This Privacy Notice explains how NITA-U handles personal data collected through its website (www.nita.go.ug) and associated services, in line with Uganda's Data Protection and Privacy Act, 2019, and its Data Protection and Privacy Regulations, 2021.

1. Data Controller

NITA-U is the Data Controller for personal data collected via this website. As defined under the Personal Data Protection and Privacy Act, 2019, a Data Controller is responsible for determining the purposes and methods of data processing.

2. Personal Data Collected and Processed

We collect the following personal data through our website’s “Contact Us” and complaints forms when you choose to communicate with us:

• Contact information data which include full name, phone number, email address, and postal address of the user.
• Demographic information data which include the location details of the user.
• Complaint and Transaction data which includes data on products, services, providers, transaction dates, and issues experienced by the complainant or user.
• Name
• Email address

This data is not collected through automated means. Additional information on automated data collection can be found in our [Cookie Use Notice].

3. Purpose and Legal Basis for Processing

We process your personal data solely to respond to your queries, requests for information, or complaints submitted through the “Contact Us” or complaints form. Our legal basis for processing is legitimate interest as permitted under Regulation 10(2)(b) of the Data Protection and Privacy Regulations, 2021.

4. Data Sharing and Disclosure

NITA-U does not share personal data with third parties unless required by law.

5. Security of Personal Data

NITA-U employs robust security measures to protect personal data. Your data is stored at the Government National Data Center and safeguarded by strict technical and organizational controls, managed by our skilled support team. We adhere to the security practices outlined in the Data Protection and Privacy Regulations, including measures to prevent unauthorized access, data loss, or breaches.

6. Biometric (Face) Data

What we collect. When you create or recover an account in the UGov Authenticator app, the app captures a single photograph of your face to verify your identity. During capture, the app performs on-device liveness detection using Google ML Kit, a library that runs entirely on your device. The liveness signals it computes — such as blink, head movement, and facial expression — are processed only in your device's memory and are immediately discarded; they are never stored or transmitted. No facial templates, embeddings, or biometric feature vectors are created on your device.

Why we store it. The single face photograph is used solely to verify your identity, and to re-verify your identity if you later recover your account. Because your face image is the credential checked during account recovery, it must be stored for as long as the account exists.

How long we store it, and why. Your face photograph is retained by the National Identification and Registration Authority (NIRA) only for the lifetime of your UGov Authenticator account. We store it for this period because the image is required to confirm your identity each time you recover access to your account. It is not stored indefinitely: when you close or delete your account, your face photograph is permanently deleted. No face image is stored on your device after verification.

Who we share it with. Your face data is not shared with any third party. The on-device liveness detection library (Google ML Kit) operates entirely offline; it does not transmit, store, or share any image or face data, and no face data is sent to Google. The face photograph is transmitted only once, over an encrypted (HTTPS) connection, to the secure backend operated by NIRA and hosted within the Uganda government data centre. No external or commercial party receives your face data.

How it is used. Your face data is used exclusively for identity verification during account registration and recovery, in accordance with the Uganda Data Protection and Privacy Act, 2019. It is never used for advertising, analytics, profiling, or any other purpose.

7. Your Rights as a Data Subject

Under the Personal Data Protection and Privacy Act, 2019, you have the following rights regarding your personal data:

• Right to Access: You can request confirmation on whether we hold your personal data and obtain a copy of it.
• Right to Rectification: You can request corrections to any inaccurate or incomplete data.
• Right to Erasure: You may request deletion of your data where permissible.
• Right to Restrict Processing: You can request limitations on how we use your data.
• Right to Object: You may object to processing in certain situations, such as for direct marketing.
• Right to Data Portability: When applicable, you have the right to receive your data in a commonly used format.

To exercise any of these rights, please contact our Data Protection Officer (DPO) via dpo@nita.go.ug.

8. Data Transfers Outside Uganda

We do not transfer personal data outside Uganda without implementing adequate safeguards equivalent to the protections offered by the Data Protection and Privacy Act, 2019. Any transfers outside Uganda are subject to user consent or stringent protection measures.

9. Data Retention

Personal data provided through the “Contact Us” form is retained for six months following the resolution of the inquiry or complaint. After this period, the data is securely deleted.

10. Data Breach Notification

In the event of a data breach, NITA-U will notify the affected individuals and the relevant authorities, following the data breach notification requirements outlined in the Data Protection and Privacy Regulations, 2021.

11. Contact Information

For any inquiries or complaints regarding this Privacy Notice or your data rights, please contact our Data Protection Officer:

Data Protection Officer

National Information Technology Authority - Uganda (NITA-U)

Palm Courts, Plot 7A, Rotary Avenue (Former Lugogo Bypass)

P.O. Box 33151, Kampala - Uganda

Telephone: +256-417-801038

Email: dpo@nita.go.ug

12. Changes to This Privacy Notice

We may update this Privacy Notice to reflect changes in regulations, practices, or our services. The latest version of this notice will always be available on our website. Please review this page periodically for any updates.