Privacy Policy

Effective date: 2026-10-10

Version: 2

This policy explains how Neptunes Solutions Limited handles personal data in Leasystream, in our other business applications and on our website. It is written to meet the Data Protection and Privacy Act, 2019 of Uganda ("the Act") and the Data Protection and Privacy Regulations, 2021 ("the Regulations").

1. Who we are

Neptunes Solutions Limited ("Neptunes", "we", "us") is a company incorporated in Uganda with its office in Gulu. We provide business applications under the names Momentrax, LeasyStream, Crediledger and UtiliFarm, and we run the website neptunes.co.ug.

• Post: P.O. Box 361128, Uganda
• Email for privacy questions and requests: info@neptunes.co.ug

2. Two different roles

We handle personal data in two different ways. Which one applies to you decides who you should contact.

When we are the data controller. We decide why and how the data is used, and we are responsible for it. This covers:

• the people who open and run an account with us (business owners and their staff who sign in);
• billing and payment records for subscriptions;
• visitors to our websites and people who contact us, call us, or apply to us for a job or a training course.

When we are a data processor. Businesses use our applications to keep records about their own customers, renters, landlords, borrowers, guarantors, members, suppliers, farm workers and staff. That data belongs to the business. The business is the data controller: it decides what to collect and why. We store and process that data for the business, on its instructions, and only to provide the service.

If a business that uses one of our applications holds your data (for example, you rent from a landlord who uses LeasyStream, you borrowed from a lender who uses Crediledger, or you bought from a shop that runs on Momentrax), that business is responsible for your data. Please contact the business first. Section 12 explains how we help.

3. The principles we follow

The Act sets out principles for handling personal data. We follow them, and we expect the businesses that use our applications to follow them too. Personal data must be:

• collected and used lawfully, fairly and openly, and with respect for the person's privacy;
• collected for a clear and specific purpose, and not used in a way that does not fit that purpose;
• limited to what is needed;
• accurate and kept up to date;
• kept no longer than needed;
• kept secure;
• handled by someone who is accountable for it.

4. Data we collect as a controller

Account holders and their staff users

• Business details: business name, country, location, contact email address and phone number.
• User details: name, email address, phone number, role and permissions, and a password (we store it only in a scrambled, one-way form and cannot read it).
• Optional profile details that a business chooses to keep about its own staff users, such as a photo or signature.
• Sign-in and security records: dates and times of sign-in, failed attempts, the internet (IP) address and the type of browser or device.
• A record of actions taken in the account (the audit trail), which shows which user did what and when.
• Support and feedback messages you send us.

Billing

• The plan, prices, invoices and receipts for your subscription.
• Payment records: amount, date, method, transaction reference, the mobile money number or bank details a payment came from as reported by you or by the payment provider, and any proof of payment you send.
• We do not receive or store card numbers. Card and mobile money payments are handled by the payment provider.

Website visitors

• Technical data sent by your browser: IP address, browser type, the pages requested and the time.
• A session cookie (see section 8).

People who contact or call us

• Contact forms and emails: your name, email address, phone number, the subject and your message, with the IP address and browser type used to send a form.
• Phone calls: your number, the time and length of the call, and the notes our staff make.

People who apply for a job or a training course on neptunes.co.ug

• Job and internship applications: names, email address, phone number, date of birth, gender, nationality, identity number, address, education and work history, referees, your letter, and the documents you upload.
• Course applications and students: names, contact details, date of birth, gender, nationality, identity number, address, education, occupation and employer, next of kin, course and payment records, results and certificates.

We collect this data from you directly, from the business that sets up your user account, and from our payment and messaging providers when they confirm a payment or a delivery.

5. Data that businesses keep in the applications (we are the processor)

What is stored depends on what each business chooses to enter. The lists below show the kinds of personal data each application is built to hold.

Momentrax (business management and online shop)

• Customers and suppliers: names, contact people, phone numbers, email and postal addresses, tax identification number, registration number, bank and mobile money details for payments, credit limits, notes and uploaded documents (which may include identity documents).
• Sales records: invoices, receipts, payments, orders, balances owed.
• Online shop buyers: name, email address, phone number, delivery address, order details and the mobile number used to pay.
• The business's staff: contact details, date of birth, gender, address, next of kin, photo, signature and documents.

LeasyStream (property and lease management)

• Renters: names, date of birth, gender, marital status, national identification number, tax identification number, contact details, occupation, employer, income, emergency contact, guarantors, and uploaded documents.
• Landlords and property owners: names, contact details, identification numbers, and bank or mobile money details for payouts.
• Tenancy records: leases, rent charged and paid, deposits, late fees, balances, notices, maintenance requests and messages sent.
• Renter portal: a renter who is given access signs in with an email address and password and sees their own lease, charges, payments, receipts and requests.

Crediledger (lending and savings records)

• Borrowers, members and guarantors: names, date of birth, gender, marital status, national identification number, photo, contact details, home and residence details, occupation, employer, income and next of kin.
• Identity and supporting documents: copies of identity cards, photos, signatures and proof of ownership.
• Loan and savings records: applications and decisions, loans, repayment schedules, repayments, penalties, arrears, security (collateral) and its value, savings accounts and transactions.

UtiliFarm (farm management)

• Farm workers and staff, suppliers and buyers: names, contact details, roles, work and payment records.

In every application

• Messages (SMS and email) that the business sends to its own contacts through the application: the recipient's number or address, the content, and whether it was delivered.
• Records of receipts issued, so that a receipt's verification code can be checked. The public verification page shows only what is needed to confirm the receipt: the business, the receipt number, the amount, the date, whether it is still valid and, where the printed receipt names the payer, that name.

Special personal data. Some of this is special personal data under the Act, which includes financial information and information about health. Identity numbers and copies of identity documents are also sensitive. A business that enters this kind of data must have a lawful basis for collecting it and, where the Act requires, the person's consent. A business must not enter data about a person's religious or philosophical beliefs, political opinions, sexual life or health unless the law allows it and it is truly needed.

6. Why we use personal data and our lawful basis

The Act allows personal data to be collected and used with the person's consent. It also allows it without consent in the cases the Act lists, including where it is needed to perform a contract with the person, to meet a legal duty, or where a law authorises or requires it.

As a controller, we use personal data:

• to open and run your account, provide the service and give support. This is needed to perform our contract with the business, and users are added by the business they work for;
• to take and confirm payments, issue invoices and receipts, and keep accounts. This is needed for the contract and to meet our duties under tax and company law;
• to send service messages, such as password resets, sign-in links, renewal reminders, receipts, notices of changes and security alerts. This is part of providing the service;
• to keep the service secure, prevent abuse and fraud, find and fix faults, and keep an audit trail. The Act requires us to keep personal data secure;
• to answer enquiries and to consider applications for jobs and courses. We do this at your request and with the consent you give when you send us your details;
• to run training courses, issue certificates and let others check that a certificate is real. This is needed to perform our contract with the student;
• to tell account holders about new features or products. You can ask us to stop at any time (see section 12);
• to meet legal duties and to respond to lawful requests from courts and authorities.

Where we rely on your consent, you may withdraw it at any time. That does not affect what was done before you withdrew it.

As a processor, we use the data that businesses keep in the applications only to provide the service to that business: to store it, display it to the business's users, run the calculations and reports the business asks for, send the messages the business sends, back it up and keep it secure. We do not use it for our own marketing, and we do not sell it. The business is responsible for having a lawful basis for the data it enters.

7. Decisions made automatically

We do not use personal data to make decisions about people by automated means alone in a way that has a legal or similarly significant effect on them. In particular, our applications do not score people for credit and do not approve or refuse a loan, a tenancy or a sale. People make those decisions.

Some things do happen automatically, by fixed rules:

• an account is suspended when a subscription is not paid after the grace period;
• sign-in is blocked for a short time after repeated wrong passwords;
• forms on our websites are checked for spam;
• dates and charges are applied to records under the settings chosen by the business, for example marking an instalment overdue, adding a late fee or penalty, or sending a reminder.

If you believe one of these has affected you wrongly, contact the business concerned, or us, and a person will review it.

8. Cookies and similar technology

In the applications. We use only cookies that are needed for the application to work and to stay secure:

• a session cookie that keeps you signed in while you work. It ends when you close your browser or after a period without activity;
• if you tick "remember me" when you sign in, a cookie that keeps you signed in on that device for up to 30 days;
• security values that protect forms from being submitted by another website.

Your browser may also store a few display preferences on your device, such as whether a menu is collapsed. The applications do not use advertising cookies and do not use analytics or tracking tools.

Sign-up check. The sign-up page of an application may use a check provided by Cloudflare to tell people from automated programs. It runs only on that page.

Fonts and code libraries. Some pages load fonts, icons or standard code libraries from content networks run by other companies (such as Google Fonts, jsDelivr, cdnjs and jQuery). To deliver the file, that company's server receives your IP address and browser type, as with any website. These files do not set cookies in our applications.

On neptunes.co.ug. Our company website uses a session cookie for security on its forms. It is delivered through Cloudflare, which may set a cookie of its own for security. In addition:

• the contact page shows a Google map and may use Google reCAPTCHA to stop spam;
• the job application and course application pages load Google Tag Manager, a Google tool for managing measurement tags.

These Google services may set their own cookies and receive your IP address when you open those pages. We do not use advertising or tracking tools on the applications themselves. If we add analytics or similar tools anywhere, we will update this policy first and ask for your consent where the law requires it.

You can block or delete cookies in your browser settings. If you block the session cookie you will not be able to sign in.

9. Who we share data with

We do not sell personal data. We share it only as follows.

Providers who work for us (our processors). They may use the data only to provide their service to us:

• Hosting. Our servers are rented from Contabo GmbH and are located in Germany. Uploaded files for some applications are kept with a storage provider in the European Union.
• Email delivery. Brevo delivers the emails sent by us and by businesses through the applications.
• SMS delivery. Africa's Talking delivers SMS messages through the mobile networks.
• Payments. MTN Mobile Money, Airtel Money and Flutterwave handle payments. They receive what is needed to process a payment, such as the paying number, the amount and a reference. They are also responsible in their own right for the data they hold about their own customers.
• Website protection and delivery. Cloudflare, and the Google services described in section 8.

The business you belong to or deal with. A business's authorised users can see the data in that business's account. Each business's data is kept separate from every other business's data.

Our own staff. A small number of authorised Neptunes staff can access account and customer data where this is needed for support, maintenance, security and billing. They are bound to keep it confidential.

Authorities and legal claims. We disclose personal data where the law, a court order or a lawful request from an authority requires it, and where it is needed to establish or defend a legal claim.

A change of ownership. If our business or an application is transferred to another company, the data needed to continue the service will pass to it, under the same protections. We will tell account holders if this happens.

10. Storing data outside Uganda

The data in our applications is stored on servers in Germany, in the European Union. Some of our providers may process data in other countries, for example when an email or SMS is routed for delivery.

Section 19 of the Act allows personal data to be processed or stored outside Uganda where the country has adequate measures in place to protect it, at least equivalent to the protection given by the Act, or where the person has consented. We rely on the following:

• data protection law in Germany and the rest of the European Union (the General Data Protection Regulation) gives a level of protection that we consider at least equivalent to the Act;
• our providers are bound by contract to keep the data confidential and secure and to use it only to provide their service;
• a business that uses our applications instructs us, through our Terms of Service, to store its data there. The business is responsible for telling the people whose data it holds and for obtaining any consent the Act requires.

If we move data to a different country, we will update this policy.

11. How we protect data

We use technical and organisational measures that are appropriate to the data we hold. At present these include:

• Encrypted connections. Data travelling between your device and our applications is encrypted (HTTPS).
• Separation between businesses. Each business's records are separated inside the database by rules that the database itself enforces, so that one business's users cannot read another's data.
• Access by role. Each business controls what each of its users may see and do. Access by our own staff is limited to those who need it.
• Passwords. Passwords are stored only in a scrambled, one-way form.
• Sign-in protection. Sign-in is blocked for a time after repeated wrong passwords, and users are signed out after a period without activity.
• Audit trail. The applications keep a record of who did what and when.
• Private files. Where an application keeps uploaded documents in private storage, they can be opened only through links that expire.
• Backups. We take daily backups of the databases so that we can restore the service after a failure.

No system can be made completely secure. You can help by using a strong password that you do not use elsewhere, by giving each person their own sign-in, and by removing access when someone leaves.

12. Your rights and how to use them

Under the Act you have the right:

• to be told what personal data is collected about you and why;
• to ask for a copy of your personal data (access);
• to have data that is inaccurate, out of date, incomplete or misleading corrected, and to have data deleted or destroyed where there is no longer a right to keep it;
• to object to, or ask for a stop to, processing that causes or is likely to cause you unwarranted damage or distress;
• to stop your data being used for direct marketing;
• not to be subject to a decision that significantly affects you and is based only on automated processing, and to ask for such a decision to be reviewed by a person;
• to withdraw a consent you gave;
• to complain to the Personal Data Protection Office (section 15), and to seek compensation through the courts where the Act allows.

Where we are the controller (your account, billing, website, enquiries and applications), write to info@neptunes.co.ug. We may need to confirm who you are before we act. We aim to reply within 30 days, and sooner where the law sets a shorter time. There is no charge unless the law allows one.

Where a business holds your data in one of our applications, please contact that business first. It is the controller and it decides how to answer. We will pass on to the business any request we receive that concerns its data, and we will help it to answer. We cannot change or delete a business's records at the request of someone else without the business's instruction, unless the law requires us to.

Account holders can correct most of their own details, and export their business's data, from inside the application.

13. How long we keep data

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires.

Data in a business's account (we are the processor)

• While the account is open, including while it is suspended for non-payment: for as long as the business keeps it there. The business can correct or delete records, within the limits needed to keep accounts and audit trails complete.
• After the account is closed: the business may ask for an export for 30 days. After that we delete the data from our live systems, or change it so that no person can be identified from it, within 90 days.
• Backups: database backups are kept as 14 daily copies and 12 monthly copies. Data that has been deleted from the live system therefore disappears from the backups within 12 months.

Data we hold as controller

• Account, invoice and payment records: 7 years after the end of the year they relate to, to meet tax and accounting law.
• Technical and error logs: 90 days in full, then up to 2 years with IP addresses and user identifiers removed.
• Records of sign-in attempts used for security: 30 days.
• Messages sent to us through contact forms and by email: up to 2 years after the matter is closed.
• Job and internship applications: up to 12 months after the position is filled, unless you ask us to keep your details for longer or you join us.
• Course and student records: for the length of the course and 7 years after it. The record of a certificate we have issued (the holder's name, the course and the date) is kept for as long as the certificate may need to be checked.
• The audit trail: for the life of the account.

Where a legal claim or an investigation is under way, we keep the relevant data until it is finished.

14. If something goes wrong

If we learn of a breach of security that affects personal data, we will act to contain it and to find out what happened.

• Where we are the controller, we will notify the Personal Data Protection Office immediately, as the Act requires, and we will tell the people affected in the way and at the time the Act and the Office require.
• Where we are the processor, we will tell the business concerned without delay and give it the information we have, so that it can notify the Office and the people affected.

If you think your account or your data has been misused, tell us straight away at info@neptunes.co.ug.

15. The regulator and complaints

The Personal Data Protection Office is the independent office, under the National Information Technology Authority, Uganda (NITA-U), that oversees the Act. The Act requires organisations that collect or process personal data to register with the Office. The Office keeps a public register, and you may also ask us for our registration details at info@neptunes.co.ug.

If you are unhappy with how your personal data has been handled, please tell us first so that we can try to put it right. You also have the right to complain to the Personal Data Protection Office at any time. Its contact details and complaint form are on its website, www.pdpo.go.ug.

16. Children

Our applications are made for businesses and are not meant for use by children. We do not knowingly open accounts for anyone under 18.

A business may sometimes need to record data about a child, for example a dependant or next of kin. The Act allows a child's personal data to be collected only with the consent of a parent or guardian, or where the law requires it or it is needed for research or statistics. The business is responsible for meeting that rule.

If you believe we hold a child's data that we should not have, write to info@neptunes.co.ug.

17. Our data protection contact

Questions about this policy, requests about your personal data and reports of a concern should be sent to our data protection contact:

• Email: info@neptunes.co.ug
• Post: Data Protection, Neptunes Solutions Limited, P.O. Box 361128, Uganda

18. Changes to this policy

We may update this policy when our applications, our providers or the law change. We will publish the new version with its effective date and version number. Where a change matters to how we use your data, we will tell account holders by email or by a notice in the application before it takes effect.