including Uganda's Data Protection and Privacy Act, 2019 and applicable regulations.

Where you use a Tuku Service through an employer, school, cooperative, development programme, institution, government body, business or other customer, that organisation may control some information and Tuku-Tuku may process it on the organisation's behalf. In those circumstances, the organisation's privacy rules may also apply.

3. Information we may collect

The information we collect depends on the Tuku Service, your role, the features you use and the permissions you grant.

Account and identity information

• name, username and profile information;
• email address and telephone number;
• organisation, business, school, programme or team membership;
• job title, role and access permissions;
• account identifiers and authentication information; and
• account preferences and settings.

Passwords are not intended to be stored in readable form. Authentication credentials are handled using appropriate authentication and security systems.

Business and organisational information

• business names, registration details and business profiles;
• business, farm, branch, collection-centre or service locations;
• products, services, suppliers, customers and team information;
• inventory, sales, operations and workflow information;
• programme, monitoring, resilience, risk and performance information; and
• documents or records uploaded by authorised users.

Financial and transaction information

Certain Tuku Services may process prices, income, expenses, invoices, receipts, payroll, tax-related information, cash-flow information, financial projections, loan information, payment references or other financial and commercial records.

Where a payment is handled directly by a bank, mobile-money operator, app store or payment processor, that provider may process payment credentials independently. Tuku-Tuku does not require access to complete card credentials where a payment provider can process them directly.

Location and mobility information

Some Tuku Services rely on location to provide their core functionality. Depending on the service and the permissions you grant, we may process approximate or precise location, GPS coordinates, mapped business or farm locations, journey origins and destinations, route information, traffic or incident locations and location generated during an active journey or field activity.

If a feature requires background location, the relevant application will provide the required disclosure and request the applicable device permission. You can control location permissions in your device settings, although disabling location may prevent some features from functioning.

Camera, photographs, media and documents

Certain products may allow you to take or upload photographs, documents, receipts, identity records, incident images, farm or product images or other media. Camera or media access is used when required for a feature you choose to use and subject to device permissions.

Audio and microphone information

If a Tuku Service provides voice input, recording, speech recognition or voice-enabled AI functionality, it may process audio that you intentionally provide. We do not access your microphone unless the relevant functionality requires it and the required device permission has been granted.

Messages and communications you choose to provide

Some Tuku Services may allow you to forward, import, share or create messages, notes, email content, SMS content or other communications for productivity, record-keeping or AI assistance. We process such content only when you choose to provide it or when an authorised organisation has configured a permitted integration.

Contacts and address-book information

If a feature allows you to invite, select or communicate with contacts, an application may request access to contacts only where that functionality requires it and subject to your device permission. Where possible, we limit processing to the contact information necessary for the requested feature.

NFC, QR and connected-device identifiers

Some products may use NFC tags, QR codes, Bluetooth or similar device functions to identify assets, products, records, locations or physical items. We process the identifiers needed to connect the physical item with the relevant digital record.

Device, diagnostic and usage information

• IP address, device type, operating system and browser type;
• app version, device or installation identifiers and notification tokens;
• language, time zone and network information;
• crash reports, diagnostic logs and security events;
• screens, pages and features used; and
• timestamps and related service-usage information.

Information supplied by other users or organisations

We may receive information about you when an organisation creates or manages an account for you, an administrator invites you to a workspace, a business records you as an employee, supplier, customer or contact, a programme registers you, another user shares a record with you, or authorised data is imported into a Tuku Service.

Organisations using Tuku Services are responsible for ensuring that they have an appropriate legal basis to provide personal information to us.

4. How we use information

We may use personal information to:

• provide, operate and maintain the Tuku Services;
• create, authenticate and manage accounts;
• provide role-based access to products, organisations and workspaces;
• synchronise information between mobile applications, websites and backend systems;
• provide requested features, reports, calculations, forecasts, recommendations and analytics;
• provide artificial-intelligence and machine-learning functionality;
• process transactions and maintain records;
• support mapping, navigation, field activity and location-based features;
• send security alerts, service messages and requested notifications;
• provide customer support and troubleshoot technical problems;
• measure product performance and improve usability, reliability and security;
• prevent fraud, abuse and unauthorised access;
• protect users, organisations and Tuku-Tuku systems;
• comply with legal, regulatory and contractual requirements; and
• develop and improve Tuku Services using aggregated, de-identified or appropriately protected information.

5. Artificial intelligence and automated processing

Some Tuku Services include artificial intelligence, machine learning or automated analysis. Information you submit to an AI feature may be processed to produce the requested answer, recommendation, prediction, classification, summary or other output.

AI processing may use Tuku-managed infrastructure or approved service providers. Access to information within Tuku AI systems is designed to respect product, organisation, workspace and user permissions. Access to an AI feature does not automatically give a user access to information belonging to another user, organisation or product.

We do not intentionally make private account or organisational information public through an AI feature.

If we introduce a materially different use of personal information for general-purpose model training or another purpose beyond providing, securing and improving the relevant services, we will provide appropriate notice and obtain consent where required by law.

6. Legal bases for processing

Depending on the circumstances and applicable law, we process personal information because processing is necessary to provide a service or perform a contract; you have given consent; processing is required by law; processing is necessary for legitimate interests such as security, fraud prevention, service reliability and product improvement where those interests are not overridden by your rights; or another lawful basis applies.

Where processing is based on consent, you may withdraw that consent. Withdrawal does not affect processing that was lawful before consent was withdrawn.

7. How we share information

We do not sell personal information.

We may disclose information to:

• service providers supporting hosting, databases, authentication, communications, file storage, AI, maps, analytics, security, diagnostics and payment processing;
• organisations you belong to, where authorised administrators need access to information associated with their organisation or workspace;
• people or organisations you choose to share with through public listings, team invitations, shared documents, marketplace features or other sharing functionality;
• authorities or other parties where reasonably necessary to comply with law, court orders, lawful requests, fraud or security investigations, or to protect rights, property or safety; and
• successors or transaction parties in connection with a merger, acquisition, financing, restructuring or transfer of business assets, subject to applicable privacy requirements.

8. International and cross-border processing

Tuku-Tuku is based in Uganda, but some infrastructure and service providers may operate in other countries. Where personal information is transferred or processed outside Uganda, we take appropriate steps required by applicable law to protect the information.

Depending on the circumstances, these measures may include contractual protections, processor obligations, security measures, assessment of the receiving jurisdiction and consent or other authorisation where required.

9. Security

We use technical and organisational measures designed to protect information against accidental or unlawful loss, destruction, alteration, disclosure or access. Depending on the service, these measures may include encrypted network connections, secure authentication, password hashing, role-based access, database controls, user and organisation isolation, audit logging, monitoring, backups, security updates and least-privilege access.

No internet-connected system can guarantee absolute security. You should protect your credentials and notify us promptly if you suspect unauthorised access.

10. Data retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, to provide the Tuku Services, maintain security, satisfy contractual obligations and comply with applicable legal, accounting or regulatory requirements.

Retention periods differ by category of information and product. Account information is ordinarily retained while the account remains active. Following deletion, personal information associated with the account will ordinarily be deleted or de-identified within a reasonable period unless retention is necessary for security, fraud prevention, dispute resolution, financial record-keeping, legal compliance or another lawful purpose.

Information may remain temporarily in encrypted or disaster-recovery backups until those backups are overwritten under our normal backup cycle. Aggregated or irreversibly de-identified information may be retained for analytics, research, planning and product improvement.

11. Account and data deletion

Where a Tuku application allows you to create an account, you may request deletion of your account and associated personal information through the account or privacy settings of the relevant application where available, or through Tuku-Tuku's external account-deletion process.

Request account deletion

We may take reasonable steps to verify that you are authorised to delete the account. Deleting an account is different from signing out, disabling notifications or temporarily deactivating an account.

Following a valid deletion request, we will delete or de-identify personal information associated with the account except information we are legally permitted or required to retain. Where information belongs to an organisation's legitimate business or programme records, deleting an individual's account may not require deletion of those organisational records.

12. Your privacy rights

Subject to applicable law, you may have the right to:

• know whether we process information about you;
• request access to personal information;
• request correction of inaccurate or incomplete information;
• request deletion or destruction where applicable;
• object to or request restriction of certain processing;
• withdraw consent where processing relies on consent;
• receive information about how and why your information is processed; and
• lodge a complaint with an appropriate data-protection authority.

We may need to verify your identity before fulfilling a request. Certain rights may be limited where processing or retention is required by law or necessary to protect the rights of another person.

13. Device permissions

Tuku applications request device permissions only where relevant to a feature. Depending on the product, this may include:

• Location for navigation, traffic information, field mapping, business or farm mapping and journey tracking;
• Camera and media for photographs, documents, receipts, identity records, incident reports or product records;
• Microphone for voice-enabled features;
• Contacts for contact-selection or invitation features where offered;
• Notifications for alerts, reminders, service messages and updates; and
• NFC or related device functions for supported tags, assets or identification workflows.

You can generally change permissions in your device settings. Removing a permission may cause the associated feature to stop working. Where required, we provide prominent in-app disclosure before collecting sensitive information in circumstances where the collection may not be reasonably expected.

14. Cookies and similar technologies

Our websites and web applications may use cookies, local storage, session storage or similar technologies to maintain signed-in sessions, remember preferences, protect accounts, understand product usage, measure performance and diagnose problems. Where legally required, non-essential technologies will be used subject to appropriate user choice or consent.

15. Analytics and diagnostics

We may collect service usage, crash and performance information to understand how Tuku Services are used and to improve them. Where reasonably possible, we use aggregated or de-identified information for product analytics. We do not use analytics as a means of selling personal information.

16. Communications

We may send communications necessary to operate your account or provide a service, including security alerts, authentication messages, transaction confirmations, support responses, service notices and programme notifications.

Where we send marketing communications, you may opt out. Opting out of marketing does not prevent us from sending essential service or security communications.

17. Children and young people

Most Tuku Services are intended for businesses, professionals, organisations or users capable of entering into the relevant service agreement. A Tuku Service is not intended for independent use by a child unless the product is specifically designed or deployed for children, students or young people.

Where a product processes information relating to a child, we require an appropriate lawful basis and, where applicable, consent or authorisation from a parent, guardian, school, institution or other legally authorised person. We seek to limit children's information to what is reasonably necessary for the relevant service.

If you believe a child's personal information has been collected without appropriate authority, contact us.

18. Organisation and administrator responsibilities

Organisations using Tuku Services may collect and manage information concerning employees, customers, farmers, students, beneficiaries, members, suppliers or other individuals. Those organisations are responsible for having an appropriate legal basis, providing required privacy notices, granting access only to authorised personnel and using information obtained through the Tuku Services only for legitimate authorised purposes.

Tuku-Tuku may suspend access where we reasonably believe a user is accessing or processing personal information without authority.

19. Third-party websites and services

Tuku Services may link to or integrate with payment platforms, mapping services, communication services, app stores or other third-party products. Their independent processing is governed by their own privacy policies. Tuku-Tuku is not responsible for the independent privacy practices of third parties you choose to use outside the Tuku Services.

20. Google Play and mobile application disclosures

For Tuku applications distributed through Google Play, this Privacy Policy applies together with the Data safety information on the app's Play listing, permissions and disclosures shown within the application, and any product-specific privacy notice.

Because different Tuku applications provide different functionality, the categories of data actually collected by one app may differ from another. The Data safety declaration for each app is intended to reflect the actual behaviour of that application and its included software development kits.

Where a Google Play application permits account creation, Tuku-Tuku provides a mechanism to request deletion of the account and associated personal data, subject to legitimate retention requirements described in this policy.

21. Changes to this Privacy Policy

We may update this Privacy Policy when our products, technology, legal requirements or data-processing practices change. When we make material changes, we will update the “Last updated” date and, where appropriate, provide additional notice through a Tuku Service, email or another appropriate channel.

22. Contacting Tuku-Tuku about privacy

Questions, complaints, access requests and deletion requests concerning privacy may be directed to:

Tuku-Tuku Innovation Labs
Gulu, Uganda
info@tukutuku.org
tukutuku.org

When contacting us about a privacy matter, please identify the relevant Tuku Service and use the subject line “Privacy request” where practical.

23. Complaints to the regulator

If you are in Uganda and believe your personal information has been handled in violation of applicable data-protection law, you may have the right to lodge a complaint with Uganda's Personal Data Protection Office (PDPO). Contacting Tuku-Tuku first does not affect your right to contact a regulator.