Data Processing Agreement

• Ensure a lawful basis for the personal data uploaded, issued or verified.
• Provide required notices to data subjects.
• Handle data subject requests for records the Institution controls.

• Process personal data only on the Institution's documented instructions.
• Ensure personnel are bound by confidentiality.
• Implement appropriate technical and organisational measures (see Security Measures).

Verify.ug applies multi-tenant isolation, Row-Level Security, RBAC, MFA-capable authentication, encryption in transit (TLS 1.2+) and encryption at rest for managed storage. See our Security Whitepaper for the full control set.

Personal data will be treated as confidential and access limited to personnel with a need-to-know.

• The Institution authorises the use of sub-processors necessary to operate the Platform (e.g. cloud hosting, email delivery, payment providers).
• A current list is available on request from privacy@verify.ug.
• We will provide reasonable notice of material changes and give the Institution an opportunity to object.

Where personal data is transferred outside Uganda, we implement appropriate safeguards, including contractual protections with sub-processors.

The Institution may request reasonable information to demonstrate compliance with this DPA. On-site audits, where required by law, will be scheduled to minimise disruption and subject to confidentiality.

We will notify the Institution without undue delay after becoming aware of a personal data breach affecting its data, and provide information reasonably necessary to meet the Institution's own notification obligations.

Upon termination or written request, the Processor will delete personal data processed on behalf of the Institution, except where retention is required by law or for defined operational log windows.

Prior to deletion, the Institution may export credential and verification records through the Platform or via API within a reasonable window.

Each party will comply with applicable data protection laws relevant to its role, including — where applicable — Uganda's Data Protection and Privacy Act.