Privacy Policy

Buy2Africa (www.buy2africa.com). Version 2.1 (draft). Last updated 12 November 2026.

1. Who is responsible

Buy 2 Africa Limited, a company registered in Uganda, with its office at Kampala, Uganda ("Buy2Africa", "we", "us"), is the data controller of your personal data. Contact: help@buy2africa.com.

We follow the Uganda Data Protection and Privacy Act 2019 and its Regulations. For customers in the European Union and the United Kingdom, we also follow the GDPR and the UK GDPR.

This policy covers www.buy2africa.com, our app, our messages (email, WhatsApp, phone, social media) and our shipping service.

2. The data we collect

From you:

• Account data: first and last name, email, phone, WhatsApp number, destination country, delivery address, Buy2Africa number, company name (B2B), sign-in data (through our sign-in provider, including Google, Apple or Facebook if you use them).
• Identity data: a copy of your ID when we ask for it to release a parcel, settle a claim or prevent fraud.
• Shipment data: tracking numbers, stores and sellers, contents, values, store invoices, order and delivery confirmations, parcel reports, approvals and shipment history.
• Payment data: invoices, amounts, deposits, payment method, proof of payment, refunds. We do not store full card numbers.
• Messages: support tickets, chats, emails, WhatsApp messages, phone call notes and social media messages with us.
• Insurance and claims data: your documents, photos and statements.
• Data about other people: the names and phones of people who collect parcels for you. Give us these only with their permission.

From your parcels and our partners:

• Parcel photos, weights, sizes and warehouse notes from our partners (when your parcel arrives and when we measure it again in the destination country).
• Tracking events from airlines and carriers, and data from customs agents, payment providers, and stores or banks (for example in a fraud report).

Automatically, when you use the website:

• IP address (stored only as a salted hash for consent and security records), device and browser data, pages visited, sign-in times, security checks (for example reCAPTCHA), cookie choices, and, if you agree, analytics and marketing cookies (see the Cookie Notice).
• Whether you open our emails or click their links.

3. Why we use it, and the legal basis

• Open and run your account, receive, store, measure, photograph, ship, clear and deliver your parcels: Contract
• Invoices, payments, tax, customs and accounting records: Contract and legal obligation
• Messages about your account, parcels, invoices and shipments: Contract
• Insurance and claims: Contract
• Identity checks, fraud prevention, sanctions screening, security, debt collection, legal claims: Legitimate interest and legal obligation
• Improve the website and our service, statistics, staff training: Legitimate interest, or consent for analytics cookies
• News and offers about Buy2Africa services by email or WhatsApp: Legitimate interest for our existing customers, or consent where the law requires it. You can unsubscribe at any time.
• Interest-based advertising: Consent (marketing cookies)

We do not sell your personal data. We do not make decisions about you only by automatic means that have legal or similar significant effects on you. Our system can mark parcels as ready to ship, but a person on our team gives the final go-ahead.

We may use software tools, including AI tools, to help our staff sort, translate and answer messages and to check documents. We do not allow these providers to use your data to train their general models, where we can control this.

4. Marketing

When you open an account, we add you to our mailing list for news and offers about Buy2Africa. Every marketing email has an unsubscribe link, and you can also unsubscribe in your account or by writing to us. You still get service messages (for example parcel arrival and invoices) after you unsubscribe.

5. Sign in with Google, Apple or Facebook

You can create your Buy2Africa account and sign in with your Google, Apple or Facebook account. Our sign-in provider, Descope, connects to these services for us.

What we receive from Google. When you choose "Continue with Google", Google asks for your permission and then gives us only: your name, your email address, whether Google has verified that email address, your profile picture (if you have one) and a Google account ID. These are the "openid", "email" and "profile" permissions. We do not receive your Google password, and we do not get access to your Gmail, Google Drive, contacts, calendar or any other Google data.

How we use it. We use this data only to: create your Buy2Africa account and sign you in; show your name in your account and on your Buy2Africa shopping address; send you messages about your account, your parcels and your bills; and keep your account safe (for example, to stop a second account with the same email address).

What we do not do. We do not sell Google user data. We do not use it for advertising, and we do not give it to advertising partners. We do not use it to train AI models. We share it only with the service providers that run your account for us (Descope for sign-in, Vercel for hosting, Neon for the database, and our email providers), and only to provide the service. People on our team can see it only when they need it to help you, for security, or when the law requires it.

Google API Services User Data Policy. Buy2Africa's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How long we keep it, and how to remove it. We keep it while your account is open, then as described in section 8. You can remove Buy2Africa's access to your Google account at any time at https://myaccount.google.com/permissions. To delete your account and the data we hold, write to help@buy2africa.com or use the support page. We delete it within 30 days, except data we must keep by law (for example invoices).

Apple and Facebook work the same way: we receive only your name, email address and an account ID, and we use them only as described above.

6. Who we share it with

Only what each one needs:

• Logistics: our warehouse partners (DealTas in the USA and Germany, and our partners in Dubai and the UK), airlines, freight forwarders, couriers, delivery riders, customs agents and customs authorities.
• Payments: payment and mobile money providers and banks.
• Technology providers: website hosting (Vercel), database (Neon), sign-in (Descope), email (Google Workspace, MailerSend, Postmark), support desk and WhatsApp (Freshworks/Freshdesk), security checks (Google reCAPTCHA), store price search (SerpApi or Serper), analytics (Google Analytics 4, only if you accept analytics cookies).
• Advertising partners: Meta (Facebook, Instagram) and TikTok, through their pixels, only if you accept marketing cookies. They may use this data under their own privacy policies.
• Stores and banks: when we check a fraud report or a claim.
• Professional advisers: lawyers, accountants, auditors and insurers.
• Authorities: customs, tax, police, courts and regulators, when the law requires it or to protect our rights, our customers or the public.
• Business transfer: if the business, the brand or its assets are sold, merged or transferred, data may pass to the new owner, who must use it under this policy.

Our providers must protect your data and use it only for our instructions.

7. International transfers

Your data is processed in Uganda, the USA, the European Union, the United Kingdom, the United Arab Emirates and other countries where our partners and providers are, because our service moves parcels between these countries. These countries may have different data protection laws. Where the law requires it, we use safeguards such as standard contractual clauses, or we transfer data because it is necessary to perform our contract with you. Contact us for details.

8. How long we keep it

• Shipment, invoice, customs, tax and payment records: 7 years after the shipment.
• Account data: while your account is open, then 2 years.
• ID copies: until the parcel is released or the claim is closed, then 6 months, unless needed for a legal claim or fraud case.
• Parcel photos: 12 months.
• Support messages: 3 years.
• Marketing data: until you unsubscribe.
• Consent and security records: as long as needed to prove them.

We may keep data longer when the law requires it or to defend a legal claim.

9. Your rights

You can ask us to: give you a copy of your data; correct it; delete it; limit or object to its use (including for marketing); move it to another provider; and withdraw your consent. Write to help@buy2africa.com. We may ask you to prove your identity. We answer within 30 days. Some data we must keep by law (for example invoices and customs records).

You can complain to the Personal Data Protection Office of Uganda (www.pdpo.go.ug), or to the data protection authority in your country. Please contact us first so we can try to help.

10. Security

We use technical and organisational safeguards: encrypted connections, sign-in without passwords, access by role in our back office (staff sign in only with company accounts), activity logs, signed and time-limited links for files, and hashed IP addresses. No system is fully secure, and we cannot guarantee the security of data sent over the internet. Tell us at once if you think your account is at risk. If a data breach puts your data at risk, we tell the PDPO and you as the law requires.

11. Children

Our service is for people aged 18 and over. We do not knowingly collect data from children. If you think a child gave us data, contact us and we will delete it.

12. Other websites

Our website links to stores, carriers and other websites, and some store links may be affiliate links. We do not control these websites. Their own privacy policies apply.

13. Changes

We may update this policy. We publish the new version with its date on the website and tell account holders about important changes by email or in their account.

14. Contact

Buy 2 Africa Limited, Kampala, Uganda. Email: help@buy2africa.com.

Adapted from the Privacy Policy (GDPR enhanced) template prepared and made publicly available by General Legal, PC (CC0 1.0). The template is for general reference only and is not legal advice. General Legal has not reviewed this document.