Privacy Policy — East African Directory

Effective date: 16 October 2026

Version: 5

This policy explains how Neptunes Solutions Limited handles personal data in East African Directory, the public business directory at eastafricandirectory.com. It is written to meet the Data Protection and Privacy Act, 2019 of Uganda ("the Act") and the Data Protection and Privacy Regulations, 2021 ("the Regulations").

1. Who we are

Neptunes Solutions Limited ("Neptunes", "we", "us") is a company incorporated in Uganda with its office in Gulu. We run East African Directory ("the directory"). We decide why and how personal data is used in the directory, and we are responsible for it: under the Act we are the data controller.

Post: P.O. Box 361128, Uganda
Email for privacy questions and requests: info@neptunes.co.ug

2. What this policy covers

The directory lists businesses and organisations. Most of what it holds is information about businesses, not about people. Some of it is still personal data, because it can point to a person: the phone number of a sole trader, an email address with a name in it, or the address of a business run from a home. We treat such details as personal data.

This policy covers three groups of people:

visitors, who look at the directory or send us a message;
business owners and their representatives, who open an account and manage a listing;
people named or reachable through a listing that they did not create themselves (see section 9).

3. The principles we follow

The Act sets out principles for handling personal data. We follow them. Personal data must be:

collected and used lawfully, fairly and openly, and with respect for the person's privacy;
collected for a clear and specific purpose, and not used in a way that does not fit that purpose;
limited to what is needed;
accurate and kept up to date;
kept no longer than needed;
kept secure;
handled by someone who is accountable for it.

4. Data we collect

From every visitor

Technical data sent by your browser with each page: your internet (IP) address, the type of browser or device, the page requested and the time. The web server keeps this in its log.
A session cookie (see section 8).
Listing views. When you open a business's page we record that the page was viewed: which listing, the time, your IP address, the type of browser, and the address of the page you came from where your browser sends it. We use this to count how often a listing is viewed, and to avoid counting the same visitor twice within half an hour.
Searches. The words you search for, and the category or place you choose, are part of the address of the results page, so they appear in the web server's log like any other page request. We do not keep a separate record of searches and we do not build a profile of what a visitor looks for.

You can look at the directory without giving us your name or creating an account.

From people who send us a message

The contact page asks for your name, your email address, optionally a phone number and whether it is on WhatsApp, a subject and your message. With it we keep the time, the IP address and the type of browser used to send it, and the result of an automatic spam check (section 7).

From business owners and their representatives

Account details: the email address you sign in with, and a password (we store it only in a scrambled, one-way form and cannot read it), whether the email address has been confirmed, and the time of your last sign-in. You can change the email address you sign in with from your dashboard. While a change is waiting, we hold the new address until you confirm it from that address; after a change, we hold the previous address for 72 hours so that it can be put back, and then for a further 7 days until the link is cleared out. After that the previous address remains only in the sign-in records below, for as long as those are kept.
Sign-in records: each attempt to sign in, with the email address typed, the time, the IP address, the type of browser and whether it succeeded.
When you open an account or send a claim from a listing's page, we record the time and your IP address, to limit abuse.
Links we email to you to confirm your address, reset your password, confirm a change of the email address you sign in with, or undo such a change. We keep them only in a scrambled form, and each can be used once.
The listing itself: everything you enter about the business (section 5), with the dates it was created and changed.
Proof you send us when you ask for verification or claim a listing, such as a registration certificate or an identity document, the name, phone number and relationship to the business you give with a claim, and our notes on the request.
Plan and payment records, if you take a paid plan: the plan, the period, the amount, the date, how you paid and a receipt number. The directory does not take payments online, and we do not receive or store card numbers.
A record of what our own staff do to a listing or an account, such as approving, suspending, verifying or featuring it.

We collect this data from you directly. For the listings described in section 9, the business details came from an earlier version of the directory or from information the business had already made public.

5. What is published, by design

A directory exists to be read. Everything on a listing is public: anyone can see it without an account, search engines can index it, and other people may copy it in ways we cannot control.

A listing can show:

the name of the business, what it does, its category and the year it was established;
its logo, cover picture and other pictures;
its addresses and branches, post office box, town or district and country, and its position on a map;
its phone numbers, including a WhatsApp number, its email address and its website;
its opening hours and links to its social media pages;
whether it is verified.

The owner chooses what to enter. If you are an owner, enter only what you want the public to see. The email address you sign in with is not shown on your listing. A listing shows an email address only if you enter a public contact email for it; you can change or hide it at any time from your dashboard. Changing the email address you sign in with does not change the public contact email on a listing. If you registered before 13 October 2026, your listing may still show your sign-in address until you choose; your dashboard tells you. Each branch can also show an email address of its own.

Never published: your password, your sign-in records, the proof you send us, your payment records, and messages sent through the contact page. The number of times a listing has been viewed is shown to its owner only.

6. Why we use personal data and our lawful basis

The Act allows personal data to be collected and used with the person's consent. It also allows it without consent in the cases the Act lists, including where it is needed to perform a contract with the person, to meet a legal duty, or where a law authorises or requires it.

We use personal data:

to publish listings and let people search them. For a listing an owner created, this is what the owner asked us to do when they registered and agreed to our Terms of Use;
to open and run owners' accounts, confirm email addresses, reset passwords and send the emails an account needs. This is needed to provide the directory to the owner;
to answer messages, claims, and requests for verification, correction or removal. We do this at your request and with the consent you give when you send us your details;
to record paid plans and payments and keep accounts. This is needed for the agreement with the owner and to meet our duties under tax and company law;
to count listing views;
to keep the directory secure, stop spam and abuse, and find and fix faults. The Act requires us to keep personal data secure;
to meet legal duties and respond to lawful requests from courts and authorities.

We do not sell personal data, and we do not use the directory's data to advertise other companies' products to you. Where we rely on your consent, you may withdraw it at any time. That does not affect what was done before you withdrew it.

7. Things that happen automatically

We do not use personal data to make decisions about people by automated means alone in a way that has a legal or similarly significant effect on them.

Some things do happen automatically, by fixed rules:

a message sent through the contact page is checked for signs of spam. A message that looks like spam is still kept, marked for a person to look at; a form filled in by a program may be discarded. If you send several messages in an hour you are asked to wait;
sign-in is blocked for 15 minutes after repeated wrong passwords;
a new listing is shown to the public once its email address is confirmed;
listings on a paid plan can appear among the featured listings and higher in results.

If you believe one of these has affected you wrongly, write to us and a person will review it.

8. Cookies and services provided by others

Cookies. The directory sets one cookie: a session cookie, needed for the forms and for signing in to work safely. It holds a random identifier, not your name, and it ends when you close your browser. The directory does not use advertising cookies, and it has no analytics or tracking tools.

Files loaded from other companies. The page layout code, the icons, the typeface, the map software and all scripts are served from our own server. One thing is fetched from elsewhere: OpenStreetMap supplies the map pictures on a listing page that shows a map and on the page where an owner sets a branch's position; its server receives your IP address and the type of browser, as with any website. When an owner asks that page to find an address, the address typed is sent to OpenStreetMap's search service. The contact page shows our office address with links to OpenStreetMap and Google Maps; nothing is sent to either unless you follow a link.

Links. Listings link to the businesses' own websites, social media pages and WhatsApp. When you follow a link you leave the directory, and that site's own policy applies.

If we add analytics or a similar tool, we will update this policy first and ask for your consent where the law requires it. You can block or delete cookies in your browser settings. If you block the session cookie, the forms and signing in will not work.

9. If a listing is about you or your business and you did not create it

Some listings were carried over from an earlier version of the directory or were put together from information the business had already made public. They are marked "Not yet verified". A listing may also have been created by someone else in a business, or by someone who had no right to.

You can also claim a listing from its page ("Is this your business? Claim it"); this needs an account, which you can open without creating a listing.

If a listing is about you or your business, you can ask us:

to correct it;
to remove it, or to remove a detail such as a personal phone number or a home address;
to hand it over to you, so that you manage it yourself (see "Claiming a listing" in our Terms of Use).

Write to info@neptunes.co.ug or use the contact page. Tell us which listing it is and what you want changed. You do not need an account. We may ask for something that shows the listing is about you or that you speak for the business, so that nobody can take down or change another person's listing.

A listing that nobody has claimed is corrected or removed at the request of the business it describes. Where a listing is managed by an account holder, we will look at both sides before we decide; a personal detail that should not be public is taken down first. We aim to reply within 30 days, and sooner where the law sets a shorter time. Search engines and other sites may show an old copy for a while after we have changed or removed a listing.

10. Who we share data with

We do not sell personal data. We share it only as follows.

The public. Listings are published (section 5).

Our own office system. Messages sent through the contact page are also sent to Neptunes' internal system, where our staff read and answer the messages from all our websites. The copy carries what you entered, with the time, the IP address, the type of browser and the result of the spam check. It is sent over an encrypted connection and can be seen only by authorised Neptunes staff. Our staff are also told by email that a message has arrived; the email carries the subject and the first few lines of the message, but not your name or contact details.

Providers who work for us. They may use the data only to provide their service to us:

Hosting. Our servers are rented from Contabo GmbH and are located in Germany.
Website protection and delivery for our internal system: Cloudflare.
The companies named in section 8, which deliver files to your browser.

Our own staff. A small number of authorised Neptunes staff can access accounts, listings and messages where this is needed for support, verification, security and billing. They are bound to keep the data confidential.

Authorities and legal claims. We disclose personal data where the law, a court order or a lawful request from an authority requires it, and where it is needed to establish or defend a legal claim.

A change of ownership. If the directory is transferred to another company, the data needed to continue it will pass to that company, under the same protections. We will tell account holders if this happens.

11. Storing data outside Uganda

The directory's data is stored on servers in Germany, in the European Union.

Section 19 of the Act allows personal data to be processed or stored outside Uganda where the country has adequate measures in place to protect it, at least equivalent to the protection given by the Act, or where the person has consented. We rely on the following:

data protection law in Germany and the rest of the European Union (the General Data Protection Regulation) gives a level of protection that we consider at least equivalent to the Act;
our providers are bound by contract to keep the data confidential and secure and to use it only to provide their service.

If we move data to a different country, we will update this policy.

12. How we protect data

We use technical and organisational measures that are appropriate to the data we hold. At present these include:

Encrypted connections. Data travelling between your device and the directory is encrypted (HTTPS).
Passwords. Passwords are stored only in a scrambled, one-way form.
Sign-in protection. Sign-in is blocked for a time after repeated wrong passwords. Resetting a password signs the account out everywhere. Changing the email address you sign in with needs your current password, takes effect only when the new address confirms it, and signs the account out everywhere; we tell the previous address, which can undo the change for 72 hours.
Links that work once. The links we email to confirm an address, reset a password, or confirm or undo a change of sign-in address are kept in a scrambled form, can be used once and expire.
Protected forms. Forms carry a security value so that another website cannot submit them in your name.
Limited access. Messages, accounts and records can be opened only by authorised staff.
Backups. We take daily backups of the database so that we can restore the directory after a failure.

No system can be made completely secure. You can help by using a strong password that you do not use elsewhere.

13. Your rights and how to use them

Under the Act you have the right:

to be told what personal data is collected about you and why;
to ask for a copy of your personal data (access);
to have data that is inaccurate, out of date, incomplete or misleading corrected, and to have data deleted or destroyed where there is no longer a right to keep it;
to object to, or ask for a stop to, processing that causes or is likely to cause you unwarranted damage or distress;
to stop your data being used for direct marketing;
not to be subject to a decision that significantly affects you and is based only on automated processing, and to ask for such a decision to be reviewed by a person;
to withdraw a consent you gave;
to complain to the Personal Data Protection Office (section 16), and to seek compensation through the courts where the Act allows.

To use any of these rights, write to info@neptunes.co.ug. We may need to confirm who you are before we act. We aim to reply within 30 days, and sooner where the law sets a shorter time. There is no charge unless the law allows one.

Owners can correct their listing themselves, at any time, from their dashboard. You can also change the email address you sign in with there. To close an account and remove its listing, write to us from the account's email address.

14. How long we keep data

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires.

A listing and its account: for as long as the account is open. When an owner asks us to close the account, the listing is taken off the public pages straight away and the account and listing are deleted from our live systems within 90 days. Payment records are kept as set out below.
Listings nobody has claimed: until the business claims the listing or asks us to remove it, or we find that the business has closed.
Sign-in records: 12 months.
Records of listing views that include an IP address: 90 days. After that we keep only the count.
Messages sent through the contact page, in the directory and in our internal system: up to 2 years after the matter is closed. Messages marked as spam: up to 90 days after they were received or, if our staff marked them as spam later, after they were marked.
Email notices of a message: deleted from our mailbox within the same periods.
Proof sent for verification or a claim: until the request is decided and for 12 months after.
Payment records: 7 years after the end of the year they relate to, to meet tax and accounting law.
The web server's log: 90 days.
Backups: database backups are kept as 14 daily copies and 12 monthly copies. Data that has been deleted from the live system therefore disappears from the backups within 12 months.

Where a legal claim or an investigation is under way, we keep the relevant data until it is finished.

15. If something goes wrong

If we learn of a breach of security that affects personal data, we will act to contain it and to find out what happened. We will notify the Personal Data Protection Office immediately, as the Act requires, and we will tell the people affected in the way and at the time the Act and the Office require.

If you think your account or your data has been misused, tell us straight away at info@neptunes.co.ug.

16. The regulator and complaints

The Personal Data Protection Office is the independent office, under the National Information Technology Authority, Uganda (NITA-U), that oversees the Act. The Act requires organisations that collect or process personal data to register with the Office. The Office keeps a public register, and you may also ask us for our registration details at info@neptunes.co.ug.

If you are unhappy with how your personal data has been handled, please tell us first so that we can try to put it right. You also have the right to complain to the Personal Data Protection Office at any time. Its contact details and complaint form are on its website, www.pdpo.go.ug.

17. Children

The directory is made for businesses and for adults looking for them. It is not meant for children, and we do not knowingly open accounts for anyone under 18.

The Act allows a child's personal data to be collected only with the consent of a parent or guardian, or where the law requires it or it is needed for research or statistics. If you believe we hold a child's data that we should not have, write to info@neptunes.co.ug.

18. Our data protection contact

Questions about this policy, requests about your personal data and reports of a concern should be sent to our data protection contact:

Email: info@neptunes.co.ug
Post: Data Protection, Neptunes Solutions Limited, P.O. Box 361128, Uganda

19. Changes to this policy

We may update this policy when the directory, our providers or the law change. We will publish the new version on the directory with its effective date and version number. Where a change matters to how we use your data, we will tell account holders by email before it takes effect.