Data Privacy & Trust

Privacy Policy

Last updated: October 7, 2026 · Compliant with the Data Protection and Privacy Act, 2019 (Uganda)

At WedPool, we take the confidentiality of your celebration and your contributors' personal information with utmost seriousness. This Privacy Policy details how we collect, protect, encrypt, and handle personal data in accordance with the Data Protection and Privacy Act, 2019 of Uganda.

1. Information We Collect

We adhere to strict principles of data minimization:

  • Account Holders (Couples & Treasurers): Full name, verified email address, encrypted mobile phone number, and secure password hash.
  • Contributors: Name, optional relationship category (Family, Workmates, In-Laws, Friends), pledge amount, and telephone number provided by the committee for the sole purpose of transmitting payment receipts.
  • Financial Records: Recorded contribution amounts, transaction timestamps, payment methods (Cash, MTN MoMo, Airtel Money, Bank Deposit), and optional receipt image attachments.
  • Information We NEVER Collect: We never collect, process, or store credit card numbers, debit card CVVs, or mobile money wallet PINs.

2. Cryptographic Security & Encryption Standards

Unlike traditional spreadsheet trackers, WedPool implements banking-grade safeguards:

  • AES-256-GCM Authenticated Encryption: All phone numbers stored in our database are encrypted at rest with an isolated server application key.
  • HMAC-SHA256 Blind Indexing: We maintain a cryptographic hash of phone numbers using a private pepper, allowing the system to match returning contributors without exposing raw numbers in database tables.
  • Public Masking: When a committee generates a transparency share link, donor telephone numbers are automatically redacted (e.g. +256 701 *** 890) so third parties cannot scrape contact details.

3. Purpose of Processing & Legal Basis

We process personal information under the legitimate interest of organizing matrimonial celebrations and with contributor consent. Specific uses include:

  • Generating accurate financial statements and budget reconciliations for wedding committees;
  • Dispatching automated, transactional thank-you SMS receipts upon payment logging;
  • Preventing duplicate payments and fraud through deduplication keys;
  • Providing account security notifications and password reset tokens.

4. Third-Party Telecom Gateways

To deliver SMS receipts within Uganda, message payloads are securely transmitted via encrypted API connections to licensed Ugandan telecom aggregators (Pahappa / EgoSMS). These partners process data strictly for transmission to MTN Uganda, Airtel Uganda, and partner mobile operators, and are bound by telecom confidentiality regulations.

5. Quiet Hours & Communication Safeguards

To respect contributor rest, WedPool enforces default quiet hours from 21:00 (9:00 PM) to 07:00 (7:00 AM) East Africa Time. Any message triggered within this window is held securely in an encrypted queue and dispatched automatically when morning hours commence.

6. Your Rights Under Ugandan Law

Under the Data Protection and Privacy Act, 2019, users and contributors hold the following statutory rights:

  • Right to Access: You may request a complete export of your personal contribution records.
  • Right to Rectification: You may correct inaccurate or outdated information recorded by your committee.
  • Right to Erasure (“Right to be Forgotten”): Campaign owners may request permanent deletion of their account and all associated donor records upon celebration completion.
  • Right to Opt-Out of SMS: Contributors may opt out of SMS receipts at any time by contacting our support team or asking their committee treasurer.

7. Contact the Data Protection Officer

For data privacy inquiries, access requests, or deletion notices, please contact our Data Protection Officer:

WedPool Data Privacy Desk
Plot 14 Lumumba Avenue, Nakasero, Kampala, Uganda
Email: privacy@wedpool.cloudcommet.com