Privacy Policy
Effective 30 September 2026. This notice explains how Luba Modern Market handles personal data through LUBA Market.
1. Data controller
Luba Modern Market determines why and how personal data is processed for LUBA Market and acts as the data controller under Uganda’s Data Protection and Privacy Act, Chapter 97. Its registered business address is H23, Nambi Mall.
2. Information collected
Depending on your role and activity, we collect names, mobile number, email address, date of birth, residential address, role and organisation details; National Identification Number, NIRA verification details, passport details and identity documents; next-of-kin information; account, device, session and security records; wallet, payment, transaction, holding, delivery, collection, hub and referral records; communications, support requests and audit events.
3. Sources of information
Information is received directly from you, from an administrator or marketing agent authorised to invite you, from hub staff recording an operation, from payment and communications providers, and from lawful identity or compliance sources used to verify submitted information.
4. Purposes and lawful bases
We process data to create and secure accounts, verify identity and roles, perform requested services and contracts, manage commodity and hub operations, maintain accurate financial and stock records, prevent fraud, provide support, comply with legal duties, protect legitimate operational and security interests, and send optional marketing only where separate consent has been given.
5. Identity and sensitive records
KYC identifiers and documents are used only for identity, compliance and fraud-prevention purposes. Access is limited to authorised staff and regulators with a lawful basis. Identity documents are stored in encrypted private storage rather than the public website.
6. Sharing and processors
We may share the minimum necessary data with SMS and email providers delivering OTP or service messages, Google when you choose Google sign-in, payment providers when financial channels are enabled, secure hosting and storage providers, professional advisers, auditors, identity-verification services, and public authorities where disclosure is required or authorised by law. Processors must be subject to appropriate confidentiality and data-protection obligations.
7. Transfers outside Uganda
Where a service provider processes information outside Uganda, Luba Modern Market will assess the destination and provider, use appropriate contractual and security safeguards, and make the transfer only where permitted by applicable law.
8. Security
Controls include encrypted connections, encrypted private document storage, hashed refresh tokens, short-lived access tokens, one-time-code limits, server-side role and ownership checks, audit logging, upload validation, backups and reconciliation. No system is risk-free, so users should also protect their phone and promptly report suspicious activity.
9. Retention
Data is kept only as long as necessary for the relevant service, security, legal, tax, accounting, audit and dispute requirements. Session and temporary verification records have shorter lifetimes. Immutable financial, stock and audit records may need to be retained after account closure and corrected through linked entries rather than deletion.
11. Automated processing
The platform may automatically enforce access permissions, quote expiry, stock availability and security limits. Decisions requiring identity, KYC, suspension or adverse role review include human review and a recorded reason. LUBA Market does not currently make solely automated decisions that produce legal or similarly significant effects.
12. Your rights
Subject to applicable law, you may request access to personal data, correction of inaccurate or incomplete information, deletion where lawful, restriction or objection to certain processing, withdrawal of consent where processing relies on consent, and a portable copy where applicable. Identity may be verified before a request is fulfilled.
13. Limits on deletion
Deletion may be refused or limited where information must be retained for a legal obligation, transaction or stock record, fraud prevention, audit, legal claim or regulatory requirement. Where possible, unnecessary information will be removed or access restricted.
14. Complaints
Please first contact Luba Modern Market’s designated privacy contact so the concern can be investigated. You may also complain to Uganda’s Personal Data Protection Office or exercise any other remedy available under Ugandan law.
15. Data breaches
Suspected incidents are investigated, contained and documented. Luba Modern Market will notify the Personal Data Protection Office and affected individuals where notification is required by law and will provide practical protective steps where appropriate.
16. Children
LUBA Market is not intended for children and accounts must not be created for a child unless a lawful, specifically designed service and appropriate guardian process are introduced.
17. Policy changes
Material changes will be shown through a new effective date and communicated through the service or registered contact details. Where a new purpose requires consent, it will be requested separately.
18. Contact
Privacy requests, complaints and data-protection enquiries may be sent to +256784044745. Written correspondence may be delivered to H23, Nambi Mall.