Privacy Policy
Last updated: 10 September 2026
This Privacy Policy explains how MuzigoFinder Uganda Limited collects, uses, stores, and protects your personal data when you use our platform and services.
1. Who We Are
MuzigoFinder Uganda Limited is a technology company registered in Uganda. We operate the MuzigoFinder platform — a broker-free housing marketplace connecting tenants with verified landlords across Uganda.
2. Data We Collect
We collect only what is necessary to provide our services. The categories below depend on your role (tenant, landlord, or field representative).
Account data
- Full name
- Email address
- Phone number
- Password (hashed — never stored in plain text)
- Role (tenant, landlord, field rep)
Identity verification (tenants)
- NIN card image
- Selfie photo for ID matching
- Verification status and date
Listing data (landlords)
- Property address and location
- Photos and property description
- Pricing and availability
- NIN / ownership documents for landlord verification
Booking & payment data
- Booking dates and status
- Payment method (MTN MoMo, Airtel, Visa, Mastercard)
- Pesapal transaction reference numbers
- Connection fee amount (UGX 25,000)
Usage data (automatically collected)
- Browser type and device
- Pages visited and search terms
- IP address (anonymised after 30 days)
- Session duration
3. How We Use Your Data
We process your data on the following legal bases under the Data Protection and Privacy Act 2019: contract performance, legitimate interest, and legal obligation.
- Create and manage your account and profile
- Match tenants with suitable listings and landlords
- Process connection fee payments securely via Pesapal
- Coordinate listing verification visits and booking confirmations
- Send transactional notifications (SMS, email, WhatsApp)
- Verify landlord and tenant identities to prevent fraud
- Improve our platform, fix bugs, and analyse usage patterns (aggregated, anonymised)
- Comply with legal obligations under Ugandan law
We do not sell your personal data. We do not use your data for third-party advertising or profiling.
4. Data Sharing & Third-Party Processors
We share your data only with the processors and parties listed below, each bound by data processing agreements or legal obligations.
Stores user accounts, listings, bookings, and reviews. Hosted on AWS (EU region). SOC 2 Type II certified.
Processes MTN MoMo, Airtel Money, Visa, and Mastercard payments. PCI-DSS compliant. Licensed by Bank of Uganda.
Sends booking confirmations, account verification, and system notifications. No marketing emails sent via this provider.
Hosts the MuzigoFinder web application. Processes server-side requests including form submissions and API calls.
Contracted individuals who access tenant NIN details and landlord property information solely for visit coordination and ID verification.
Personal Data Protection Office of Uganda, Uganda Revenue Authority, and Uganda Police Force — only when legally required.
5. Your Rights
Under the Data Protection and Privacy Act 2019, you have the following rights:
Request a copy of all personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Request deletion of your data where no legal basis exists to retain it.
Ask us to pause processing your data while a dispute is resolved.
Receive your data in a machine-readable format (JSON or CSV).
Object to processing based on legitimate interest.
To exercise any right, email info@muzigofinder.co.ug. We will respond within 21 days as required by law.
6. Data Retention
| Data type | Retention period |
|---|---|
| Active account data | For the duration of your account |
| Inactive accounts | 2 years after last login, then anonymised |
| Booking & payment records | 7 years (Uganda tax law requirement) |
| NIN / identity documents | Deleted 90 days after verification or rejection |
| IP addresses | Anonymised after 30 days |
| Support correspondence | 3 years |
7. Security
We apply industry-standard technical and organisational measures to protect your data:
- All data transmitted over HTTPS with TLS 1.3 encryption
- Passwords hashed using bcrypt — never stored or logged in plain text
- Database access restricted by row-level security policies (Supabase RLS)
- NIN documents stored in private, access-controlled cloud storage
- Admin and field rep accounts use role-based access controls
- Regular security audits and dependency vulnerability scanning
In the event of a data breach affecting your rights, we will notify you and the Personal Data Protection Office within 72 hours of discovery.
8. Policy Changes
We may update this Privacy Policy to reflect changes in our services, technology, or legal requirements. When we make material changes, we will:
- Display a notice on the MuzigoFinder platform
- Email registered users at least 14 days before the change takes effect
- Update the "Last updated" date at the top of this page
Continued use of MuzigoFinder after changes take effect constitutes acceptance of the updated policy. If you disagree with any change, you may delete your account at any time from your account settings.
9. Contact & Data Protection Officer
For any privacy-related question, request, or complaint, contact our Data Protection Officer: