Privacy Policy

Guza is operated by Nam Inc. (“Guza”, “we”, “us” or “our”). Nam Inc. determines how personal data is used to operate Guza. A merchant independently controls how it uses buyer information for its own sale, delivery, customer service and legal duties.

Merchant and team data: name, email, phone or WhatsApp number, credentials and security settings, @handle, business profile, logo and cover media, location, social links, offerings, team roles, support messages and profile-completion data.

Trust and billing data: identity and business-verification details, NIN or document information where submitted, business licences, verification status, subscription plan, payment references, invoices, payout or settlement details, and related audit records.

Buyer and order data: name, phone number, delivery address or landmark, optional delivery coordinates, order items and customisation answers, uploaded custom-order files, delivery quote, payment method and status, order history, delivery PIN events, confirmations, reviews, reports and support messages.

Usage and device data: IP address, browser and device information, session and push-subscription identifiers, referral or campaign attribution, searches, page and offering interactions, order events, diagnostic logs, performance data and error reports. Carts, favourites and install preferences may be stored on your device.

Printa data: artwork, product choices, placement settings, preview files, production instructions and job status.

We receive data directly from you, from merchants or team members acting for a business, from your device when you use Guza, from payment, messaging, delivery, identity-verification and analytics providers, and from public or official sources used to verify a business. If you provide another person's data, you must have authority to do so.

• to create and secure accounts, merchant @ identities and team access;
• to publish storefronts, offerings, pages and Printa previews;
• to capture orders, calculate delivery, create receipts and PINs, and connect buyers with merchants;
• to process subscriptions or supported payments and maintain financial records;
• to send service, order, billing, security and optional channel notifications;
• to verify identity, licences and ownership and prevent fraud, abuse and prohibited trade;
• to provide analytics, support, reliability monitoring and product improvement; and
• to comply with law, enforce our terms and protect users or the platform.

Depending on the activity, we rely on your consent, performance of a contract or steps you request before a contract, compliance with legal obligations, and legitimate interests such as platform security, fraud prevention and service improvement. Where consent is the basis, you may withdraw it without affecting earlier lawful processing.

Merchant @handles, display names, logos, cover media, business descriptions, locations, trust signals, offerings, prices and other published profile content are public and may appear in search or sharing previews. The merchant fulfilling an order receives the buyer and order information needed to confirm, deliver, support and account for that transaction. Do not put sensitive personal data in a public description or upload unless it is necessary.

We use vetted providers for cloud hosting, databases, file and image storage, email, push and messaging, payment processing, delivery routing, identity verification, analytics, error monitoring and customer support. They receive only data needed for their role and process it under their terms or our instructions. WhatsApp, Telegram or another channel applies its own privacy terms once you choose to open it.

We may also disclose data to professional advisers, a successor in a corporate transaction, regulators, law enforcement or courts where required or permitted by law, or when reasonably necessary to protect rights, safety and platform integrity. We do not sell personal data or provide it to third parties for their own behavioural advertising.

Some providers may store or process data outside Uganda. Where this occurs, we take reasonable steps to use providers and safeguards that protect the data consistently with applicable Ugandan requirements.

We keep personal data only for as long as needed for the purpose collected, including providing the Service, maintaining order and financial records, resolving disputes, preventing fraud and meeting legal obligations. Retention varies by record type and account status. When data is no longer required, we delete, de-identify or securely isolate it, subject to lawful backup and record-keeping periods.

Buyer request posts, private offers and reference images are removed after the request's 14-day window. If a buyer accepted an offer, the resulting private conversation may retain a minimal transaction event and its separately governed conversation history so the parties can continue the agreed purchase and Guza can handle safety or dispute obligations.

Contact details supplied with a commerce-safety report are removed after the case is closed and the 180-day follow-up period expires. The case decision and non-contact audit record may be retained longer for repeat-abuse prevention, legal compliance and platform integrity.

Business licences, product authorisations and compliance responses are kept in private storage and accessed by authorised reviewers through short-lived links. Relevant case evidence may be preserved for longer when a documented legal hold, dispute, investigation or lawful authority request requires it.

We use access controls, tenant separation, encrypted network connections, protected session cookies, password hashing, rate limits, audit events, private verification-document storage and operational monitoring. Access to sensitive merchant, order and trust data is restricted by role. No online system is risk-free; contact us promptly if you suspect misuse or a security incident.

Subject to Ugandan law, you may ask whether we hold your personal data and request access, correction, an electronic copy, deletion, restriction or objection where applicable. You may withdraw consent and challenge an automated decision if one materially affects you. We may need to verify your identity and may retain data where the law or an unresolved transaction requires it.

Send a request to hello@guza.ug. If you believe a privacy concern remains unresolved, you may file a complaint with Uganda's Personal Data Protection Office.

Guza uses necessary cookies for merchant, guardian and buyer-device sessions; local device storage for carts, favourites, attribution and install preferences; and service analytics and error monitoring to understand usage and reliability. We do not use these technologies for third-party behavioural advertising. Blocking necessary storage can prevent sign-in, cart, order-history or security features from working.

Search-demand insights use normalized daily aggregate counts. Those aggregate rows do not contain a buyer identity, IP address, cookie, account or session identifier; contact-like and unusually identifying queries are discarded, and rare terms are suppressed before they appear in an insight dashboard. Search-demand aggregates are retained for up to 180 days.

Guza is not directed at children who cannot lawfully consent or enter the relevant transaction. A parent or guardian should supervise use where required. We do not knowingly request children's identity-verification documents for merchant accounts.

We may update this notice as Guza, our providers or the law changes. We will post the effective date and give reasonable notice of material changes where appropriate.

Privacy questions, requests or complaints: hello@guza.ug.