Data Protection at AfrikCap

Where your data lives

Application data and documents are stored with Supabase in the European Union (Ireland). CRM records go to Zoho in India; product analytics to PostHog in the United States. All transfers outside Uganda rest on your express consent, collected separately on every form, under Section 19 of the Data Protection and Privacy Act (Cap 97).

How it is protected

• Encryption in transit and at rest; private storage buckets with short-lived signed links
• Role-based access — only the people who need your data to process your application can see it
• Passwords stored as bcrypt hashes; one-time codes for employee login; audit logs

Your controls

• View and withdraw your consents in the app under Privacy & Consents
• Access, correct, erase or object: email dpo@afrikcap.com — response within 30 days
• Complaints: dpo@afrikcap.com first, then the Personal Data Protection Office (www.pdpo.go.ug)

Agents and biometrics

Field agents verify their identity with a live selfie at daily check-in (fraud prevention only — never surveillance or productivity tracking). Failed checks go to a human supervisor, not an automatic lock-out. Details in section 4 of the Privacy Policy.