SYSTRA – SMC LIMITED uses essential cookies and performance analytics to ensure secure corporate communications, statutory compliance with Uganda data privacy laws, and optimal digital service delivery.


Privacy Preferences

Privacy & Cookie Preferences

When you visit SYSTRA – SMC LIMITED, information may be stored or retrieved through your browser via cookies. In compliance with the Uganda Data Protection and Privacy Act (2019) and international GDPR principles, you may configure your preferences below.

  • Essential System & Compliance Cookies
    Strictly necessary for security tokens, encrypted session state, CSRF protection, and audit logs. These cannot be disabled without compromising fundamental site security.
    Required
  • Cloud Edge Delivery & Telemetry
    Routes asset delivery through low-latency East African edge PoPs, ensuring sub-second response times for documents, assets, and venture telemetry.
    Required
  • Performance & Traffic Analytics
    Aggregated, anonymized visit metrics to measure portal usage, evaluate user journeys, and optimize venture showcase performance.
  • Venture Middleware & Third-Party Services
    Enables external partner connectors including interactive maps, carrier verification APIs, and GateGrocer fleet trackers.
Save & AcceptDecline Optional
Privacy Policy

Privacy Policy

Statutory Compliance with Uganda Data Protection Act (2019) & Global GDPR Standards
  1. Home
  2. Corporate
  3. Privacy Policy

Data Controller Identity

This Privacy Policy governs data processing activities carried out by SYSTRA – SMC LIMITED, a private Single Member Corporation incorporated under the Companies Act of the Republic of Uganda (URSB Registration Number: 80034927231456), operating headquarters in Kampala, Uganda, and its operating subsidiaries including GateGrocer.

Effective Date
September 2026 Edition

1. Regulatory Framework & Scope

SYSTRA – SMC LIMITED operates in strict fidelity with statutory data protection legislation, primarily the Uganda Data Protection and Privacy Act, 2019 and its subordinate regulations, alongside cross-border standards including the European Union General Data Protection Regulation (EU GDPR 2016/679) where applicable to international counterparties.

This document applies to all personal information, commercial transactional metadata, biometric identifiers, and telemetry data ingested through:

  • Corporate web portals and subsidiary interfaces (including systracorp.com and GateGrocer web/mobile applications).
  • Enterprise B2B API integrations (URA PRN generation, EFRIS fiscal signing, and WhatsApp Cloud banking channels).
  • Supply-chain fulfillment, logistics tracking, and last-mile order delivery registries.

2. Categories of Data Collected

GateGrocer Commerce & Fulfillment

Customer names, delivery physical addresses across Greater Kampala, telephone numbers, order SKU histories, delivery driver geolocation timestamps, and mobile money payment transaction confirmation codes.

B2B Middleware & Financial Rails

Institutional Taxpayer Identification Numbers (TINs), PRN registration tokens, EFRIS fiscal invoice signatures, API client keys, IP whitelists, and webhook delivery audit trails.

Corporate & Career Applicants

Curriculum vitae, national identification numbers, professional references, employment histories, and executive communications submitted to our recruitment or governance desks.

System Telemetry & Cookies

Encrypted session tokens, CDN routing headers, anonymized latency benchmarks, and consent state cookies managed via our GDPR preference modal.

3. Legal Basis for Data Processing

We process information strictly under lawful bases specified by Section 7 of the Uganda Data Protection Act and Article 6 of the GDPR:

  1. Performance of a Contract: Necessary for fulfillment of FMCG deliveries through GateGrocer or the execution of B2B enterprise software contracts.
  2. Statutory Obligation: Compliance with mandatory statutory filings, Uganda Revenue Authority (URA) tax invoicing, anti-money laundering (AML), and know-your-customer (KYC) requirements.
  3. Legitimate Interests: Securing enterprise systems against cyber intrusion, preventing fraudulent payment injection, and maintaining platform uptime.
  4. Explicit Consent: Granted by data subjects for marketing updates, performance cookies, or voluntary talent pool submissions.

4. Security Safeguards & Encryption Architecture

All data in transit is encrypted using Transport Layer Security (TLS 1.3). Data at rest in our distributed cloud databases is protected with AES-256 encryption. Cryptographic keys used for URA EFRIS fiscal signing and payment tokenization are sequestered inside hardware security modules (HSM) with strict role-based separation of privilege.

5. Data Subject Rights & Escalation

Under Uganda law and international standards, you hold enforceable rights regarding your personal records, including the right to request access, rectification, erasure, restriction of processing, or data portability.

Data Protection Officer Contact

To exercise statutory rights or submit an inquiry regarding data practices, contact our Data Protection Officer:

Office of Data Protection & Governance
SYSTRA – SMC LIMITED (URSB BRN: 80034927231456)
Email: partnerships@systra.ug
Headquarters: Kampala, Uganda

Institutional Security & Compliance Ecosystem

Adhering to verified standards across East African financial and technological rails.