1) Who we are (Data Controller)

SABSAT Contractors & Suppliers Ltd
Mercy Complex, along Kabale–Kisoro Road, next to Kabale Municipal Council Offices
P.O. Box 460211, Kabale, Uganda
Phone/WhatsApp: +256 777 648 924 / 0704 005 719
Email: byamukamasamuel71@gmail.com

We are the data controller for personal data collected through our website and in connection with our architectural, engineering, supervision, and construction management services. Where we rely on specialist vendors (e.g., website hosting, email, analytics), those vendors act as data processors under our instructions.

2) Scope

This policy applies to personal data we process when you:

• visit or interact with our website or social media pages;

• contact us by phone, WhatsApp, email, or in person;

• request a quote, book a site visit, or otherwise receive our services;

• are a supplier or business partner to SABSAT.

This policy does not cover third‑party websites, services, or platforms that we do not control. Their privacy practices are governed by their own policies.

3) Personal data we collect

Contact & identity data — name, organization, job title, phone/WhatsApp, email, physical address.
Project & site data — location, plot details, drawings, photos/videos you share, schedules, procurement and contractor contact data.
Communications — messages and call/meeting notes (including WhatsApp and email).
Technical/usage data — IP address, device, browser, pages viewed, time on page, and similar diagnostics gathered via cookies or similar technologies.
Marketing preferences — your choices about newsletters or updates.
CCTV/visitor records (if applicable) — for safety and security at our office or project sites.
Supplier information — company name, contact details, TIN, banking details for payment processing.

We do not seek to collect special personal data (e.g., health data) unless necessary and lawful for a specific purpose or you provide clear consent. We also do not knowingly collect children’s data without proper consent from a parent/guardian.

4) How we collect personal data

• Directly from you when you submit forms, call/WhatsApp/email us, upload files, or meet us.

• Automatically when you use our website (cookies, logs, analytics).

• From third parties where lawful and appropriate (e.g., publicly available records, your nominated contractors/consultants, or referees you provide).

5) Legal bases for processing

We process personal data on one or more of the following lawful bases:

• Consent — for example, when you tick a consent box on a form or opt in to marketing.

• Contract — to take steps at your request before entering into a contract and to perform our contract with you (e.g., designs, supervision, reports).

• Legal obligation — to comply with laws and regulatory requests (e.g., tax, safety).

• Legitimate interests — to operate, secure, and improve our services (balanced with your rights), such as responding to enquiries, project coordination, keeping records, and preventing fraud or misuse.

Where the law requires consent (e.g., certain categories of data or uses), you may withdraw your consent at any time; this does not affect processing that has already occurred.

6) How we use personal data

• To respond to enquiries, provide quotes, and deliver our services.

• To plan and manage projects, including consultant/contractor coordination, site supervision, QA/QC, and handover documentation.

• To operate and improve our website and services (analytics, troubleshooting, security).

• To send service communications (e.g., meeting notes, reports) and, where permitted, marketing updates (you can opt out at any time).

• To comply with law, enforce agreements, and protect rights, property, safety, and security.

We do not sell your personal data.

7) Sharing your personal data

We may share personal data with:

• Service providers/processors acting on our behalf (hosting, email, IT support, analytics, document storage, print/signage, couriers), bound by confidentiality and security obligations.

• Project participants where necessary (e.g., your appointed contractor, consultants, suppliers) strictly for your project.

• Authorities or regulators where required by law or to protect vital interests.

• Successors in the event of a merger, reorganization, or transfer of our business or assets.

8) International transfers

Some processors or systems we use may be located outside Uganda. Where personal data is transferred outside Uganda, we take steps required by Ugandan Data Protection Law—such as obtaining your consent where necessary and ensuring the recipient provides a comparable level of protection. We also use contractual safeguards with our processors.

9) Data retention

We retain personal data only for as long as necessary to achieve the purposes described above, unless a longer retention period is required or permitted by law (e.g., tax/accounting, contract, or safety records). When data is no longer needed, we will delete, destroy, or de‑identify it in a manner that prevents reconstruction.

10) Security

We apply organizational, technical, and physical safeguards appropriate to the nature of the data, including: access controls, password and MFA where supported, least‑privilege practices, secure disposal of paper files, encrypted storage/transport where feasible, staff awareness, and vendor due diligence. If we become aware of a data incident, we will assess and notify the Personal Data Protection Office (PDPO) and affected individuals where required by law.

11) Your rights

Subject to applicable law, you may have the right to:

• Be informed about how we collect and use your data;

• Access the personal data we hold about you;

• Request correction/rectification of inaccurate or incomplete data;

• Request blocking, erasure, or destruction of data in certain circumstances;

• Object to certain processing (including direct marketing) or withdraw consent where processing is based on consent;

• Request review of automated decisions that significantly affect you; and

• Complain to the Personal Data Protection Office (PDPO) if you believe your rights have been infringed.

We will respond to rights requests within the timelines required by law. To exercise your rights, please contact us using the details in Section 1.

12) Cookies & similar technologies

We use cookies or similar technologies to operate the website, remember preferences, and analyze traffic. You can control cookies via your browser settings. Disabling some cookies may affect site functionality. Where required, we will request your consent for non‑essential cookies.

13) Children’s data

We do not knowingly collect personal data from children under 18 without consent from a parent or legal guardian or unless otherwise permitted by law. If you believe a child has provided us data without appropriate consent, please contact us so we can take steps to delete it.

14) Marketing communications

If you opt in to receive updates, we may send you newsletters or invitations. You can unsubscribe at any time via the link in the message or by contacting us. We will not send you marketing without a lawful basis.

15) Third‑party links

Our website may contain links to third‑party sites (e.g., social media). We are not responsible for their privacy practices. We recommend you review their privacy notices.

16) Changes to this policy

We may update this policy from time to time. We will post the new version and update the “Last updated” date at the top. Significant changes may be notified on the website or by direct notice where appropriate.

17) How to contact the regulator

Personal Data Protection Office (PDPO) — National Information Technology Authority – Uganda (NITA‑U)
(See government website for current contact details.) You may lodge a complaint if you believe we have not handled your personal data in accordance with Ugandan Data Protection Law.