Privacy Policy

Thirdsan ("we", "us", "our") is committed to protecting your personal data. As Uganda's trusted cybersecurity infrastructure provider, data protection is not a compliance box — it is fundamental to our work and our values. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that data. By using our website at thirdsan.com, you agree to this policy.

1. Who We Are

Thirdsan is a civic-tech company and Uganda's trusted cybersecurity infrastructure provider, delivering IT solutions, digital transformation services, and national-scale security architecture. We are registered in Uganda and operate from DK City Plaza, Hanlon Road, Kampala. Contact: enterprise@thirdsan.com

2. Information We Collect

Information you provide directly:

• Name, email address, phone number, and project details submitted via our contact form
• Communications you send us via email or WhatsApp

Information collected automatically:

• Website usage data via Google Analytics 4 (pages visited, time on site, referral source, device type)
• IP address and browser information for security and performance monitoring
• Cookies set by Google Analytics for traffic measurement

3. How We Use Your Information

• To respond to your inquiries and provide requested services
• To send project proposals, quotes, and follow-up communications
• To send a confirmation email when you submit a contact form
• To analyse website traffic and improve our website performance
• To comply with legal obligations in Uganda

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4. Third-Party Services

We use the following third-party services that may process your data:

• Google Analytics 4 — website traffic analysis. Data is processed by Google LLC (US). See Google's Privacy Policy.
• WhatsApp (Meta) — if you contact us via our WhatsApp link. Data is processed by Meta Platforms, Inc.

5. Data Retention

We retain contact form submissions and communications for up to 3 years for business record-keeping purposes, after which they are securely deleted. Analytics data is retained per Google Analytics' default retention settings (14 months).

6. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data
• Withdraw consent to marketing communications at any time

To exercise these rights, contact us at enterprise@thirdsan.com.

7. Cookies

Our website uses cookies primarily for Google Analytics. These cookies do not personally identify you. You can disable cookies in your browser settings; however, this may affect website functionality. By continuing to use our website, you consent to our use of cookies.

8. Security

We implement reasonable technical and organisational security measures to protect your data against unauthorised access, alteration, disclosure, or destruction. Our website uses HTTPS encryption for all data in transit. As a cybersecurity infrastructure provider, we hold ourselves to the same standards we recommend to our clients — including access controls, encrypted storage of sensitive records, and regular internal security reviews.

8a. Cybersecurity Services & Client Data

Where Thirdsan provides cybersecurity services — including security audits, penetration testing, incident response planning, or institutional security architecture — we operate under a strict engagement confidentiality framework. Client system information, vulnerability findings, and security reports are:

• Shared only with authorised personnel at the client organisation
• Never disclosed to third parties without explicit written consent
• Stored in access-controlled, encrypted environments
• Destroyed or returned to the client at engagement completion, per agreed terms

All Thirdsan cybersecurity engagements are governed by a signed Scope of Work and Non-Disclosure Agreement (NDA). If you are engaging us for security services and have questions about data handling, contact enterprise@thirdsan.com before the engagement begins.

9. Children's Privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

11. Contact Us

For any privacy-related questions or requests:

• Email: enterprise@thirdsan.com
• Phone: 0200 991234
• Address: Hanlon Road | DK CITY Plaza, Kampala, Uganda