Your privacy and data protection are our top priorities
Coop Profiler is a digital platform provided by The Uhuru Institute for Social Development Ltd.. This Privacy Policy applies to the Coop Profiler public website, hosted application, mobile components, support interactions and related services where TUI determines how Personal Data is handled or processes Personal Data on behalf of a customer.
This Policy should be read together with the Coop Profiler Terms of Use and any applicable Service Level Agreement or Data Processing Schedule. A customer organisation may also provide its own privacy notice for data it collects through Coop Profiler.
TUI acts as a Data Controller when it determines the purpose and manner of processing for account registration, user authentication, billing, payment records, fraud prevention, platform security, service telemetry, support administration, legal compliance, website analytics and TUI’s institutional records.
When a cooperative, STA, Partner or other customer uses Coop Profiler to collect and manage Personal Data about members, respondents, employees, delegates or other persons for the customer’s own purposes, that customer generally acts as Data Controller and TUI generally acts as Data Processor. TUI processes that customer-controlled data under the customer’s authorised instructions and the applicable agreement.
Customers are responsible for deciding what data to collect, why it is needed, who may access it, how long it should be kept and which lawful basis supports the processing. Coop Profiler provides the technical platform but does not automatically make a customer’s collection lawful.
Account and identity data, such as names, usernames, email addresses, telephone numbers, organisation details, roles and profile images.
Authentication and security data, such as password hashes, login records, device or session information, security events and access logs.
Billing and transaction data, such as plan, invoice, payment reference, payment status, currency, payment method and evidence of manual payment.
Support and communication data, such as messages, tickets, call notes, email correspondence and troubleshooting information.
Usage and technical data, such as pages viewed, features used, timestamps, browser or device information, IP-derived information and diagnostic telemetry where enabled.
Customer-controlled profiling data, such as demographic information, identification details, membership and shareholding records, financial information, organisational information, questionnaire responses, uploaded documents, images, location data and other fields configured by the customer.
Partner-access records, such as access requests, permissions, approvals, revocations and audit events.
Other information voluntarily provided through forms, imports, integrations or authorised professional services.
Depending on customer configuration, customer-controlled data may include special or sensitive personal information. Customers should collect such information only where necessary and lawful and should apply enhanced safeguards appropriate to the risk.
Directly from you when you register, communicate with us, make a payment or use the Service.
From the customer organisation that creates your account or records information about you.
From respondents or members who complete a customer-created questionnaire or profiling workflow.
From authorised imports or integrations configured by a customer.
From payment, hosting, analytics, security and support providers where necessary to operate the Service.
From public or regulatory sources where collection is lawful and relevant to TUI’s compliance obligations.
Create and administer accounts and organisational profiles.
Provide profiling, questionnaires, analytics, reporting, CRMI, document management and other subscribed features.
Manage subscriptions, invoices, payments, storage, Add-ons, loyalty benefits and revenue-share records.
Authenticate users, manage permissions, prevent abuse and protect platform security.
Provide support, onboarding, maintenance and service communications.
Operate backups, disaster recovery, logging, monitoring and incident response.
Improve functionality, reliability, usability and performance.
Create aggregated or de-identified research, benchmarking and statistical insights.
Comply with legal, regulatory, audit, accounting and dispute-resolution obligations.
Send service-related communications and, where permitted, optional marketing or product communications.
TUI processes Personal Data only where there is an applicable lawful ground under Ugandan law or another mandatory law that applies to the processing. Depending on context, the basis may include consent, performance of a contract, compliance with a legal obligation, protection of legitimate interests recognised by law or another statutory ground.
Where a customer controls profiling data, the customer is responsible for identifying the lawful basis, giving required privacy information, obtaining consent where consent is required and ensuring collection is adequate, relevant and not excessive for the intended purpose.
Customer-controlled profiling data remains under the customer’s ownership and control. TUI does not sell customer-controlled Personal Data.
TUI may access customer-controlled data only as necessary to operate the Service, follow authorised instructions, troubleshoot with appropriate authority, investigate a security incident, comply with law or perform another activity allowed by the applicable agreement.
A customer may configure questionnaires, permissions and document types that cause additional Personal Data to be collected. TUI therefore cannot list every possible customer-defined data field in this Policy. Customers should maintain their own records of processing and privacy notices appropriate to their use case.
Coop Profiler may allow Partners to request or receive access to cooperative data. Access should be granted only by an authorised cooperative or through another valid legal arrangement. Permissions can be limited and revoked.
A Partner that receives Personal Data becomes responsible for handling that data lawfully under its own role and obligations. TUI records and enforces platform permissions but does not replace the legal responsibilities of the organisations sharing data.
TUI uses service providers and subprocessors for functions such as cloud hosting, data storage, backups, email delivery, payments, analytics, monitoring, security and technical support. We require appropriate confidentiality, security and data-protection commitments based on the nature of the service.
A current subprocessor register or relevant information will be made available through Coop Profiler, on request or through another published TUI channel. TUI may replace a provider where reasonably necessary for security, performance, cost, compliance or service continuity.
Some service providers may process or store Personal Data outside Uganda. Where TUI processes or stores Personal Data outside Uganda, we apply section 19 of the Data Protection and Privacy Act and the applicable Regulations, including assessment of adequate protection, consent or another lawful safeguard where required.
Customers should inform TUI where their own legal, contractual or sector requirements impose additional data-location restrictions.
TUI may create aggregated or de-identified information from Service data for research, benchmarking, product improvement, CRMI analysis, sector intelligence, statistical reporting and service planning. We do not publish or use this information in a form reasonably capable of identifying an individual or customer organisation unless separately authorised or legally permitted.
Where information can reasonably be re-identified, it remains protected as Personal Data and is not treated as anonymous merely because direct identifiers were removed.
We retain Personal Data only for as long as reasonably necessary for the purpose for which it was collected, the applicable customer instructions, legal obligations, accounting, dispute resolution, security or another lawful purpose.
When a paid subscription ends, the account may pass through a Grace Period, read-only period and suspension before controlled deletion. Storage entitlement expiry does not automatically destroy files immediately.
When the applicable retention period expires, active records will be deleted, destroyed or de-identified in a manner designed to prevent reconstruction where required by law. Protected backups may retain data until the backup set expires under the normal retention schedule. Backups are not normally modified record-by-record unless technically required and feasible.
Certain billing, audit, security or legal records may be retained longer where required by law or reasonably necessary to establish, exercise or defend legal rights.
We use technical and organisational controls designed to protect the confidentiality, integrity and availability of Personal Data. Controls are selected according to risk and may include:
HTTPS/TLS for production web traffic.
Password hashing and secure credential management.
Role-based access controls and least-privilege administration.
Multi-factor authentication for privileged administrative access.
Security logging, monitoring and incident escalation.
Secure development, dependency management and vulnerability remediation.
Controlled file-upload validation, malware or threat scanning and protected storage for sensitive uploads.
Backup monitoring and restoration testing.
Access review and prompt revocation of unnecessary privileged access.
Subprocessor due diligence and confidentiality obligations.
No system can be guaranteed completely secure. Users must also protect credentials, devices and local networks and must notify us promptly of suspected compromise.
TUI maintains automated production database backups at least twice daily, seven days a week, with secure off-server storage. Customer-uploaded files are protected through backup, replication, versioning or an equivalent recovery control. TUI performs documented restoration testing at least quarterly.
Backup frequency and recovery design may evolve as technology changes, but we will not materially reduce the protection of Personal Data without appropriate risk assessment and compensating controls.
If TUI believes Personal Data has been accessed or acquired by an unauthorised person, we will activate our incident-response process and comply with applicable notification duties. Section 23 of Uganda’s Data Protection and Privacy Act requires immediate notification to the competent authority in the prescribed manner where the statutory threshold is met.
Where the incident affects customer-controlled Personal Data, TUI will notify the affected customer without undue delay after becoming aware of a confirmed breach and will provide reasonably available information to support investigation, containment, regulatory notification and communication with affected persons where required.
Subject to applicable law, a data subject may have rights including access to Personal Data, rectification, blocking, erasure or destruction, prevention of processing for direct marketing, rights relating to automated decision-taking, the right to be informed and the right to complain about non-compliance.
Where TUI is the Data Controller, you may submit a request through the privacy contact in this Policy. Where the relevant data is controlled by a cooperative, Partner or other customer, we may direct the request to that Data Controller and provide reasonable processor assistance.
We may need to verify identity and authority before responding. Some rights are subject to legal exceptions, retention requirements and the rights of other persons.
Coop Profiler is not designed as a consumer service directed to children. A customer that collects Personal Data relating to a minor or another protected person must ensure that the collection is lawful, necessary and supported by guardian consent or other authority where required.
Our websites and applications may use cookies, local storage, session technologies and analytics tools to authenticate users, preserve preferences, measure usage, improve performance and protect security. Analytics services such as Google Analytics may be used where enabled.
Where required by applicable law, optional analytics or marketing cookies will be subject to appropriate notice or consent. Essential authentication and security technologies may be necessary for the Service to function.
Coop Profiler may calculate scores, classifications, analytics or other outputs from data supplied by users. These outputs support decision-making but should not be treated as infallible or as a substitute for appropriate human review.
If TUI introduces AI-assisted features or automated processing that materially affects individuals, we will provide appropriate information and controls required by applicable law. Customers remain responsible for lawful use of automated features in their own decision processes.
We may disclose Personal Data where required by law, court order, regulator or lawful governmental request or where reasonably necessary to protect rights, security, users or the integrity of the Service. Where legally permitted, we will limit disclosure to what is necessary and may notify the affected customer or individual.
We may update this Privacy Policy to reflect legal, security, product or processing changes. Material changes will be communicated through the website, application, email or another appropriate channel. The version and effective date will be maintained so users can identify the applicable policy.
TUI’s formal privacy contact for Coop Profiler is [email protected].
Privacy contact: [email protected].
Postal / office contact: The Uhuru Institute for Social Development Ltd., Bwindi Trust House, Plot 1 Katalima Crescent, Naguru, P.O. Box 130337 Kampala, Uganda.
General institutional contact: [email protected].
If you believe your privacy rights have been infringed, please contact the relevant Data Controller or TUI using the details above so the matter can be investigated. You also have the right to lodge a complaint with the Personal Data Protection Office in Uganda.
Personal Data Protection Office, Padre Pio House, Plot 32 Lumumba Avenue, Kampala, Uganda. Official contact details should be obtained from the PDPO website because regulatory contact information may change.
