Privacy Policy
Last updated: 5 August 2026. Compliant with Uganda's Data Protection and Privacy Act 2019.
1. Who we are
Corpshore Uganda Limited is a business process outsourcing, IT outsourcing and AI services company registered and operating in Kampala, Uganda. We are Ranked #1 of 20 BPO companies in Uganda by Outsource Accelerator 2026.
For the purposes of Uganda's Data Protection and Privacy Act 2019 (Act No. 9 of 2019), Corpshore Uganda Limited is the Data Controller in respect of personal data collected through our website, client engagements, recruitment processes and employment relationships.
Our registered address is Kampala, Uganda. Our designated Data Protection Officer can be reached at info@corpshore.solutions.
This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have under the DPA 2019.
2. Data we collect
The data we collect depends on how you interact with Corpshore Uganda. The categories below describe each group of data subjects and the information we process.
Website visitors
When you browse corpshore.ug, our hosting infrastructure automatically records your IP address, browser type, device type and the pages you visit. This technical data is used solely to maintain site security and, where you have opted in, to produce aggregate analytics. We do not record personally identifying analytics data by default. You may opt in to analytics cookies through our cookie banner.
Contact form submissions
When you submit an enquiry through our contact or quote forms, we collect your name, email address, organisation name, phone number, your message and a timestamp recording the moment you provided consent. This information is used only to respond to your enquiry and to follow up within a reasonable business timeframe.
Careers applicants
When you apply for a position at Corpshore Uganda, we collect your full name, email address, phone number, Uganda National Identification and Registration Authority (NIRA) identification number (stored in encrypted form), district of residence, the position applied for and your explicit consent under the DPA 2019. We collect only the information needed to assess your application and comply with Uganda labour law. NIRA numbers are encrypted at rest and are never shared with third parties outside the hiring process.
Clients and prospective clients
When we enter into or negotiate a client engagement, we process business contact information (names, job titles, email addresses, phone numbers), contract data, service scope records and records of communications between Corpshore Uganda and the client organisation. This data is processed to deliver contracted services and to meet our legal and regulatory obligations.
Subcontractors and employees
For individuals engaged as employees or subcontractors, we collect and hold a full set of personal data as required by Uganda labour law, National Social Security Fund (NSSF) regulations and Uganda Revenue Authority (URA) tax obligations. This includes national identification details, tax identification numbers, bank account information, next-of-kin contacts and employment records. This data is used solely to manage the employment or engagement relationship and to meet statutory obligations.
3. Legal basis for processing
Under the DPA 2019, we must have a lawful basis for every type of personal data processing we carry out. The table below sets out the basis we rely on for each category of processing.
| Processing activity | Legal basis |
|---|---|
| Analytics cookies and marketing communications | Consent. You choose to opt in. You may withdraw consent at any time through our cookie settings or by emailing info@corpshore.solutions. |
| Delivering services to clients and managing employment relationships | Contract performance. Processing is necessary to carry out our obligations under a contract to which you are a party. |
| Tax records, NSSF contributions, NITA-U and IRA compliance | Legal obligation. Ugandan law requires us to collect and retain certain data. We have no discretion to decline. |
| Fraud prevention, IT security and site integrity | Legitimate interests. We have a legitimate interest in protecting our systems, our clients and our staff from unauthorised access and fraudulent activity. This interest does not override your rights under the DPA 2019. |
4. Uganda DPA 2019 compliance
Uganda's Data Protection and Privacy Act 2019 (Act No. 9 of 2019) is the primary law governing the collection, processing, storage and sharing of personal data in Uganda. It came into force on 16 February 2019 and is administered by the Personal Data Protection Office (PDPO). Corpshore Uganda Limited is committed to full compliance with the Act and treats data protection as a matter of operational practice, not merely a legal checkbox.
The DPA 2019 grants the following rights to individuals whose data we hold. You may exercise any of these rights at any time by writing to info@corpshore.solutions.
- Right of access: You may request a copy of the personal data we hold about you, together with information about how we use it.
- Right to rectification: If data we hold about you is inaccurate or incomplete, you may ask us to correct it.
- Right to erasure: In certain circumstances you may ask us to delete your personal data. We will comply unless we are required to retain it by law or to defend a legal claim.
- Right to data portability: Where processing is based on your consent or on a contract, you may request that we provide your data in a structured, machine-readable format.
- Right to object: You may object to processing carried out on the basis of legitimate interests. We will stop the processing unless we can demonstrate compelling grounds that override your rights.
We aim to respond to all rights requests within 21 days of receipt. If your request is complex or we receive a high volume of requests, we may extend this period by a further 21 days and will notify you.
If you believe your rights under the DPA 2019 have not been respected, you have the right to lodge a complaint with Uganda's supervisory authority: the Personal Data Protection Office (PDPO). The PDPO's official portal is www.pdpo.go.ug. We encourage you to contact us first so we can attempt to resolve any concern directly.
5. Data retention
We keep personal data only for as long as is necessary for the purpose for which it was collected or as required by Ugandan law. The schedules below set out our standard retention periods.
| Data category | Retention period |
|---|---|
| Website analytics (where consent given) | 26 months from the date of collection |
| Contact and enquiry form submissions | 24 months from the date of submission |
| Recruitment applications (unsuccessful candidates) | 12 months from the conclusion of the recruitment process |
| Active client data and project records | Duration of the contract, then 7 years for tax compliance |
| Employee and subcontractor personal data | 7 years after the date of termination or end of engagement |
At the end of each retention period, data is securely deleted or anonymised in accordance with the DPA 2019. Where data must be retained beyond the standard period due to a legal dispute or regulatory requirement, we will document the reason and review it annually.
6. International data transfers
Corpshore Uganda Limited is part of the Corpshore Solutions Corporation group of companies. As part of delivering services, supporting group operations and maintaining shared infrastructure, we may transfer personal data to our parent company, Corpshore Solutions Corporation, and to other group entities operating in countries outside Uganda.
Where such transfers occur, we protect your data through contractual measures that provide a level of protection equivalent to the requirements of the DPA 2019. These include standard contractual clauses agreed between Corpshore entities and, where required, data processing agreements with third-party service providers.
We do not transfer personal data to countries that do not provide an adequate standard of data protection without first obtaining your explicit consent, unless the transfer is required by Ugandan law or is necessary to perform a contract with you.
Third-party service providers that may receive data as part of our operations include cloud hosting providers and enterprise productivity platforms. All such providers are assessed for compliance with data protection standards before any data is transferred. A list of active sub-processors is available on request by emailing info@corpshore.solutions.
8. Contact and complaints
Contact our Data Protection Officer
If you have a question about this Privacy Policy, want to exercise a data subject right or have a concern about how we handle your personal data, please contact our Data Protection Officer:
Data Protection OfficerCorpshore Uganda Limited
Kampala, Uganda
Email: info@corpshore.solutions
Raising a complaint with the PDPO
If you are not satisfied with our response to your concern, you have the right to raise a complaint directly with Uganda's Personal Data Protection Office (PDPO). The PDPO is the statutory body established under the DPA 2019 to oversee data protection in Uganda.
PDPO online complaint portal: www.pdpo.go.ug
Changes to this Privacy Policy
We review this Privacy Policy at least once every 12 months and whenever there is a material change to our operations or to applicable law. If we make a significant change, for example a new category of personal data or a new purpose for processing, we will notify registered users and enquiry contacts by email and display a prominent banner on our website for 30 days following the change. The date at the top of this page always reflects when the policy was last updated. We encourage you to review this page periodically.