Privacy Policy

1. Introduction

Green Label Services Uganda Ltd ("we", "us", or "our") is an environmental and public health consultancy incorporated in Uganda, specialising in the safe disposal of hazardous waste. Our registered office is located in Kampala, Uganda.

This Privacy Policy explains how we collect, use, store, and protect personal data when you interact with our website at greenlabelservices.co.ug, contact us directly, or engage with our services. It applies to all visitors, clients, job applicants, and anyone who submits information through our web forms.

We are committed to processing personal data responsibly and in accordance with the Uganda Data Protection and Privacy Act 2019 (DPPA) and, where applicable, the principles of the EU General Data Protection Regulation (GDPR). We treat the protection of your personal information as a professional and ethical obligation — not merely a legal one.

Please read this policy carefully. If you have any questions, see Section 13 — Contact Us.

2. Information We Collect

We collect information in three ways: directly from you, automatically, and from third parties.

Information you provide directly

• Contact form: name, email address, phone number, company name, and your message.
• Quote request form: name, email, phone, company, location, waste type, volume, and service requirements.
• Job applications: name, email, phone, CV/résumé, cover letter, and any other information you include.
• Email or phone enquiries: any personal data you include in direct correspondence.

Information collected automatically

• Usage data: pages visited, time on site, referring URL, browser type, operating system, and device type.
• IP address: used for security, fraud prevention, and approximate geolocation (country/region level only).
• Cookies and similar technologies: see Section 5 for full details.

Information from third parties

We may receive limited information about you from analytics providers (e.g. Google Analytics, if enabled) and social media platforms when you interact with our content on those platforms. We do not purchase or source personal data from data brokers.

3. How We Use Your Information

We use personal data for the following purposes:

• Service delivery: to respond to enquiries, prepare and send quotations, and fulfil contracted waste management services.
• Client relationship management: to maintain accurate records of our engagements and communicate service updates.
• Recruitment: to process job applications, assess suitability, and contact shortlisted candidates.
• Legal and regulatory compliance: to meet our obligations under NEMA guidelines, the DPPA, tax law, and other applicable Ugandan legislation.
• Site improvement: to analyse aggregated usage patterns and improve our website content and user experience.
• Security: to detect, investigate, and prevent fraudulent or unauthorised activity.
• Communications: to send transactional emails (e.g. form acknowledgements) and, where you have consented, service newsletters or updates.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Legal Basis for Processing

Under the Uganda Data Protection and Privacy Act 2019 and GDPR principles, we rely on the following legal bases:

• Consent — where you have explicitly agreed (e.g. cookie consent, opting in to marketing communications). You may withdraw consent at any time by contacting us or updating your cookie preferences.
• Contractual necessity — where processing is necessary to fulfil or prepare a contract with you (e.g. processing a service request or quote).
• Legitimate interests — where we have a legitimate business reason that is not overridden by your rights (e.g. fraud prevention, network security, improving our website).
• Legal obligation — where processing is required to comply with Ugandan law or regulatory requirements, including NEMA and tax authority obligations.

5. Cookie Policy

Cookies are small text files stored on your device when you visit our website. We use cookies to ensure the site functions correctly, understand how it is used, and — with your consent — to serve relevant advertising.

Categories of cookies we use

• Strictly Necessary: Essential for the website to operate. These include session management, security tokens, and accessibility preferences. They cannot be disabled.
• Analytics: Used to collect anonymous data about how visitors interact with the site (e.g. pages visited, time on site). We use this to improve content and performance. Only activated with your consent.
• Marketing: Used to track visits across websites and deliver advertisements relevant to your interests. Only activated with your consent.

You can manage your cookie preferences at any time using the cookie preferences panel, accessible via the cookie icon in the bottom-right corner of the screen. Withdrawing consent will not affect processing already carried out on the basis of prior consent.

6. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We share personal data only in the following limited circumstances:

Service providers

We engage trusted third-party suppliers who process data on our behalf, including web hosting providers, email delivery services, and analytics platforms. All processors are bound by contractual obligations to handle data securely and only for specified purposes.

Legal requirements

We may disclose personal data to law enforcement, regulatory bodies, or courts when required by law, or when we believe disclosure is necessary to protect the rights, property, or safety of Green Label Services, our clients, or the public.

Business transfers

In the event of a merger, acquisition, or sale of business assets, personal data may be transferred as part of that transaction. We will notify affected individuals as required by law.

Professional advisors

Lawyers, auditors, and insurers acting on our behalf may access personal data where strictly necessary and subject to professional confidentiality obligations.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. The table below summarises our standard retention periods.

When data is no longer required it is securely deleted or anonymised. You may request earlier deletion subject to our legal retention obligations — see Section 9.

8. International Transfers

Green Label Services Uganda Ltd is based in Uganda. Where we use third-party service providers whose servers are located outside Uganda (for example, cloud hosting or analytics platforms based in the European Union or the United States), personal data may be transferred to those jurisdictions.

We take appropriate safeguards for all such transfers, including:

• Ensuring the recipient country or organisation provides an adequate level of data protection.
• Entering into data processing agreements that incorporate standard contractual clauses or equivalent protections.
• Conducting transfer impact assessments where required.

If you would like further information about the safeguards in place for any specific transfer, please contact us.

9. Your Rights

Under the Uganda Data Protection and Privacy Act 2019, you have the following rights in relation to your personal data. You may exercise any of these rights free of charge by contacting our Data Protection Officer (see Section 13).

We will respond to all verified requests within 30 days. In complex cases we may extend this by a further 30 days with notice. We may need to verify your identity before processing a request.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Personal Data Protection Office of Uganda (PDPO), the national supervisory authority.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

Technical measures

• HTTPS / TLS encryption for all data in transit.
• Encrypted storage for sensitive data at rest.
• Access controls: role-based permissions and strong authentication requirements.
• Regular software updates and security patching.
• Automated backups with secure off-site storage.

Organisational measures

• Data protection training for all staff who handle personal data.
• Formal data processing agreements with all third-party processors.
• Incident response procedures to detect, report, and investigate data breaches.
• Regular review of data holdings to identify and securely delete data no longer required.

Despite these measures, no data transmission over the internet can be guaranteed as 100% secure. If you become aware of any security concern relating to our services, please notify us immediately at info@greenlabelservices.co.ug.

11. Children's Privacy

Our website and services are directed at business professionals and are not intended for use by children under the age of 13. We do not knowingly collect personal data from children.

If you believe we have inadvertently collected data about a child under 13, please contact us immediately and we will take prompt steps to delete that information.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. When we make material changes, we will:

• Update the Last Updated date at the top of this page.
• Post a notice on our homepage for a period of 30 days following a significant change.
• Where required by law, notify affected individuals directly by email.

We encourage you to review this policy periodically. Your continued use of our website after changes are posted constitutes acceptance of the updated policy.

Previous versions of this policy are available on request by contacting our Data Protection Officer (see Section 13).

13. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to report a concern, please contact our Data Protection Officer:

We aim to respond to all data-related enquiries within 30 days. For urgent matters, please mark your email subject line with "Data Protection Request".