How we handle your personal data when you use Sentefy to give to, or raise funds for, Ugandan communities.
This Privacy Policy explains how Sentefy Solutions Limited collects, uses, stores, shares and protects your personal data when you use the Sentefy platform, our website and related services. We are committed to handling your data lawfully, fairly and transparently, in line with Uganda’s Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.
Sentefy is operated by Sentefy Solutions Limited, a company incorporated under the laws of the Republic of Uganda (“Sentefy”, “we”, “us” or “our”). We are the data controller responsible for the personal data we collect through the platform.
If you have any questions about this policy or how we handle your data, you can reach our data protection contact at privacy@sentefy.com.
This policy applies to everyone who uses Sentefy, including:
When you create an account, we collect your Ugandan mobile phone number, which we use to sign you in securely using a one-time password (OTP) sent by SMS. You may also provide your full name, an email address, a short bio and a profile photo. The OTP code itself is generated and delivered by our authentication provider and is never stored by Sentefy.
Campaign creators must verify their identity before they can activate a campaign or receive funds. This is required by Bank of Uganda guidelines on Know Your Customer (KYC) and Anti-Money Laundering (AML) measures.
Today this is a manual review by Sentefy: starting verification creates a request and we contact you directly to confirm your identity. No identity documents or ID numbers are collected through the platform, and no data is sent to any third-party verification provider. The remainder of this section describes the Smile ID integration that is built but not yet live — it becomes accurate only once we switch it on, and we will update this policy and tell you before we do.
Verification will be carried out by Smile ID (Smile Identity Inc.), a specialist identity-verification provider used by banks and financial institutions across Africa. When you verify, you are taken to a secure page operated by Smile ID, where you photograph your National ID and take a selfie. Those images are captured by Smile ID, not by Sentefy. Smile ID authenticates the document, matches your selfie to it, and cross-checks the ID details against the National Identification & Registration Authority (NIRA) database.
When the check is complete, Smile ID sends the result to Sentefy. That result includes some of the identity details Smile ID read from your ID (such as your ID number and date of birth), which we use only momentarily, in memory, to complete the required NIRA cross-check — and then discard. Sentefy permanently stores only the outcome of the verification: whether it passed or failed, which checks were performed, and reference numbers. We never keep or log your ID images, selfie, National Identification Number or date of birth. Smile ID processes your identity data under its own privacy policy, available at smile.id/privacy-policy.
For large donations (currently those of UGX 5,000,000 or more), we are required to carry out enhanced due diligence before processing the payment. We ask you to provide the source of the funds, the purpose of the transaction, how frequently you expect to give, and, optionally, your relationship to the campaign. This information is encrypted and held with the donation record for the retention period required by law.
When you make a donation, we collect the amount, the payment status, and the reference provided by our payment partner. If you choose to provide them — whether or not you have an account — we collect your name, phone number and email so the campaign can recognise your contribution. You may also give anonymously, in which case your donation is linked only to the campaign and the payment reference.
If you create a campaign, we collect the campaign title, description, fundraising goal and any images you upload. This information may be displayed publicly or, for invitation-only campaigns, to invited supporters.
To keep the platform secure and to meet our record-keeping obligations, we log details of each payment event, including the data exchanged with our payment partner and any error information. We also use IP addresses temporarily to limit abusive or automated requests.
We keep records of the identity checks described above, of the additional information collected for large donations, and of any reports we are required to make to the authorities. Where the law requires it, we will share transaction and identity data with the Financial Intelligence Authority, the Bank of Uganda or other authorities.
We do not currently screen users against sanctions, politically-exposed-person or terrorism-financing lists, and we do not send your name to any screening provider. If we introduce screening, we will update this policy first.
We use your personal data to:
Depending on the activity, we rely on one or more of the following legal bases under the Data Protection and Privacy Act, 2019: performance of our contract with you; compliance with a legal obligation (for example, KYC, AML and record-keeping requirements); your consent (for example, when you choose to begin identity verification); and our legitimate interests in operating a secure and trustworthy platform.
We do not sell or rent your personal data. We share it only with the service providers who help us operate the platform, and with authorities where the law requires it. Each provider listed below processes data under its own privacy policy.
To be clear, we never collect or store:
We keep personal data only as long as necessary for the purposes described in this policy, or for as long as the law requires us to.
Some of our service providers store and process data on servers located outside Uganda (for example, in the European Union and the United States). Where your personal data is transferred outside Uganda, we take steps to ensure it remains protected to a standard consistent with Uganda’s Data Protection and Privacy Act, 2019, including through our agreements with those providers.
Under the Data Protection and Privacy Act, 2019, you have the right to:
To exercise any of these rights, contact us at privacy@sentefy.com. We aim to respond within 30 days. You also have the right to lodge a complaint with Uganda’s Personal Data Protection Office if you believe your data has been handled unlawfully.
We use technical and organisational measures to protect your data, including encrypted connections, encryption of sensitive compliance information at rest, access controls that limit who can view sensitive information, a no-retention design for identity documents (none are collected through the platform today; if the hosted check is switched on, capture happens on our partner’s secure page and any identity detail returned to us is used only transiently and never stored), verified payment notifications, and limits to prevent abuse. If a data breach occurs that affects your rights, we will notify the Personal Data Protection Office and affected individuals as required by law.
Sentefy is not intended for anyone under 18 years of age, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the platform. Please review this policy periodically.
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us:
This Privacy Policy should be read together with our Terms & Conditions.