Privacy Policy

This policy explains how Zoril Systems, based in Arua, Uganda, handles personal information in connection with its website, product enquiries, support and the four apps listed below. It applies to account holders, organisation staff, customers, members, message recipients, students and guardians whose information is processed through these services.

For enquiries, account administration and our own service operations, Zoril determines why and how information is used. When a business, financial group or school enters records into an app, that organisation generally determines the purpose of those records and Zoril processes them on its behalf. Your organisation’s privacy notice and service agreement may also apply.

• Account and organisation details: names, business or school details, email addresses, phone numbers, user roles and account authentication information.
• Enquiries and support: the product you select, organisation type and size, location, requirements, preferred contact method, budget or timeframe where supplied, and correspondence or attachments you send.
• App records: information entered by you or your organisation, as described in the app-specific section.
• Technical and service records: IP address, browser or device information, request timestamps, usage and error logs where generated to operate, secure and troubleshoot the service.
• Billing records: subscription, invoice and payment references where applicable. A payment provider’s own policy applies to information submitted directly to that provider.

Only provide information needed for the relevant task. Do not include passwords, full payment-card details or unnecessary sensitive information in an enquiry or support message.

The information processed depends on the features enabled and the records your organisation chooses to enter; this list does not mean every app collects every category.

Information is used to provide the requested service, manage accounts and access, process transactions and records, generate reports, deliver messages, respond to enquiries, provide support and administer subscriptions.

It may also be used to investigate errors, prevent abuse or unauthorised access, maintain service reliability, resolve disputes and meet legal obligations. Access and use should be limited to what is necessary for these purposes.

Depending on the activity and applicable law, processing may be necessary to provide a contracted service, comply with a legal obligation, pursue a legitimate operational or security interest, or act on your consent. Where consent is required, you may withdraw it; withdrawal does not affect processing that was lawful before withdrawal.

Organisations using our apps are responsible for establishing an appropriate legal basis for the customer, member, recipient and student information they upload. Applicable requirements include Uganda’s Data Protection and Privacy Act, 2019 and related regulations, and other privacy laws where they apply.

Information may be accessible to authorised people within your organisation, Zoril personnel who need it for their work, and service providers supporting hosting, storage, email delivery, messaging, payments or technical support, as relevant to the service.

Website product enquiries are emailed to contact@zoril.app using Resend for email delivery. Your submitted email address is used as the reply-to address. Enquiry content is therefore also handled by the email delivery service and the receiving mailbox provider.

Information may also be disclosed where required by law or a valid legal request, to protect rights and safety, or in connection with a business transfer subject to applicable privacy protections. Ask us for information about providers relevant to your app or organisation before submitting information subject to special restrictions.

Apps may use cookies or browser storage for sign-in, session security, preferences and app functionality. The storage used can differ by app. You can manage cookies and site storage through your browser, although blocking or clearing essential storage may sign you out or prevent features from working.

Optional analytics or advertising technologies, if introduced, must be explained in an appropriate notice and use consent where required. This policy does not grant consent to optional tracking.

If a feature requests access to files, a camera, contacts or another device capability, the request should identify its purpose. Permissions can be managed in your device or browser settings. Only grant access where needed for a feature you choose to use.

Appropriate technical and organisational safeguards should protect information against unauthorised access, loss, alteration and disclosure. The safeguards applicable to a particular app and account are governed by its service arrangements. No online system or transmission method can guarantee absolute security.

Keep sign-in details private, use strong passwords, limit staff access and notify us promptly if you suspect misuse. Where a personal data breach occurs, notification and response obligations are assessed under applicable law.

Information is retained for the period necessary for the purpose for which it was collected, subject to service agreements and applicable legal, accounting, dispute-resolution and security requirements. The period depends on the type of record; this policy does not promise a single retention period for every app.

To request account closure or deletion, email us with the relevant app and account or organisation identifier. If records belong to a school, business or financial group, contact that organisation first so it can authorise the request. We may need to verify identity and authority before acting.

Some records may need to be retained because of legal obligations or unresolved disputes. Deleted records may remain in restricted backups until those backups expire under the applicable backup schedule. Contact us for the retention and backup arrangements relevant to your service.

Subject to applicable law, you may request access to your personal information, correction of inaccurate information, deletion, restriction or objection to certain processing, and withdrawal of consent. Data portability may be available where the law provides it.

Send requests to contact@zoril.app. We may ask for proportionate identity verification and clarification of the records concerned, and will respond within applicable legal timeframes. Do not email identity documents unless we specifically request an appropriate verification method.

For information controlled by a customer organisation, we may refer your request to that organisation or assist it in responding. Rights may be limited where a lawful retention requirement or another legal exception applies.

Zoril Analytics can contain records about children entered by authorised schools. Schools are responsible for the lawful collection of those records, appropriate parent or guardian notices or consent where required, and restricting access to authorised users.

Parents or guardians seeking access to, correction of or deletion of a child’s school records should first contact the school. Contact Zoril if you believe a child’s information has been provided without appropriate authority. Children should not independently submit product enquiries or create organisational accounts without appropriate adult authorisation.

Hosting, email, messaging and other providers may process information outside Uganda. Where cross-border processing occurs, applicable legal requirements and appropriate contractual or other safeguards must be considered. Contact us for the processing locations and safeguards relevant to your chosen service; this policy does not promise that all information stays in Uganda.

We may contact you to respond to a request or send account, security, billing or service-related notices. Your preferred contact method will be used where appropriate. Marketing communications require an appropriate legal basis and an opt-out where required; you can ask us to stop marketing by emailing contact@zoril.app.

For SMS sent by an organisation using Zoril SMS, contact the sender to manage your subscription or use its stated opt-out method. Essential service notices may still be necessary even if you opt out of marketing.

External websites, integrations and payment or telecommunications services may have their own privacy notices. Review those notices before providing information directly to them. Your organisation should check any integration it enables and the information that integration receives.

This policy may be updated to reflect changes in services, processing or legal requirements. The date above identifies the latest revision. Where a change requires additional notice or consent, that notice or consent should be provided through the relevant service or communication channel.

For privacy questions, access or deletion requests, or concerns about how information is handled, contact Zoril Systems:

Please name the app and describe your concern without including unnecessary sensitive records. You may also raise a complaint with Uganda’s Personal Data Protection Office or another competent supervisory authority where applicable.