PERSONAL DATA PRIVACY POLICY

1. General Provisions

1.1. This Personal Data Privacy Policy is the official document of the PT.SMMTOUCH.STORE service (hereinafter – the “Service”).

1.2. To use the Service, the User must provide personal data necessary for the provision of services. By providing this data to the Service Administration, the User consents to its collection, processing, storage and transfer to third parties for the purpose of providing the services.

1.3. Any active actions of the User on the Service (including registration or purchase) are deemed an acceptance of this Policy and consent to the processing of personal data. The User confirms that he or she has the legal capacity required to accept these conditions. If the User disagrees with any condition, he or she must refrain from using the Service.

1.4. Should any provision of this Policy be declared invalid or unenforceable, this shall not affect the validity of the remaining provisions.

1.5. The Service Administration reserves the right, at its sole discretion, to amend or supplement this Policy at any time without prior notice. The new version of the Policy takes effect from the moment it is posted on the Service pages. The User must independently monitor any changes; continued use of the Service after amendments have been made constitutes agreement with the new version.

1.6. This Policy has been drawn up in accordance with the legislation of the Republic of Uganda, including the Data Protection and Privacy Act 2019, taking into account the requirements of Regulation (EU) 2016/679 (GDPR) and the UK Data Protection Act 2018.

1.7. This Policy does not apply to residents of the European Union, the United Kingdom and other jurisdictions with strict data‑protection legislation and high penalties for violations. The Service is not intended for users from such regions.

2. Collection of Personal Data

2.1. The Service Administration collects the personal data provided by the User and necessary for the provision of services (for example, an e‑mail address). Such data may be transferred to third parties to organise the delivery of services.

2.2. When the Service is used, technical visit data are collected automatically, including the IP address, information about the device and browser, operating system, time of access, pages visited and the actions performed by the User. Cookies and similar technologies are used for this purpose. Cookies make it possible to personalise the User’s experience, remember preferences, collect usage statistics and display relevant advertising content. The User may disable cookies in the browser settings, but this may decrease the functionality of the Service.

2.3. Third‑party service providers and advertising networks may collect information about Users for advertising purposes through tracking technologies on the Service pages (e.g. cookies or web beacons). In such cases, the Service does not supply any personal data of the User to those third parties except in the situations provided for by this Policy or by law.

2.4. The Service Administration does not verify the accuracy of the personal data provided by the User but reserves the right to do so. The Administration is not liable for the consequences of the User providing incorrect or inaccurate data.

3. Use and Disclosure of Personal Data

3.1. The Service Administration uses the collected personal data for the following purposes:

1. provision and improvement of the Service;
2. management of the User account and provision of customer support;
3. analysis of Service usage;
4. communication with the User (e.g. sending notifications or information by e‑mail);
5. personalisation and display of content and advertising based on the User’s interests;
6. ensuring compliance with the Service Terms of Use and protecting the rights, property and safety of the Service Administration and other Users.

3.2. The Service Administration discloses personal data to third parties only in the following cases:

1. when it is necessary to involve contractors (service providers) to perform functions on behalf of the Service. Such parties receive access only to the information required for their tasks and are not entitled to use it for other purposes;
2. as required by law (for example, pursuant to a court order or a request from law‑enforcement);
3. when the Administration believes disclosure is necessary to investigate or prevent unlawful activity, fraud or other violations, as well as to protect the rights, property or safety of the Service Administration or Users, or to enforce the Service Terms of Use.

4. User Rights

The User has the following rights regarding his or her personal data:

1. Right to obtain information about the processing of personal data;
2. Right of access to personal data;
3. Right to rectify personal data;
4. Right to erase data (“right to be forgotten”);
5. Right to restrict processing of data;
6. Right to object to the processing of personal data (including for direct‑marketing purposes);
7. Right to data portability;
8. Right to withdraw consent to data processing.

5. Protection of Personal Data

5.1. The Service Administration takes reasonable security measures to protect Users’ personal information against unauthorised access or disclosure. However, no system guarantees absolute security; therefore the Administration cannot fully guarantee the safety of personal data.

5.2. The User should also exercise caution when handling personal data and avoid transmitting confidential information via unsecured communication channels.

5.3. The Administration observes generally accepted data‑protection standards and international norms when collecting, processing, storing and transferring Users’ personal data.