Privacy Policy

GoodCitizen is a multi-channel messaging platform operated by GoodCitizen Company Limited (“GoodCitizen”, “we”, “us” or “our”). We help businesses connect channels such as WhatsApp, SMS and Telegram, build automated conversation flows, and manage the customer conversations that run across them.

GoodCitizen Company Limited acts as a Tech Provider (also described by Meta as a Business Solution Provider) on the WhatsApp Business Platform. In that role we help our business customers send and receive messages through Meta’s platform. This policy explains what personal data we handle, why we handle it, and the choices you have. We handle personal data in line with Uganda’s Data Protection and Privacy Act, 2019.

The way we handle personal data depends on the situation:

• As a data controller. When you sign up for a GoodCitizen account, visit our website, or contact our team, we decide how and why your data is used. For that data we are the controller.
• As a data processor. When our business customers use GoodCitizen to message their own contacts and end users, those businesses decide what messages are sent and why. For that data we act as a processor and follow the customer’s instructions under our customer agreement and data processing terms. If  you are an end user who received a message through GoodCitizen, the business that contacted you is the controller, and you should review that business’s own privacy notice.

We collect the following categories of data:

• Account and profile data. Name, work email, phone number, company name, role, password (stored in a hashed form) and workspace settings.
• Messaging and channel data. Message content, message metadata (sender and recipient identifiers, timestamps, delivery and read status), contact records, phone numbers, display names, media and attachments, and the WhatsApp Business Account and phone number details needed to connect a channel.
• Meta platform data. When you connect a WhatsApp Business Account, we process data that Meta shares with us to operate the connection, such as business account identifiers, phone number identifiers, message templates and quality ratings. We handle this data in line with the Meta Platform Terms and the WhatsApp Business Terms.
• Billing data. Plan, invoices, usage counts and payment status. Card details are handled by our payment providers and are not stored on our servers.
• Technical and usage data. IP address, device and browser type, log data, and how you interact with the product, collected to keep the service secure and reliable.

We use personal data to:

• Provide, operate and maintain the GoodCitizen platform and its messaging features.
• Route messages to and from connected channels, including WhatsApp through Meta.
• Authenticate users, secure accounts and prevent fraud or abuse.
• Provide customer support and respond to your requests.
• Handle billing, invoicing and account administration.
• Monitor performance, fix problems and improve the product.
• Meet legal, regulatory and platform obligations.

We do not sell personal data. We do not use the content of messages processed on behalf of our customers to build advertising profiles, and we only use Meta platform data for the limited purposes permitted by Meta’s terms.

We only process personal data where we have a lawful basis to do so under the Data Protection and Privacy Act, 2019 and any other law that applies to you. Depending on the situation, we rely on one or more of the following:

• Your consent, which you can withdraw at any time.
• Performance of a contract, to deliver the service you or your business signed up for.
• Compliance with a legal or regulatory obligation.
• Our legitimate interests, such as securing the platform and improving our product, where these are not overridden by your rights.

We handle personal data in line with Uganda’s Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations made under it. The Act sets out how personal data must be collected, processed, stored, shared and disposed of, and it gives you rights over your data. We follow its core principles: we collect data lawfully and fairly, use it only for the purposes we tell you about, keep it accurate and up to date, hold it only for as long as we need it, keep it secure, and remain accountable for how it is handled.

We recognise the regulatory role of the Personal Data Protection Office (PDPO), which operates under the National Information Technology Authority, Uganda (NITA-U) and supervises compliance with the Act. Where the Act requires it, we act as a registered data collector, data processor or data controller. If you believe we have not handled your personal data in line with the Act, you may lodge a complaint with the PDPO. You can find out more at www.nita.go.ug.

We share personal data only where needed, with:

• Meta Platforms. To send and receive WhatsApp messages and operate connected business accounts. Meta handles that data under its own terms and privacy policy.
• Channel and infrastructure providers. SMS gateways, telecom carriers, cloud hosting, and other providers that help deliver messages and run the platform.
• Service providers. Payment processors, analytics and support tools that act on our instructions under contract.
• Our business customers. Where we process end user data on their behalf, we make it available to the relevant customer workspace.
• Legal and safety. Authorities or advisers when required by law, or to protect our rights, users and the public.

We require the providers we work with to protect personal data and to use it only for the purposes we set.

Our platform integrates with external services to deliver messaging and reporting features, including WhatsApp (Meta), RapidPro and Redash. These services maintain their own privacy policies that govern how they handle data, and we encourage you to review them independently. We share data with them only as needed to run the service, and we remain responsible for the data we place in their care.

GoodCitizen Company Limited and the providers we use may process data in countries other than your own. Where we transfer personal data outside Uganda, we do so in line with the Data Protection and Privacy Act, 2019 and put appropriate safeguards in place, such as contractual protections or an equivalent legal mechanism, so that your data stays protected.

We keep personal data for as long as it is needed for the purposes described in this policy. For data we process on behalf of a business customer, retention is set by that customer and their agreement with us. When a workspace closes or a retention period ends, we delete or anonymise the data, unless the law requires us to keep it longer (for example for tax or accounting).

We use technical and organisational measures to protect personal data, including encryption in transit, access controls, hashed credentials and monitoring. No system is perfectly secure, but we work to protect your data, and where the Data Protection and Privacy Act, 2019 requires it, we will notify the Personal Data Protection Office and affected people of a breach that poses a real risk to their rights.

Under the Data Protection and Privacy Act, 2019 and other laws that may apply to you, you have the right to:

• Access, correct or delete your personal data.
• Withdraw consent or object to the processing of your data.
• Ask us to restrict processing, or to provide your data in a portable format.
• Ask us not to use your data for direct marketing.

To exercise any of these rights, email us at gcinnovate@gmail.com. If you are an end user who was contacted by a business through GoodCitizen, please reach out to that business first, since they control how your data is used, and we will help them respond where needed.

If you believe your data rights have been violated, you may file a complaint with the Personal Data Protection Office (PDPO) under NITA-U. See www.nita.go.ug for more details.

You can ask us to delete personal data we hold about you. To request deletion, email gcinnovate@gmail.comwith the subject line “Data deletion request” and tell us which account, workspace or phone number your request relates to. We will confirm your request, verify your identity where needed, and delete the data within a reasonable time, unless we are legally required to keep it.

If your data was shared with Meta as part of a WhatsApp connection, deletion on our side does not automatically remove copies held by Meta or by the business that contacted you. We will let you know where you may need to contact them directly.

Our website and app use cookies and similar technologies to keep you signed in, remember your preferences and understand how the product is used. You can control cookies through your browser settings. Turning some cookies off may affect how parts of the service work.

GoodCitizen is built for businesses and is not directed at children. We do not knowingly collect personal data from children under the age required by local law. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this policy from time to time. When we make a material change, we will update the date at the top of this page and, where appropriate, let you know through the product or by email. Please review it from time to time to stay informed.

If you have questions about this policy or how we handle personal data, contact GoodCitizen Company Limited at gcinnovate@gmail.com. We are here to help.