Privacy Statement

The Data Controller responsible for your Personal Data is:

Where law firms use the Platform to process client data, the law firm acts as the Data Controller and AdvocatesConnect Ltd acts as the Data Processor on its behalf, in accordance with Sections 3 and 4 of the Data Protection and Privacy Act, 2019.

This Statement applies to all Personal Data collected and processed through the Suites platform at www.advocates-connect.com, including all subdomains, mobile interfaces, and associated services. It applies to all Users, visitors, Account Administrators, staff members, lawyers, and clients accessing the Platform from within Uganda and internationally.

We collect and process the following categories of Personal Data:

3.1 Account and Identity Data

• Full name, email address, phone number
• Job title, department, bar enrolment number (for advocates)
• National Identification Number (NIN), Tax Identification Number (TIN) — where required for HR/payroll
• Profile photograph

3.2 Firm and Organisational Data

• Firm name, address, contact details, TIN
• Branding details (logo, colours, tagline)
• Subscription and billing information

3.3 Case and Client Data

• Client names, contact details, identification documents
• Case details, court information, legal documents
• Financial records, invoices, payment histories

3.4 Technical and Usage Data

• IP address, browser type and version, device information
• Operating system, screen resolution, language preference
• Pages visited, features used, time spent, click patterns
• Login timestamps, session duration, referrer URL

3.5 Employment and Payroll Data (HR Module)

• Employee personal details, next of kin, emergency contacts
• Bank account information, mobile money numbers
• NSSF number, salary data, PAYE deductions
• Leave records, performance reviews, disciplinary records

3.6 Communication Data

• Messages sent and received through the Platform
• Email communications with support

In accordance with Section 5 of the Data Protection and Privacy Act, 2019, we process Personal Data on the following lawful bases:

We process Personal Data for the following purposes:

• Providing, maintaining, and improving the Platform and its features
• Creating and managing User accounts and firm accounts
• Processing Subscription payments and generating invoices
• Facilitating case management, client management, and billing operations
• Processing payroll, computing statutory deductions (NSSF, PAYE, LST), and generating payslips
• Enabling communication between Users, between lawyers and clients, and between firms
• Providing customer support and responding to enquiries
• Ensuring Platform security, preventing fraud, and detecting unauthorised access
• Conducting analytics to understand usage patterns and improve services
• Complying with legal and regulatory obligations
• Sending transactional communications (account notifications, payment confirmations, service alerts)
• Sending marketing communications (only with explicit consent, with the ability to opt out at any time)

6.1 Sensitive Personal Data, as defined under Section 5 of the Data Protection and Privacy Regulations, 2021, may be processed through the Platform when Users input case-related information (e.g., health records in personal injury matters, financial data in commercial disputes).

6.2 Processing of Sensitive Personal Data is conducted only where: (a) the data subject has provided explicit consent; (b) it is necessary for legal proceedings; (c) it is required by law; or (d) it is necessary for the establishment, exercise, or defence of legal claims.

6.3 Enhanced security measures are applied to all Sensitive Personal Data, including encryption at rest and in transit, strict access controls, and comprehensive audit logging.

7.1 We do not sell, rent, or trade Personal Data to third parties. We share data only in the following circumstances:

• Service Providers: Trusted third-party providers who assist in operating the Platform (hosting, payment processing, email delivery), bound by contractual data protection obligations under Section 18 of the Data Protection and Privacy Act, 2019.
• Payment Processors: PesaPal and other authorised payment gateways for processing Subscription and invoice payments.
• Legal Compliance: Where required by law, regulation, court order, or request from a competent regulatory authority including the PDPO, NITA-U, Uganda Revenue Authority (URA), or law enforcement agencies.
• Business Transfers: In connection with a merger, acquisition, or sale of all or a portion of the Company's assets, subject to the requirements of the Data Protection and Privacy Act, 2019.
• With User Consent: Where you have provided explicit consent for sharing with identified third parties.

8.1 The Platform is hosted on infrastructure that may involve the transfer of data to servers located outside Uganda.

8.2 Any cross-border transfer of Personal Data is conducted in compliance with Section 19 of the Data Protection and Privacy Regulations, 2021, which requires that:

• The recipient country or organisation provides adequate safeguards for the protection of Personal Data comparable to those under Ugandan law;
• Appropriate contractual clauses are in place with data processors;
• The transfer is necessary for the performance of a contract; or
• The data subject has provided explicit, informed consent to the transfer.

8.3 We maintain a record of all cross-border data transfers as required by the PDPO.

9.1 We retain Personal Data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

9.2 Upon expiry of retention periods, data is securely deleted or irreversibly anonymised in accordance with Regulation 17 of the Data Protection and Privacy Regulations, 2021.

10.1 In accordance with Section 19 of the Data Protection and Privacy Act, 2019 and Part IV of the Regulations, we implement appropriate technical and organisational measures to protect Personal Data, including:

• Encryption: Data encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Multi-Tenant Isolation: Strict data segregation ensuring firm data is accessible only by authorised members of that firm
• Access Controls: Role-based access control (RBAC) with principle of least privilege
• Authentication: Secure authentication via Google SSO, with support for multi-factor authentication
• Audit Logging: Comprehensive logging of all data access and modifications
• Regular Security Assessments: Periodic vulnerability scanning and security reviews
• Staff Training: Regular data protection and security awareness training for all personnel

Under Section 23 of the Data Protection and Privacy Act, 2019, you have the following rights:

• Right to be Informed: The right to know how your Personal Data is being collected, used, and shared.
• Right of Access: The right to request a copy of your Personal Data held by us.
• Right to Rectification: The right to request correction of inaccurate or incomplete data.
• Right to Erasure: The right to request deletion of your data where it is no longer necessary, subject to legal retention obligations.
• Right to Object: The right to object to processing based on legitimate interests or direct marketing.
• Right to Data Portability: The right to receive your data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Complain: The right to lodge a complaint with the Personal Data Protection Office (PDPO) of Uganda.

To exercise any of these rights, contact us at suites.support@advocates-connect.com. We will respond within thirty (30) days as required by Regulation 19 of the Data Protection and Privacy Regulations, 2021.

12.1 The Platform is not intended for use by individuals under the age of eighteen (18) years. We do not knowingly collect Personal Data from children.

12.2 If we become aware that we have collected Personal Data from a child, we will take immediate steps to delete such data in accordance with Section 8(3) of the Data Protection and Privacy Act, 2019.

We use cookies and similar technologies to operate and improve the Platform. For detailed information, please refer to our Cookie Policy.

14.1 The Platform may integrate with third-party services including Google Calendar, Google SSO, PesaPal, and email providers. Each third-party service is governed by its own privacy policy.

14.2 We ensure all third-party data processors are bound by written agreements that comply with Section 18 of the Data Protection and Privacy Act, 2019, requiring them to implement adequate security measures and process data only in accordance with our instructions.

15.1 In the event of a personal data breach that poses a risk to the rights and freedoms of data subjects, we shall:

• Notify the Personal Data Protection Office (PDPO) within seventy-two (72) hours of becoming aware of the breach, in accordance with Section 23(h) of the Act and Regulation 15 of the Regulations;
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights;
• Document the breach, its effects, and remedial actions taken in our internal breach register.

16.1 In accordance with Regulation 7 of the Data Protection and Privacy Regulations, 2021, we conduct Data Protection Impact Assessments (DPIAs) before introducing new processing activities that are likely to result in a high risk to data subjects.

17.1 The Platform does not engage in solely automated decision-making that produces legal effects or similarly significant effects on data subjects. Where tools are used to assist with document generation, case analysis, or other functions, such outputs are always subject to human review and professional judgement by the User.

18.1 We may update this Privacy Statement from time to time. Material changes will be communicated via email and/or prominent notice on the Platform at least thirty (30) days before taking effect.

18.2 The "Last Updated" date at the top of this Statement indicates when it was most recently revised.

For privacy enquiries, data subject access requests, or complaints: