Privacy Notice

Last updated: 31 October 2026

1. Who We Are

NGAA ("we", "us") operates a vehicle-access management platform for organisations in Uganda. We are the data controller for the personal information described below.

2. Information We Collect

Account details: name, email address, phone number.
Vehicle details: registration number (number plate), make, model, colour, and a windscreen photograph for verification.
Access records: date/time of gate entry or exit, gate identity, gateman who recorded the event.
Device data (gateman app): device identifier, coarse location at the time of a scan.

3. Why We Process It

To verify vehicle identity at a gate and log the movement.
To provide you a history of your own vehicle's entries and exits.
To allow Facility security managers to oversee access and respond to incidents.
To meet legal obligations (e.g. police or court requests for security footage logs).

4. Legal Basis

We process your data on the basis of:

Performance of a contract (your use of the Service via your Facility).
Legitimate interest in maintaining campus/facility security.
Your explicit consent, given at registration.

5. QR Credential Security

Your QR code is cryptographically signed and encrypted (AES-256-GCM). We never store the plaintext secret on our servers — only a one-way hash used to verify authenticity. A QR code that you print or display is only useful to a scanner at a gate with network access to verify it.

Data minimisation on the credential itself (Act s.21): the QR payload carries only what a gate needs to do its job — the vehicle registration plate, category, make, model and colour. It does not contain your name, phone number, email or any other personal identifier. If a QR code were photographed or copied at a gate, it would reveal nothing about you as a person.

6. Data Sharing

Your data is visible only to the Facility/Facilities where your vehicle is registered (tenant isolation).
We do not sell personal data to third parties.
Infrastructure providers (cloud hosting, email delivery) may process data under Data Processing Agreements.

7. Retention

Account and vehicle data: retained while the registration is active.
Phone numbers are encrypted at rest (AES-256-GCM) and are shown in staff views only in masked form.
Access logs: retained for 24 months, then anonymised.
Deleted accounts: personal data removed immediately on request; anonymised logs kept for aggregate statistics.

8. Your Rights

The Data Protection and Privacy Act, 2019 (Uganda) gives you the following rights, and NGAA provides each of them directly in the portal:

Right of access (s.24): view a copy of your personal data at any time under Account & security — your full name, email and phone number are shown to you in full, to no one else.
Right to rectification: correct inaccurate information through the profile form on Account & security.
Right to erasure (s.25) — “Delete my account”: permanently delete your account from the Account & security page (see section 8a below).
Right to withdraw consent: signing up to a facility is voluntary; deleting your account or leaving a facility withdraws it and ends your access to the Service.
Right to security: you can revoke every active session on all your devices at once with Sign out of all devices if you lose a phone.

8a. Deleting Your Account (Right to Erasure)

You can delete your own account without contacting anyone. On Account & security there is a Delete my account button. Because this is permanent, you must type the word DELETE to confirm.

When you delete your account, we erase or de-identify the following immediately:

Your name, email address and password are replaced with an unlinkable placeholder so the account can never be signed in to again.
Your phone number is deleted from storage (it is encrypted at rest while your account is active).
Your client profile and your ownership links to your vehicles are removed.
Any QR codes issued to you are revoked, so they stop working at every gate.
Every active login session for you is revoked across all devices.

What we must keep, and why. A facility is legally obliged to retain a record of vehicle movements through its gates as security evidence. We therefore keep those gate movement rows but anonymise them — your name is removed from them and they can no longer be linked back to you. Financial/tax records that the law requires (e.g. for URA) are likewise retained under statutory retention periods. After deletion you receive an erasure certificate by email recording the date, scope and legal basis of the deletion.

To exercise any right, contact: [email protected]

9. Security Measures

We use TLS in transit, bcrypt password hashing (cost 12), AES-256-GCM for QR payloads and for encrypting your phone number at rest, role-based access control, brute-force login protection with account lockout and email alerts, and audit logging on every data access event.

10. Governing Law

This notice is governed by the Data Protection and Privacy Act, 2019 (Uganda). Complaints may be lodged with the National Data Protection Commissioner.

11. Changes

We may update this notice. Material changes will be communicated via email or in-portal notification at least 14 days before taking effect.