Privacy Policy

INUKA Sourcing Service Ltd (“INUKA”, “we”, “us” or “our”) respects privacy and is committed to handling personal data responsibly. This Privacy Policy explains how we collect, use, store, share and protect personal data when individuals interact with our website, submit sourcing requests, register as suppliers, request confidentiality arrangements, communicate with us or otherwise engage with our business.

Data Controller:

INUKA Sourcing Service Ltd

Privacy Contact:

privacy@inukasourcing.com

• Identity and contact information: name, position, employer, email, telephone and business address.
• Company information: registration details, tax/business identifiers, company profiles and supplier information.
• Procurement information: product requirements, specifications, quantities, destinations, budgets where voluntarily provided, quotations, BOQs, drawings and supporting documents.
• Supplier qualification information: certifications, authorizations, licences, references, catalogues, quality documents and declarations.
• Communications: enquiries, correspondence, meeting notes and customer-service records.
• Website and technical information: IP address, browser/device information, security logs, cookies and analytics data where deployed.
• Integrity-reporting information: allegations, supporting evidence and contact information where provided.

• To receive, assess and respond to sourcing and procurement requests.
• To identify, evaluate and communicate with potential suppliers and sourcing partners.
• To prepare quotations, proposals, agreements and procurement records.
• To manage supplier qualification, due diligence and performance.
• To protect confidential business information and administer NDA requests.
• To prevent fraud, bribery, abuse, cyber threats and other misconduct.
• To comply with legal, regulatory, tax, accounting, audit and record-keeping obligations.
• To operate, secure and improve the website and business systems.
• To send marketing communications only where permitted and subject to applicable consent and opt-out requirements.

INUKA will process personal data only where an appropriate legal basis exists under applicable law. Depending on the circumstances, this may include consent, steps taken at the request of a person before entering a contract, performance of a contract, compliance with legal obligations, or other lawful grounds recognized by applicable data-protection law.

INUKA will seek only information reasonably necessary for the stated business purpose. Clients should avoid uploading unnecessary personal data, passwords, personal financial information or unrelated sensitive information.

INUKA may share relevant information with employees, professional advisers, service providers, potential suppliers, logistics and inspection partners, regulators or other parties where reasonably necessary for the sourcing assignment or legal compliance. Access should be limited to the information needed for the purpose.

International sourcing may require communication with suppliers or service providers outside Uganda. Where personal data is transferred internationally, INUKA will apply the safeguards required by applicable law and will avoid unnecessary disclosure.

INUKA will retain information only for as long as reasonably necessary for the purpose for which it was collected, contractual requirements, dispute management, audit, legal and regulatory obligations or legitimate records management. Detailed retention periods are governed by INUKA's internal Data Protection & Records Management Standard.

INUKA will apply reasonable organizational and technical measures appropriate to the nature of the information, including controlled access, secure credentials, protected file storage, backups, role-based permissions and incident response. No internet-based system can be guaranteed to be completely secure.

Individuals may exercise rights available under applicable Ugandan data-protection law, including requesting access to or correction of personal data and other applicable rights. Requests should be sent to privacy@inukasourcing.com. INUKA may need to verify identity before acting on a request.

Suspected personal-data breaches are escalated immediately through INUKA's incident process. Where notification to the Personal Data Protection Office or affected persons is legally required, INUKA will follow the applicable legal procedure.

The website and services are intended for corporate and professional use and are not directed to children.

INUKA may update this Policy when laws, systems or business practices change. The latest version will be published with its effective date.

Individuals may also contact the Uganda Personal Data Protection Office where they believe their data-protection rights have been infringed.