SentalicaSentalica
Sign in
Back to Sentalica
Data governance charter

Privacy Policy

Sentalica protects the data entrusted to our intelligence platform with clear boundaries, accountable safeguards, and respect for your rights under the Uganda Data Protection and Privacy Act, 2019.

Last updated · 26 August 2026 · Kampala, UgandaPrivacy controls and disclosures
1.

Data Controller & Statutory Governance

Sentalica (“we”, “us”, or “our”) is the Data Controller responsible for personal data collected through this platform, decision workspaces, and associated APIs.

Entity: Sentalica Uganda Limited
Data Protection Office: privacy@sentalica.com
Jurisdiction: Kampala, Republic of Uganda
2.

The Four Data Domains We Process

To describe the intended separation of data domains, Sentalica strictly categorizes all platform data into four distinct domains:

Domain 1: Public Sovereign Procurement Data

Sourced directly from official government systems (PPDA e-GP 2.0 portal, Uganda Gazette, OAG reports). Includes tender reference numbers, publication timestamps, bidder lists, Best Evaluated Bidder notices, and award values. Processed under legitimate interest to eliminate market asymmetry.

Domain 2: Statutory Registry Data

Official corporate filings from URSB (company registration numbers, official director registers) and explicitly indexed corporate records and PPDA suspension records. URA and NSSF verification feeds are not currently connected.

Domain 3: Derived Algorithmic Intelligence

Supported calculations and relationship derivations, each labelled separately from observed source facts. Explicitly identified on all screens as derived mathematical heuristics, distinct from primary statutory facts.

Domain 4: Private User Workspace Evidence

Documents you upload into Decision Workspaces (draft bids, private financial models, internal compliance certificates). Access is restricted through authenticated workspace controls and row-level security. Private uploads are not presented as public evidence.

3.

Account & Identity Data We Collect

  • Registration Credentials: Full name, professional email address, hashed passwords, organization affiliation, and operating role persona (*Supplier, Bank, Entity, Donor, Researcher, Executive*).
  • OAuth Profiles: If you authenticate via Google OAuth, we receive your email address, verified status, and basic profile name.
  • Session & Security Logs: IP address, device user-agent, authentication timestamps, and cryptographic session tokens.
  • Workspace State: Resumable workflow session progress stored in Supabase under user-isolated row-level security (RLS).
4.

Lawful Bases for Processing (PDPA 2019 & GDPR)

We process personal and organizational data strictly under the following lawful bases:

Contractual Necessity:

To maintain your active session, deliver Decision Workspace analysis, and persist your custom watchlists.

Legitimate Interests:

Aggregating public sovereign notices to advance public spend transparency and maintain platform cybersecurity.

Statutory Obligation:

Complying with lawful disclosure mandates under the laws of the Republic of Uganda.

Consent:

Optional analytics telemetry and voluntary notification digests.

5.

Private Workspace Controls

Private workspace isolation

When you upload tender documents or compliance files to an Eligibility or Verification Workspace:

  • Storage and transport encryption are provided by the configured hosting and storage providers; their current controls govern the exact mechanisms.
  • They are accessible only to your authenticated account via Supabase Row Level Security (RLS).
  • Private documents are never exposed in public search results, knowledge graph queries, or competitor benchmarks.
  • You may purge uploaded documents from your workspace at any time.
6.

Your Statutory Data Subject Rights

Depending on the law applicable to your circumstances, you may have the following data-subject rights:

  • Right to Access: Request a complete export of all personal and account data held about you.
  • Right to Rectification: Correct any inaccurate identity, organization, or role attributes in your profile settings.
  • Right to Erasure (“Right to be Forgotten”): Request deletion of your user account, uploaded documents, and saved workspace sessions, subject to legal and operational retention requirements.
  • Right to Object & Restrict: Restrict processing of your optional data for marketing or analytics.
  • Right to Data Portability: Obtain a structured JSON export of your workspace sessions and briefs.

To exercise any of these statutory rights, email privacy@sentalica.com. We verify and respond to requests within applicable legal timeframes.

7.

Technical & Organizational Security

Sentalica enforces defense-in-depth infrastructure security:

Encryption in Transit
Transport security is provided through the configured deployment provider.
Database RLS
PostgreSQL Row-Level Security isolating multi-tenant accounts.
Immutable Audits
Where captured, source-document hashes provide an additional integrity reference for stored artifacts.
8.

Contact & Supervisory Authority

If you have questions, concerns, or complaints regarding our data governance, you may contact our Data Protection Officer at privacy@sentalica.com.

In Uganda, you have the right to lodge a formal complaint with the Personal Data Protection Office (PDPO) at the National Information Technology Authority Uganda (NITA-U) at pdpo.go.ug.