Version 2 · Effective 16 September 2026
Effective date: 17 September 2026
Who we are and the law we follow
ShopHex is a marketplace for buyers and sellers in Uganda. Contact support@shopiex.store. We process personal data under Uganda’s Data Protection and Privacy Act, 2019 and Data Protection and Privacy Regulations, 2021, together with other applicable law.
Data we collect
We process account identity and contact details; Apple or Google provider identity details when chosen; profile, storefront and listing content; approximate marketplace location; messages and transaction records; reviews; support and safety reports; payment and promotion records; device, session and push-notification security information; and privacy-conscious usage events. Exact private listing coordinates and private verification evidence are access-restricted. ShopHex does not request background location access.
Apple and Google sign-in
When you select Continue with Apple or Continue with Google, the provider returns a verified account identifier and may return your email, name and profile image. ShopHex uses this information to sign you in, create an account when none exists, reconcile an existing account with the same verified email, prevent duplicate identities and protect access. Selecting the provider button is the affirmative consent action described by the linked Terms and Privacy notice on both authentication screens. Optional marketing consent remains separate.
Lawful, fair and limited use
We process data to provide an account and perform the requested marketplace service, record consent, support legitimate safety and operational interests, comply with legal duties, and use consent where required. We aim to keep collection adequate, relevant and limited. Uses include discovery, listings, messaging, blocking, orders, seller tools, payments, promotions, fraud prevention, moderation, support, service analytics and security.
Sharing and international providers
Data is shared only as needed with contracted providers supporting hosting, email, Apple or Google sign-in, SMS, notifications, mapping links, media processing and payments, or with competent authorities where lawfully required. Some providers may process data outside Uganda; ShopHex uses appropriate safeguards. ShopHex does not sell personal data.
Retention
Account, profile, authentication, preference and active public content data is kept while the account is active and then deleted or irreversibly de-identified through the in-app deletion flow. Shorter security, verification or media-expiry periods may apply. Minimum order, payment, withdrawal, promotion, fraud, dispute, moderation, audit or safety records may be retained for the period reasonably necessary to meet legal obligations, resolve claims, protect members and reconcile finances. Retained records are restricted and no longer represent an active public account.
Permanent account deletion
Signed-in members can open Profile and Account, choose Delete account, review the consequences and type the displayed confirmation phrase. Completion immediately revokes all sessions and Apple, Google and password sign-in methods; removes the public profile, active listings, uploads, preferences and provider identifiers; and removes or de-identifies associated member content where technically and legally appropriate. The process cannot be undone. If the app is unavailable, the public Account and Data Deletion page accepts a verified web request.
Your rights and choices
Subject to applicable law, members may ask for access, correction, updating, restriction, objection, portability where applicable, or deletion. Members can update profile details, notification preferences, blocked members and signed-in sessions. A person may contact the privacy address published in the Legal and Safety Centre or complain to the competent Ugandan data-protection authority.
Security, incidents and policy changes
ShopHex uses access controls, password hashing, short-lived provider challenges, secure transport, audit records and restricted evidence access. Material policy changes are versioned with a new effective date and communicated appropriately. Continued use after a notified effective date is governed by the updated version where lawful.