ECADEL GROUP LIMITED (“ECADEL GROUP”, “we”, “us”, or “our”) is committed to protecting the privacy and security of personal data entrusted to us in the course of our operations. This Privacy Policy explains how we collect, process, store, share, and protect personal information across our platforms, including SafeRoad and Meridian, as well as our corporate website and any associated services.

This Policy is issued in compliance with the Uganda Data Protection and Privacy Act, 2019 (PDPA) and applicable international data protection standards. By accessing or using our services, you acknowledge that you have read and understood this Policy.

The data controller responsible for your personal information is:

For enterprise deployments, ECADEL GROUP LIMITED may act as a data processor on behalf of a government agency, enterprise, or institutional partner who is the data controller. In such cases, data processing is governed by a separate Data Processing Agreement.

We process personal data only where we have a lawful basis to do so. The following table sets out our primary processing activities and their legal basis under the Uganda PDPA and applicable standards:

We do not sell personal data. We share personal data only in the following circumstances, and only to the minimum extent necessary:

We retain personal data for no longer than is necessary for the purposes for which it was collected, taking into account legal, regulatory, operational, and reporting requirements.

ECADEL GROUP LIMITED implements appropriate technical and organisational measures to protect personal data against unauthorized access, accidental loss, destruction, or damage. Our security programme includes:

• Encryption of data in transit using TLS 1.2 or higher across all API and web endpoints
• Encryption of sensitive data fields at rest using AES-256
• Role-based access controls with the principle of least privilege enforced throughout
• Multi-factor authentication required for all administrative and platform access
• Regular penetration testing and vulnerability assessments by qualified security practitioners
• Dedicated incident response procedures with defined notification timelines
• Data minimisation and pseudonymisation practices where technically feasible
• Vendor security assessments for all data sub-processors

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, and affected individuals without undue delay.

Subject to applicable law and certain limited exceptions, you have the following rights in relation to your personal data under the Uganda Data Protection and Privacy Act, 2019:

• Right of access — to receive a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of your data where no overriding legal basis exists
• Right to restriction of processing — to request that we limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is based on consent, to withdraw it at any time without affecting prior processing
• Right to lodge a complaint — with the Personal Data Protection Office of Uganda or your applicable supervisory authority

To exercise any of these rights, contact us at privacy@ecadelgroup.com. We will respond within 30 days. We may require verification of your identity before fulfilling a request.

Where personal data is transferred outside Uganda, we ensure appropriate safeguards are in place, including contractual clauses approved by the relevant data protection authority, or transfers to jurisdictions deemed to provide an adequate level of protection. We do not transfer personal data to jurisdictions that do not provide adequate protections without explicit data subject consent or a compelling legal basis.

Our platforms and services are directed at businesses, institutions, and adult individuals. We do not knowingly collect or process personal data from children under the age of 18 without verifiable parental or guardian consent. If you believe we have inadvertently collected data relating to a child, please contact us immediately at privacy@ecadelgroup.com.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will provide notice via email to registered account holders, in-platform notification, or a prominent notice on our website, at least 14 days prior to the change taking effect. Continued use of our services after that date constitutes acceptance of the revised Policy.

For all privacy-related queries, requests, or concerns, contact our Privacy Officer: