Privacy Notice

1. Who is responsible

BISA AIDE GROUP LIMITED, a private company limited by shares incorporated in Uganda under the Companies Act, Cap 106 (company number 80046834022644), decides how and why your personal data is used, and is the data controller for the purposes of Uganda's Data Protection and Privacy Act, 2019 and its Regulations.

Registered office: Kyebando Central, Kyebando, Kawempe Division, Kampala. Postal address: P.O. Box 220384, Kampala GPO.

For anything about your data, write to support@bisaaidegroup.com, or message us on WhatsApp at +256 767 359 989. A person reads it.

2. What we collect

If you enquire or become a client: your name, email, phone number, and what you told us you need. Then, as we work together: your business name and registration number, TIN, district, sector, directors and shareholders, financial year end, turnover where relevant, and the documents you upload so a filing can be made.

To match you with the right person: the language you prefer to work in, where you are, your sector, and whether you are already registered. We ask these because they change who handles your work and what it costs — not to build a profile of you.

If you work with us as a professional: your name, contact details, qualification, practising number, TIN, tax residency, the documents proving your credential, and the account details you are paid into.

Payments: we do not store card numbers. Card and mobile-money details are handled by our payment providers, who are responsible for them.

Using the site: basic technical records our hosting creates — an IP address, a browser type, the pages served. We do not use advertising trackers and we do not sell anything to anyone.

3. Why we are allowed to use it

We use your data to perform the contract you entered into with us; to meet our own legal obligations, including tax and anti-money-laundering requirements; and, in a limited way, for our legitimate interests in running the business — keeping records straight, preventing fraud, and improving how the service works. Where we rely on your consent, such as publishing a professional's profile, you can withdraw it at any time.

4. Who sees it

The licensed professional handling your matter, and anyone named as working alongside them on it. They see the job they are working on and nothing else — that separation is enforced by the system, not by policy.

Public bodies, where a filing requires it — URSB, URA, your local authority. That is the point of the service.

Our administrators, who coordinate the work and approve payments.

Service providers who process data on our instructions: Supabase (database and file storage), Vercel (hosting), Resend (email), Anthropic (AI-assisted drafting), and our payment providers. They act on our instructions and may not use your data for their own purposes.

We do not sell personal data, and we do not share it for marketing.

5. Where it goes

Some of these providers process data outside Uganda, including in the European Union and the United States. Where data leaves Uganda we rely on contractual protections with each provider requiring security and confidentiality at least equivalent to what the Act requires. If you would rather your matter were handled without a particular provider, tell us and we will explain what is possible.

6. How it is protected

Access is default-deny: a professional cannot see another professional's work or earnings, and a client cannot see another client's file. That is enforced in the database itself rather than by the application, so a fault in a screen cannot expose the wrong records.

Bank and mobile-money numbers are encrypted before storage with a key held outside the database, so a stolen copy of the database contains no usable account numbers. They are decrypted only at the moment a payment is prepared, and every such access is recorded with the name of the person who did it and the reason they gave. Administrator accounts require a second factor beyond email.

Documents you upload are stored privately and are not publicly reachable. Professional photographs are public, because their purpose is to be seen.

7. AI-assisted work

Some steps use AI to draft or organise — for example turning a CV into a profile, or proposing the steps a job breaks into. Where that happens, the relevant text is sent to our AI provider for processing and is not used to train their models.

Every AI-produced output is a draft. A qualified person reviews it before anything is filed, published or acted on. No decision that affects you — whether to take your work, what to charge, what to file — is made by an automated system alone.

8. How long we keep it

Company and tax filings, and the records supporting them, are kept for the periods Ugandan law requires — generally at least six years. Identity verification records are kept as long as required by anti-money-laundering rules. Enquiries that never become clients are deleted after two years. Payment records are kept for seven years.

Where you ask us to delete something we are not required to keep, we will.

9. Your rights

Under the Act you may ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything that is wrong or out of date;
• delete data we no longer have a lawful reason to keep;
• stop using your data for a particular purpose;
• withdraw a consent you gave us.

Write to support@bisaaidegroup.com. We will respond within thirty days, and we will not charge you for a reasonable request.

If you are unhappy with how we have handled your data, tell us first — we would rather fix it. You also have the right to complain to Uganda's Personal Data Protection Office.

10. Children

Our services are for people running or starting businesses, and are not directed at children. We do not knowingly collect data about anyone under 18.

11. Changes

If we change how we use your data in a way that materially affects you, we will tell you by email before it takes effect, and the date at the top will change.

See also our Terms of Service.