Privacy Policy

1. Who controls your data

GIX Agency Limited is the data controller for personal data collected through this website. Our contact address is Kalema Road, Kampala, Uganda. Our published data-protection contact is team@gixagency.com.

2. Data we collect

• Enquiry data: name, email address, company, and the information included in a message.
• Newsletter data: the email address submitted for subscription.
• Technical and security data: IP address, browser information, requested pages, timestamps, and events needed to prevent abuse and operate the website.
• Optional analytics data: usage and device information collected by Google Analytics only after consent.

Contact and newsletter information is provided voluntarily. Without the required contact fields, we cannot respond to an enquiry or register a subscription.

3. Purposes and lawful bases

• Responding to enquiries and preparing requested proposals: steps taken at your request before entering into a contract, or your consent where no prospective contract is involved.
• Newsletter communication: your consent, which may be withdrawn at any time.
• Website security, diagnostics, and abuse prevention: providing the website you request, your consent where required, and applicable legal obligations.
• Optional audience analytics: your consent.
• Record keeping and compliance: applicable legal obligations and the establishment or defence of legal claims.

Our authority to collect and process personal data comes from your consent, steps taken at your request before entering into a contract, performance of a contract, or compliance with a legal obligation, as applicable under the Data Protection and Privacy Act, 2019. We do not sell personal data, reuse it for an incompatible purpose, or use automated decision-making that produces legal or similarly significant effects.

4. Service providers and international transfers

We use Railway to host the website, Brevo to deliver email and manage newsletter contacts, GitHub to manage source code, and—when you consent—Google Analytics to understand website usage. These providers receive only the data needed for their role and process it under data-processing and security terms.

Some processing may occur outside Uganda. Before personal data is processed or stored outside Uganda, we conduct provider and transfer due diligence and require protection at least equivalent to Uganda's data-protection requirements, or obtain the data subject's consent where that is the applicable legal basis.

We may also disclose information when required by law, to protect rights or safety, or as part of a business reorganization subject to appropriate safeguards.

5. How long we retain data

• General enquiries: up to 24 months after the last substantive interaction, unless a longer period is needed for a contract or legal obligation.
• Newsletter records: until consent is withdrawn or the address remains inactive for 24 months.
• Security and diagnostic records: normally no more than 12 months, unless an incident requires longer investigation.
• Optional analytics event data: up to 2 months, after which it is deleted or de-identified.

At the end of the applicable period, we securely delete, destroy, or de-identify the record unless a contract, legal obligation, active dispute, or your valid consent requires longer retention.

6. Cookies and analytics

Essential site functions do not require analytics cookies. If Google Analytics is configured, it loads only after you select “Accept analytics.” Your choice is stored in your browser. Selecting “Decline” prevents analytics from loading. You may clear the site’s local storage in your browser to reset that choice.

7. Your rights

Subject to applicable law, you may request access to or correction of personal data, object to or restrict processing, request deletion, request a portable copy where applicable, and withdraw consent without affecting earlier lawful processing. Send requests to team@gixagency.com. We will acknowledge and assess the request, may verify your identity, and will respond within the period required by applicable law.

8. Security and incidents

We use access controls, encrypted transport, restricted production secrets, input validation, and operational monitoring designed to protect personal data. No internet service can guarantee absolute security. We assess suspected incidents and notify affected people and the relevant authority when required by law.

9. Contact and complaints

Contact GIX Agency Limited at team@gixagency.com or Kalema Road, Kampala, Uganda. You may also lodge a complaint with Uganda’s Personal Data Protection Office through pdpo.go.ug.