Privacy Policy
This policy explains what personal data ArcardeMall collects, why, how long it is kept and what you can do about it. It is written to meet Uganda’s Data Protection and Privacy Act 2019 and the Data Protection and Privacy Regulations 2021.
1. Who is responsible for your data
The data collector and data controller is Omega Nodes Company Ltd, trading as ArcardeMall, incorporated in Uganda under the Companies Act, 2012, with its registered office at Luweero, Luweero District, Uganda.
Data protection contact: info@omeganodes.ai.
2. What we collect and why
| Data | Why we need it | Lawful basis |
|---|---|---|
| Name, email address, phone number | To create and secure your account and to contact you about orders | Performance of a contract |
| Delivery addresses and district | To deliver what you buy and to quote a delivery fare | Performance of a contract |
| Orders, payments and escrow records | To process purchases, release funds and issue receipts | Contract and legal obligation (tax) |
| Vendor and rider KYC documents | To verify who is selling and delivering on the platform | Legal obligation and legitimate interest in a safe marketplace |
| Login attempts, IP address, device/browser string | To detect brute-force attacks and account takeover | Legitimate interest in security |
| Audit log of sensitive actions | To investigate incidents and disputes | Legitimate interest and legal obligation |
| Messages between buyers, vendors and riders | To let you agree details and to resolve disputes | Performance of a contract |
We do not sell personal data, and we do not use it to train third-party advertising profiles.
3. Who we share it with
Personal data is shared only with the parties that need it to complete what you asked for:
- The vendor you buy from receives your name, delivery address and phone number — and only for the order concerned.
- The rider assigned to your delivery receives your delivery address, phone number and the handover code, for the duration of the delivery.
- Payment providers (Omega Nodes, Flutterwave, Paystack) receive the amount, reference and the identifiers their mobile-money flow requires. They are independent controllers for the payment itself.
- Our hosting provider stores the database and application on our instructions, as a processor.
- Authorities, where we are legally required to disclose.
4. Where your data is stored
Data is stored on servers operated on our behalf. Where a provider stores or processes data outside Uganda, we rely on a contract that obliges them to protect it to a standard at least equivalent to the one required by the Data Protection and Privacy Act 2019, as required by section 19 of that Act.
5. How long we keep it
| Category | Retention |
|---|---|
| Account profile | For as long as the account is open, then 30 days after deletion is requested. |
| Orders, invoices, escrow ledger | 7 years after the transaction, as required by Ugandan tax and accounting law. |
| Login attempt history | 12 months. |
| Security audit log | 24 months. |
| Messages | 24 months after the conversation ends. |
6. How we protect it
- Passwords are stored only as bcrypt hashes; we never see or store them in the clear.
- Traffic is encrypted in transit with TLS.
- Administrator accounts can enable time-based one-time-password multi-factor authentication.
- Failed logins are rate limited and repeated failures lock the account temporarily.
- Every sensitive action is written to an append-only audit log.
- The database is not reachable from the public internet.
7. Your rights
Under the Data Protection and Privacy Act 2019 you may:
- ask what personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- ask us to delete your data, subject to records we must keep by law;
- object to processing based on our legitimate interests;
- withdraw a consent you gave, without affecting what happened before you withdrew it.
You can exercise the first three yourself from Your data rights. Requests sent to info@omeganodes.ai are answered within 30 days.
8. Data breaches
If a breach is likely to harm you, we will notify you and the Personal Data Protection Office (PDPO), Uganda within 72 hours of becoming aware of it, describing what happened, what data was affected and what you should do.
9. Children
ArcardeMall is not intended for anyone under 18. We do not knowingly collect data from children; if you believe we have, contact us and we will delete it.
10. Complaints
If you are unhappy with how we handle your data, tell us first at info@omeganodes.ai. You also have the right to complain to the Personal Data Protection Office (PDPO), Uganda.
11. Changes to this policy
When we change this policy we publish a new version number and date at the top of the page. If the change materially affects your rights, we will tell you in the app before it takes effect.