Privacy Policy

1. Introduction

This Privacy Policy explains how Sumic Online collects, uses and protects the personal information of everyone who uses the platform: buyers, sellers and logistics partners alike.

Sumic Online is operated by Sumic IT Solutions Ltd, a company registered in Uganda. Sumic IT Solutions Ltd is the data controller for the information described in this policy. Our postal address, phone number and email addresses are in section 11.

By using Sumic Online, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.

This policy applies to all information collected through our website (sumiconline.com), our Android and iOS mobile application (com.sumiconline.app), and any related services, sales, marketing or events (collectively, the "Services"). It covers all three kinds of account on the platform: buyer accounts, supplier and seller accounts, and logistics partner accounts.

2. Information We Collect

2.1 Information You Give Us

We collect the personal information you provide when you use the Services:

Registration: your first and last name, email address, password, phone number (optional) and organisation name. Every buyer account is also given a buyer organisation record.
Your profile: name, phone number, street address, city and country. Your email address is shown but cannot be changed.
Orders and delivery: the items you order, and the delivery contact (name, email, phone, address, city and country), plus any notes you add.
Payments: for mobile money, your payer phone number and network (MTN or Airtel). For card payments, nothing; see section 5. We keep the amount, currency, method and status of every transaction, together with the payer name and notification email attached to it.
Business and verification details (sellers and logistics partners): organisation name, registration number, tax identification number, year established, number of employees, industry, business description, pickup address and contact details, the verification documents you upload and, if you receive payouts, your payout account details (method, account holder name, account number and provider).
Content you create: product reviews and ratings, messages and enquiries you send to other users, product listings and images you upload and, if you report content or block another user, the reason and details you give us.
Shopping activity: your cart, saved items, wishlist and the sellers you follow are stored against your account so they appear on every device you sign in from.
Support and dispute records: the tickets, evidence and correspondence you send us.

2.2 Information Collected Automatically

Approximate location at sign-up: when an account is created, our server asks the IP lookup service ipwho.is where the request came from, and stores the country, region and city on the account, plus a flag if a VPN, proxy or Tor connection was detected. We use it for fraud prevention; it does not follow you around.
IP address on each request: used briefly in memory to limit abusive traffic. It is not written to your account record.
App usage statistics: described in full in section 2.5. This is our own first-party measurement; no third-party analytics or advertising service is involved.
Promotion views and taps: when you see or tap a promotion in the app or on the site, we record it so we can measure it. Promotions on Sumic Online are created and served by us; we carry no ad networks.

We do not collect precise GPS location, contacts, call logs, SMS, photos, audio, or the list of apps installed on your device. The one exception is our own delivery operation: a courier's shift record includes the GPS readings taken while working, because that is what proves a delivery happened.

2.3 Information from Third Parties

We receive information about you from:

Google Sign-In, if you choose it. Google gives us your name, email address and profile photo; your Google password is never shared with us.
Sign in with Apple, if you choose it. Apple gives us your name (on first sign-in only) and either your email address or a private relay address.
Our payment processor tells us whether a payment succeeded, failed or is awaiting confirmation.
ipwho.is answers our sign-up location lookup, as described in section 2.2.

2.4 What the Sumic Online Mobile App Collects

The app collects the same account, order and support information described above. In addition:

Sign-in details: your email and password, or your Google or Apple account details if you use one of those.
Device and app information: app version and build number, device model, manufacturer and operating system version, so we can deliver the right content and support the phones our customers actually own. Section 2.5 explains exactly how this is sent.
Notifications need no device token: order, message and promotion alerts are built on your phone from events arriving over our encrypted connection. The app does not register a push token with Google Firebase or Apple, and neither company is involved in delivering your alerts. Notifications are optional: you can decline the permission, or turn them off in your device settings at any time, and the app keeps working.
Data stored on your device: the app keeps a local copy of your signed-in session, saved delivery addresses, search history, recently viewed products, cached orders, cart, favourites, notifications, blocked users and your preferences (theme, language, currency) so it works on a poor connection. Your sign-in tokens and the analytics identifier in section 2.5 are held in the device's encrypted secure storage. Everything on your phone is removed when you log out, delete your account, clear the app's storage, or uninstall the app.

The app asks for three Android permissions: internet access; permission to show notifications (Android 13 and later, and you can refuse it); and, on Android 12 and older only, permission to write a product poster to your gallery when you tap save. On iPhone it asks for one thing only: permission to add a product poster to your photo library; it cannot read the photos already there.

It never asks for your location, camera, microphone, contacts, call log, SMS, the files on your device, or the advertising identifier, and it does not show the App Tracking Transparency prompt, because it does not track you across other companies' apps and websites.

2.5 Mobile Analytics (Our Own Usage Measurement)

The app sends Sumic Online a small, encrypted usage report so we can see how many people use the app, which screens they use, and which devices and versions we need to support. It goes only to our own servers, is never used for advertising, and is never shared or sold. It contains:

an installation identifier, a random 32-character code the app creates on first launch, not derived from any hardware detail or anything personal;
a hashed device key, a one-way SHA-256 hash of your phone's system identifier, computed on your phone. The original identifier never leaves the device, and our server accepts only a 64-character hash, so the raw identifier could not be stored even by mistake. It exists so that reinstalling the app on the same phone counts once rather than twice;
platform, app version and build, how many times the app was opened since the last report, and which screens were viewed and when. Screen names come from a fixed list built into the app, so they never contain a product name, an order number, a search term, or anything you typed;
on the first report, and after each sign-in or sign-out, device details: operating system version, manufacturer, brand, hardware model, retail name (for example "TECNO SPARK 10C"), whether it is a real phone or an emulator, and the app build number. On Android the retail name is sent only if it still names the manufacturer or a known product series, so a personal name like "Amina's phone" stays on your device. On iPhone the device name you chose is never read.

If you are signed in, our server records your account ID alongside the report so activity counts once per person rather than once per device. If you are not signed in, it counts as guest activity against the installation. We do not store your IP address or browser information with analytics data, and we do not work out your location from it.

Mobile Analytics collects no IMEI, serial number, MAC address, SIM data, phone number, advertising identifier (IDFA or AAID), GPS location, contacts, photos, files, keystrokes, crash logs or screen recordings. There is no crash-reporting service in the app at all.

Because this data is needed to operate and support the app, it cannot be switched off inside the app, and we declare it as required rather than optional in the Google Play and Apple App Store privacy forms.

3. How We Use Your Information

We use the information we collect for the following purposes:

Account Management: Create and manage your account, verify your identity, and authenticate logins.

Transaction Processing: Process orders, payments and shipping, handle returns and refunds, and issue invoices.

Matching Buyers and Sellers: Show your listings to buyers, and show your order and enquiry details to the seller or logistics partner you chose.

Customer Support: Respond to inquiries, resolve disputes, and provide technical assistance.

Platform Improvement: Understand how the app is used through the first-party analytics in section 2.5, and improve features accordingly.

Security & Fraud Prevention: Detect and prevent fraud, unauthorized access and other illegal activity, including the sign-up location check in section 2.2.

Moderation: Review content reports and blocks, and remove content that breaks our Terms.

Legal Compliance: Comply with applicable laws, regulations and legal processes, including tax and accounting record-keeping.

We do not build a behavioural advertising profile of you, we do not make automated decisions that have a legal or similarly significant effect on you, and we do not license your personal data to anyone.

5. Data Security

We take technical and organizational measures to protect your personal information from unauthorized access, disclosure, alteration or destruction. Specifically:

Encryption in transit

Every request between your device and our servers uses HTTPS/TLS, with HTTP Strict Transport Security enabled, and reaches us through Cloudflare.

Card details stay with the provider

Card payments are entered on our payment provider's own secure checkout page, opened inside the app. We never see, receive or store card numbers, expiry dates or CVV codes.

Access controls

Passwords are stored only as bcrypt hashes, and reset links, confirmation codes and recovery PINs are stored as one-way hashes. Staff access is role-based and enforced on the server, not merely hidden in the interface.

Data minimisation by design

The app hashes your device identifier before sending it, asks for a minimum of permissions, and our analytics endpoint discards any field it was not written to expect.

No method of transmission over the internet, and no method of electronic storage, is 100% secure, and we will not pretend otherwise. We do not claim to hold a security certification we have not been audited for, and we do not claim penetration testing we have not carried out. Keeping your password private and using a strong one genuinely reduces your risk.

6. Your Rights

Under Uganda's Data Protection and Privacy Act, 2019, and the data protection laws of other places where you may live, you have the following rights over your personal information:

Access: ask what we hold about you, and get a copy of it.
Correction: fix inaccurate or incomplete information yourself in your profile, or ask us to.
Deletion: delete your account at any time without needing anyone's permission. Section 8 says exactly what that removes and what it cannot.
Objection: object to processing of your information for particular purposes.
Withdraw consent: stop marketing communications, decline notification permission, or undo any consent you gave.
Portability: ask for the data you gave us in a transferable form.
Complain: raise it with us first, and if you are not satisfied, with the data protection authority in your country. If you are in the European Economic Area, you may lodge a complaint with your supervisory authority.

Most of this you can do yourself in your account settings. For a request that needs us (an access copy, a portability export, or removal of something section 8 says we kept), write to [email protected] from the email address on your account. We will verify who you are and answer within 30 days, free of charge.

7. Data Retention

We keep personal information only for as long as we need it for the purpose it was collected for, or longer where the law obliges us to. The periods below are what our systems actually do, not what sounds reassuring.

Account information: while your account exists. Deleting it starts a 30-day recovery window, after which an automated job purges the record.
Sign-ups that were never confirmed: a scheduled job removes a pending registration 24 hours after its confirmation code expires, so an abandoned email address does not linger on the system.
App analytics (device records and daily activity): deleted automatically 400 days after the device was last seen. The "online now" presence record is kept for 45 days.
App analytics (screen-view totals): kept as aggregate counts for as long as we run the platform. These totals are not linked to any person or device.
Orders: kept for as long as tax, accounting and consumer-protection law requires, which in Uganda means years rather than months. When you delete your account, the delivery name on each order becomes "Deleted user" and the email, phone and street address are blanked; the order contents, amount and city are what remain.
Payment records: kept so that money that moved can be reconciled, refunded and audited. As section 8 explains, the payer's mobile money number or notification email is one thing we cannot erase while the transaction still has to be traceable.
Messages and enquiries: kept while the conversation is needed to service an order. After account deletion the text remains with the recipient, and your contact details are removed from it.
Uploaded files and verification documents: kept while your account is active, and not swept away automatically when it closes: ask us and we will delete them.
Server logs: our infrastructure writes operational logs, and we have not configured a fixed deletion period for them. We are telling you that rather than quoting a number we do not enforce.
Data cached on your device: until you log out, delete your account, clear the app's storage, or uninstall the app.

Where we have not automated a deletion, we will carry it out by hand if you ask. Write to [email protected].

8. Deleting Your Account and Data

You can delete your Sumic Online account without contacting anyone. There are three ways:

In the mobile app

Open Profile → Settings → Delete Account, read what will happen, then confirm your email address and password. The same Settings screen has Restore an account you deleted in the last 30 days should you change your mind.

On this website

Visit sumiconline.com/delete-account, sign in, and confirm. That page lists the same details set out here.

By email

If you can no longer sign in, write to [email protected] from the address on the account. We will verify your identity and delete it, normally within 30 days.

The 30-day window

Deletion is not instantly irreversible. When you confirm, your account is deactivated and taken off the platform, and signing in stops working. For 30 days after that you can restore it from Settings in the app, or from the delete-account page. When the 30 days pass, an automated job deletes the account permanently, and after that it cannot be recovered.

What is deleted: your sign-in credentials, profile, cart, saved items, wishlist, the sellers you follow, your product reviews, the RFQs and store enquiries raised against your account, and your notification preferences. If you are a buyer whose organisation has no other members, that buyer organisation record goes with you. If you ran a seller or logistics account, deleting it removes your product listings, banners, promotions and enquiries.

What is cleaned up but kept: your completed orders stay as accounting records, with the delivery name replaced by "Deleted user" and the email, phone and street address blanked out. The messages you sent stay with the seller or logistics partner you contacted, with your contact details removed from the conversation. Enquiries that an open order still needs stay, with your user identity unlinked. Any delivery quotes a courier owed you are closed off rather than erased, so the order follows its normal deadline.

What we cannot delete automatically, and would rather tell you than leave you to discover it:

Payment records. Each attempt keeps the payer's mobile money number or notification email, the payer name and your user ID, because a transaction that has moved money must stay auditable and refundable. Ask us and we will anonymise these once nothing is outstanding on your account.
Files you uploaded. Product images and business verification documents sit in our storage and are not swept away by the deletion job. Email us and we will delete them, and any listings that used them.
An order still in progress. If a buyer has an open order against your account, we keep the delivery details a courier needs to finish it, and remove them when the order closes.
Copies already lawfully made. Records given to a tax authority, bank, insurer or court, and anything we must keep because you or we are under a legal duty.

If you have orders in progress, please complete or cancel them before deleting, so the other party is not left unable to reach you or deliver to you.

9. Cookies & Local Storage

This section is a correction, and we would rather be accurate than conventional: the Sumic Online website does not use cookies. Earlier versions of this policy described essential, analytics and marketing cookies, named Google Analytics, and pointed at a cookie consent banner. We set no cookies at all, have never put Google Analytics or any other tracking script on this site, and there is nothing to consent to, so there is no consent banner. Nothing here changes what we do with your data; it changes what we claim.

What we do use is your browser's own local and session storage. It holds:

Your sign-in session: the token that keeps you logged in, with your name and email so the page can greet you. Signing out, or clearing site data, removes it.

Your choices: your currency and the exchange rates we last fetched, your language, the delivery location you typed, and which promotions you have already been shown so we do not repeat them.

Your convenience: your cart, saved items, wishlist, recent searches, trending searches and saved searches, all kept on your device so the site feels quicker. A search term is sent to the server only to look up results; the history of them is never stored on our side.

Because this is storage rather than a cookie, it is not attached to every request and no other website can read it. You can refuse or erase it whenever you like: your browser's settings have "clear browsing data", and a private or incognito window discards it when you close it. The site still works if you block storage entirely; you will simply have to sign in again, and your cart will not survive the visit.

The Sumic Online mobile app uses no cookies either; its on-device storage is described in section 2.4.

10. Children's Privacy

Sumic Online is a business-to-business and business-to-consumer trading platform intended for adults. Our Services are not directed at children, and you must be at least 18 years old to create an account, as set out in our Terms of Service.

We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.

11. Contact Us

Sumic Online is provided by Sumic IT Solutions Ltd. If you have questions about this Privacy Policy or our data practices, or want to make a request under section 6, contact us:

Post

Sumic IT Solutions Ltd
National ICT Innovation Hub Building, 1st Floor
New Port Bell Road
P.O. Box 172928, Kampala GPO
Kampala, Uganda

We have not appointed a separate Data Protection Officer. Requests under section 6 come to the privacy address above and are handled by the team that runs the platform.

Privacy Policy

Table of Contents