Privacy Policy

1. Who we are

Tukola is a marketplace platform operating in Kampala, Uganda that connects households and businesses with vetted blue-collar workers ("fundis"). This policy explains what personal data we collect, why, and how we protect it, in line with the Data Protection and Privacy Act, 2019 (Uganda).

2. What we collect

• Phone number — used as your account identity and for login codes (OTP).
• Name and role (employer or fundi) — to operate the marketplace.
• Fundi profiles — skills, work area, and verification status.
• Job details — titles, descriptions, locations, photos you upload, and prices.
• Payment records — amounts, mobile-money references, and receipts.
• Messages sent through in-app chat.
• Approximate location (parish/area level) — only when you use location features. We do not track your precise GPS.

3. Why we collect it (purpose)

We use your data only to run the service: creating your account, matching fundis to jobs, holding and releasing payments in escrow, resolving disputes and guarantee claims, and preventing fraud. We do not sell your data to anyone.

4. When we share data

• Between job parties: an employer sees a fundi's profile; contact details are only shared after payment is secured in escrow.
• Payment providers (e.g. MTN Mobile Money) — only what is needed to process your payment.
• SMS providers — your phone number, to deliver login codes.
• Where required by Ugandan law or a lawful authority request.

5. How long we keep data

• Login codes (OTP): deleted after 10 minutes.
• Accounts, jobs, and messages: kept while your account is active, and up to 24 months after, unless you ask us to delete sooner.
• Payment and receipt records: kept for 7 years, as required for tax and financial records (EFRIS/URA).

6. Your rights

Under the Data Protection and Privacy Act, you may ask us to: show you the data we hold about you, correct it, or delete it (except records we must keep by law, such as payment records). To make a request, contact us through the app or at the email below. We respond within 30 days.

7. Security

Passwords are never used — login is by one-time SMS code with server-side sessions. Payment data is handled by licensed providers. Access to our database is restricted and encrypted in transit. No system is perfectly secure, but protecting your data is a core design requirement of Tukola, not an afterthought.

8. Analytics

We collect anonymous product analytics (e.g. which features are used) to improve the service. These are counts of actions, not recordings of you.

9. Changes and contact

If we change this policy we will update this page and the date below. Questions or requests: contact us through the Tukola app or at privacy@tukola.com.