Privacy Policy

Effective and last updated: 5 October 2026

This Privacy Policy explains how NEKSES INVESTMENT LTD ("SASA", "we", "us", or "our") handles personal data when authorised users, customers, suppliers, employees, and other business contacts use SASA services or receive communications generated through the platform.

1. Information we collect

• Account information: names, usernames, work contact details, roles, organisation details, and authentication and security records.
• Business records: sales, purchases, invoices, payments, debts, returns, inventory, payroll, delivery, supplier, customer, and audit information entered by an authorised organisation.
• Communications: telephone numbers, message contents, campaign preferences, WhatsApp or SMS message identifiers, and available delivery status.
• Technical information: IP address, device and browser information, cookies, timestamps, diagnostic logs, and security events.
• Support information: information supplied when requesting help, exercising a privacy right, or reporting a problem.

2. How we use information

We use personal data to provide and secure the service; authenticate users; process business transactions; generate operational and financial records; deliver requested SMS, email, and WhatsApp communications; provide support; prevent misuse and fraud; maintain audit trails; comply with law; and improve reliability.

3. Legal grounds and organisational customers

We process information where it is necessary to provide contracted services, comply with legal obligations, pursue legitimate and lawful business purposes, protect users and the service, or where valid consent has been provided. An organisation using SASA controls the business information its authorised users enter and is responsible for having an appropriate basis to collect and use that information.

4. Communications and WhatsApp

SASA may send transactional notices about debts, payments, sales, or other business activity to numbers supplied by an authorised organisation. Official WhatsApp Business Platform services are provided by Meta. Meta and telecommunications providers may process phone numbers, message contents, identifiers, and delivery information under their own terms and privacy policies. Marketing messages should only be sent to contacts who have provided the required permission, and recipients may opt out using the instructions in the message or by contacting the responsible organisation.

5. When information is shared

We do not sell personal data. We may share only the information needed with authorised users of the relevant organisation; hosting, messaging, email, support, security, and payment service providers; professional advisers; a successor in a lawful business transfer; or public authorities where disclosure is lawfully required. Service providers must handle information only for the agreed purpose and with appropriate safeguards.

6. International processing

Some technology or messaging providers may process information outside Uganda. Where applicable, we use contractual, technical, consent-based, or other lawful safeguards intended to provide an appropriate level of protection.

7. Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected. Transaction, tax, employment, fraud-prevention, security, backup, and audit records may be retained for longer where required by law, contract, dispute resolution, or another lawful purpose. When retention is no longer justified, information is deleted, securely destroyed, or de-identified.

8. Security

We use access controls, authentication, logging, backups, encryption in transit, and operational safeguards designed to protect personal data. No internet or storage system is completely secure, so users must also protect their credentials and promptly report suspected unauthorised access.

9. Your choices and rights

Subject to applicable law and appropriate identity verification, you may ask to access, correct, update, block, or delete personal data, object to certain processing, withdraw consent where processing depends on consent, or complain about how information is handled. Requests involving records controlled by an organisation may be referred to that organisation.

See our Account and Data Deletion page for deletion instructions. You may also complain to Uganda's Personal Data Protection Office.

10. Cookies

SASA uses session, security, preference, and similar essential technologies to keep users signed in, remember settings, prevent abuse, and operate the service. Blocking essential cookies may prevent parts of the service from working.

11. Children

SASA is a business operations service and is not directed to children. It should not be used to knowingly submit a child's personal data unless an authorised organisation has a lawful reason and all required permissions.

12. Changes and contact

We may update this policy to reflect legal, operational, or service changes. The current version and effective date will remain available on this page. Privacy questions and requests may be sent to [email protected]. Please do not send passwords, access tokens, or unnecessary sensitive information by email.