Privacy Policy

1. Introduction

This Privacy Policy explains how Stonepath Estates ("we", "us") collects, uses, stores, and protects personal data when you use our platform. It is structured to align with Uganda's Data Protection and Privacy Act, 2019 ("the Act").

2. Data We Collect

• Identity and contact data: name, email address, phone number.
• Account data: password (stored hashed), role, verification status.
• Activity data: listings viewed, saved, or created; searches; enquiries; bookings.
• Payment-related data: transaction amount, type, status, and provider reference from Pesapal. We do not collect or store your card or mobile money PIN/credentials.
• Content you submit: property listings, images, reviews, and messages.

3. How We Use Your Data

We use personal data to: create and manage your account; display and manage listings; process payments and bookings; send transactional emails (confirmations, verification, password resets) and, where you have opted in, newsletter updates; detect and prevent fraud; and improve the Platform.

4. Legal Basis for Processing

We process personal data on the basis of: your consent (e.g. newsletter sign-up); the performance of a contract (e.g. creating your account, processing a payment you requested); and our legitimate interest in operating a secure and functional marketplace, balanced against your rights under the Act.

5. Third-Party Processors

We share personal data with the following processors, only as needed to provide the Platform:

• Pesapal — payment processing.
• Resend — transactional and newsletter email delivery.
• Railway — backend application and database hosting.
• Vercel — frontend application hosting.
• Cloudflare — content delivery and network security.

Each of these providers processes data under its own privacy and security terms; we select providers that offer appropriate safeguards for the data we share with them.

6. Data Retention

We retain account and transaction data for as long as your account is active and for a reasonable period afterward to meet legal, accounting, and dispute-resolution obligations. You may request earlier deletion as described in Section 7, subject to any retention we are legally required to maintain.

7. Your Rights Under the Act

As a data subject under Uganda's Data Protection and Privacy Act, 2019, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to legal retention requirements.
• Object to processing carried out on the basis of legitimate interest.
• Withdraw consent at any time for processing based on consent (e.g. unsubscribe from the newsletter).

To exercise any of these rights, contact us at support@stonepathestates.com.

8. Cookies and Local Storage

The Platform stores your authentication session in your browser's local storage (under the key sp_token) so you remain signed in between visits. This token is cleared automatically when your session expires or when you sign out, and it is not shared with third parties.

9. Data Security

We apply reasonable technical and organisational measures — including encrypted connections, hashed passwords, and access controls — to protect your data. No system is completely secure, and we encourage you to use a strong, unique password.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be highlighted on this page with an updated revision date.

11. Contact and Regulatory Registration

For any privacy question or to exercise your rights, contact support@stonepathestates.com. Stonepath Estates registers as a data controller/processor with Uganda's Personal Data Protection Office (PDPO) in accordance with the Act.