Privacy Policy
Impala is operated by SMS One Ltd ("we", "us"), a company registered in Uganda. This policy explains what personal data the Impala platform processes and how we protect it, consistent with Uganda's Data Protection and Privacy Act, 2019 (DPA-2019).
1. Who this policy covers
Impala is business-to-business software used by licensed waste-collection companies (our "customers") to run their operations. Most personal data on the platform belongs to our customers' own customers (residents and businesses they serve). For that data, the waste-collection company is the data controller and SMS One is the data processor, acting on their instructions.
2. Data we process
- Account data — names, work email addresses, phone numbers and roles of staff who sign in to the console.
- Service records — premises served, collection schedules, job cards and proof-of-service, on behalf of our customers.
- Billing & payments — invoices, receipts and mobile-money/PSP transaction references. We never store full card details.
- Technical data — authentication tokens, IP address and audit logs needed to secure the service.
3. How we use it
We process personal data only to provide, secure, support and improve the Impala service, to authenticate users, to bill our customers, and to meet legal and regulatory obligations. We do not sell personal data, and we do not use it for advertising.
4. Sensitive identifiers
The party/premise registry is our highest-sensitivity store. It is resolve-only, not browsable, and national identity numbers are never returned to the interface or written to logs. Phone numbers, identity data and message contents are never logged in plain text.
5. Storage & security
Data is hosted on Google Cloud infrastructure with tenant isolation (a separate database schema per customer), encryption in transit (TLS), role-based access control, append-only audit logging of material actions, and secrets held in a managed secret store — never in code. Access by our staff is restricted, logged and, where impersonation is used for support, itself audited.
6. Retention & erasure
We retain personal data for as long as a customer's account is active and as required by law, then delete or anonymise it. Data subjects may exercise their DPA-2019 rights (access, correction, erasure) through the relevant waste-collection company, who we support as processor.
7. Sharing
We share data only with sub-processors necessary to run the service (e.g. cloud hosting, payment service providers and SMS gateways), each under contract, and with authorities where required by law (e.g. tax fiscalisation).
8. Contact
Questions or requests: privacy@impalalite.com. SMS One Ltd, Kampala, Uganda.