Privacy Policy
Effective 7 September 2026
In short
We are a printing, design and ICT business in Hoima. We collect only what we need to quote for your work, produce it and contact you about it.
Files you upload for printing are permanently deleted after 14 days and cannot be recovered. We never sell your data. Some of the services we rely on to run this website store data outside Uganda — section 4 names every one of them.
1.Who is responsible for your data
Nexhub Digital is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are accountable for it under the Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021 of the Republic of Uganda.
- Trading name: Nexhub Digital
- Place of business: Wright Road, Opposite Kwebiha Road, Hoima, Uganda
- Data protection contact: support@nexhubdigital.net
This policy covers nexhubdigital.net and the services we provide from our premises. It does not cover other websites we link to.
2.What we collect
We ask for information at the point you choose to contact us, request a quote, or send us a file to print. Nothing on this website requires you to create an account.
Information you give us
- Who you are: your name, and your company name if you are ordering for a business.
- How to reach you: phone number (including MTN and Airtel numbers) and email address.
- Where you are: district, town or delivery address, where you give it for delivery or invoicing.
- What you need: the specifications of your job — size, paper, quantity, deadline, budget range and any notes you add.
- Your files: artwork, documents, certificates and designs you upload for printing.
- Business details: for invoicing clients, a Tax Identification Number (TIN) and billing address.
Information we collect automatically
- Technical data: your IP address, browser type and the pages you visit, recorded in server logs and used to keep the site available and to block abuse of our forms.
- Analytics data: collected only if you agree — see section 13.
We do not collect payment card details. We are not paid through this website; payment is arranged separately by Mobile Money or in cash at our office.
3.Why we use it, and our lawful basis
Section 7 of the Data Protection and Privacy Act, 2019 requires us to have a lawful basis for every use of your personal data. This is ours, purpose by purpose.
| What we do | Data used | Lawful basis |
|---|---|---|
| Prepare a quotation and produce your order | Name, contact details, job specifications, uploaded files | Necessary to perform our contract with you, or to take steps at your request before entering one |
| Contact you about your job and send confirmations | Name, email, phone number | Necessary to perform our contract with you |
| Issue quotations, invoices and receipts | Name, company, TIN, billing address, amounts | Compliance with our legal obligations under Ugandan tax law |
| Keep the website available and stop spam and fraud | IP address, request patterns, bot-protection signals | Compliance with our obligation to secure personal data under section 20 of the Act |
| Measure how the website is used | Truncated IP, pages viewed, device type | Your consent, which you may withdraw at any time |
| Send you offers and promotional messages | Name, email, phone number | Your consent, which you may withdraw at any time |
We do not make decisions about you by automated means, and we do not profile you.
4.Where your data is processed
Your data is stored outside Uganda
We run this website on international cloud infrastructure. That means personal data you give us is stored and processed on servers located outside Uganda, principally in the United States and the European Union.
Section 19 of the Data Protection and Privacy Act, 2019 allows this where the receiving country provides adequate protection, or where you consent to the transfer. By submitting a form on this website you consent to your data being transferred and stored as described below.
These are every service that handles your personal data on our behalf, what each one does, and where it sits. We keep this list current as our infrastructure changes.
| Service | What it does for us | Data involved | Location |
|---|---|---|---|
| Supabase | Database, authentication and encrypted file storage | Names, contact details, order details, uploaded artwork | United States / European Union |
| Vercel | Website hosting and content delivery | IP addresses and request logs | United States (global edge network) |
| Resend | Sending transactional email — confirmations and replies | Name, email address, message content | United States |
| Upstash | Rate limiting to prevent spam and abuse of our forms | Hashed IP address, request counts | United States / European Union |
| Cloudflare | Turnstile bot protection on forms | IP address, browser signals | Global network |
| Google Analytics | Website usage statistics — only with your consent | Truncated IP, pages viewed, device type | United States |
Each of these providers is bound by its own contractual data protection terms, processes data only on our instructions, and is not permitted to use your data for its own purposes. If you would rather not have your data transferred abroad, contact us by phone or visit our office in Hoima and we will handle your job without using this website.
6.How long we keep it
Print files are deleted after 14 days
Every document, artwork file and certificate submitted through our online print ordering portal is held in encrypted storage while we produce your job, and is then permanently and irreversibly deleted from our servers after 14 days. This runs automatically every day. Once a file is purged it cannot be recovered by us or by anyone else, under any circumstances.
Please keep your own copy of anything you send us. We cannot reprint from a deleted file.
Everything else is kept only as long as we have a reason to hold it:
| Record | Kept for | Why |
|---|---|---|
| Uploaded print files | 14 days | Long enough to produce and reprint if there is a fault |
| Order and enquiry records | Up to 2 years after your last contact | To answer questions about past work and handle disputes |
| Quotations, invoices and receipts | 5 years | Required by Ugandan tax law |
| Marketing consent records | Until you withdraw consent, then 1 year | To prove we had your permission |
| Website server logs | Up to 90 days | Security monitoring and abuse prevention |
When a retention period ends we delete the record or anonymise it so it can no longer be linked to you.
7.How we protect it
Section 20 of the Data Protection and Privacy Act, 2019 requires us to secure personal data against loss, damage and unauthorised access. In practice we:
- Serve the entire website over encrypted HTTPS connections.
- Store uploaded files in a private, access-controlled bucket — never in a publicly readable location.
- Enforce database-level access rules so a record can only be read by someone entitled to read it.
- Rate-limit and bot-check every public form to prevent bulk harvesting.
- Validate and sanitise everything submitted before it is stored or emailed.
No system is perfectly secure, and we cannot guarantee the security of data while it travels across the internet to us. We keep our safeguards under review and improve them as risks change.
8.If something goes wrong
Section 23 of the Data Protection and Privacy Act, 2019 requires us to notify the Personal Data Protection Office (PDPO) where personal data in our custody is accessed or acquired by an unauthorised person, and to notify you where the breach affects you.
Our procedure is to:
- Contain the incident and assess what data was involved.
- Notify the Personal Data Protection Office (PDPO) within 72 hours of becoming aware of a reportable breach.
- Contact affected individuals directly, without undue delay, explaining what happened and what to do about it.
- Record the incident and what we changed to prevent a recurrence.
9.Your rights
Under the Data Protection and Privacy Act, 2019 you have the following rights over the personal data we hold about you:
- To be informed of how your data is collected and used — this policy.
- To access the personal data we hold about you, and to be told why we hold it and who we have shared it with.
- To rectification — to have inaccurate or incomplete data corrected.
- To erasure — to ask us to delete data we no longer have a lawful reason to keep.
- To object to processing, including processing for direct marketing, which we will always stop on request.
- To withdraw consent at any time, where consent is our basis. Withdrawing does not affect anything we did lawfully beforehand.
- To prevent processing likely to cause you unwarranted damage or distress.
How to exercise them
Email support@nexhubdigital.net or write to us at Wright Road, Opposite Kwebiha Road, Hoima, Uganda. Tell us which right you want to exercise and enough detail for us to find your records.
We will respond within 30 days, free of charge. If your request is unusually complex we will tell you within that period and explain how much longer we need. We may ask you to confirm your identity before releasing personal data, so that we do not disclose it to the wrong person.
One limit worth knowing: once a print file has passed its 14-day deletion, we cannot produce a copy of it for an access request, because we no longer hold it.
10.Complaints to the regulator
If you are unhappy with how we have handled your personal data, please tell us first — we would rather put it right. But you do not have to come to us, and you can complain to the regulator at any time.
The supervisory authority in Uganda is the Personal Data Protection Office (PDPO), established under the Data Protection and Privacy Act, 2019 and hosted by the National Information Technology Authority – Uganda (NITA-U). You can lodge a complaint with them at www.pdpo.go.ug.
11.Marketing messages
We will only send you promotional messages — by email, SMS or WhatsApp — if you have asked us to. Agreeing to our terms in order to place an order is not consent to marketing; the two are kept separate.
Every marketing email carries an unsubscribe link. You can also reply "STOP" to a marketing SMS, or email support@nexhubdigital.net at any time. We act on withdrawals promptly.
Messages about a job you have actually placed — a quotation, a confirmation, or a notice that your order is ready — are not marketing, and you will continue to receive those while your order is live.
12.Children and young people
Section 9 of the Data Protection and Privacy Act, 2019 gives special protection to the personal data of children. This website is intended for adults and for people acting for a business.
We do not knowingly collect personal data from anyone under 18 through this website. If you are under 18, please ask a parent, guardian or teacher to place the order for you, or come to our office in Hoima in person.
Where we produce work for a school — student cards, certificates, yearbooks — we handle any pupil information strictly on the school's instructions, use it only for that job, and delete it on the same 14-day schedule. If you believe we hold a child's data without proper authority, contact us and we will delete it.
14.Changes to this policy
We may update this policy as our services or the law change. The effective date at the top of this page always tells you which version is current.
If we make a change that materially affects how we use your personal data, we will make it prominent on the website and, where the change requires it, ask for your consent again before relying on it.
15.Contact us
For anything in this policy — a question, a request about your data, or a complaint — reach us at:
- Email: support@nexhubdigital.net
- Phone: +256 786 743 096 / +256 771 978 986
- Address: Wright Road, Opposite Kwebiha Road, Hoima, Uganda
- Online: our contact form