Privacy Policy
How Granite Gate Logistics collects, uses, and protects personal data. Governed by the Uganda Data Protection and Privacy Act 2019.
Who we are and what this document covers.
Granite Gate Logistics Ltd is a company incorporated in Uganda, operating custody-grade logistics from Kampala across East and Central African trade corridors.
This Privacy Policy explains how we collect, use, store, and protect personal data in connection with our services and this website. It applies to clients, prospective clients, suppliers, and website visitors.
We comply with the Uganda Data Protection and Privacy Act 2019 (PDPA). Where our operations involve data subjects in other jurisdictions, we apply equivalent standards.
We collect only what we need to operate.
Contact and identity data: name, job title, organisation, email, telephone, and address, collected when you submit an enquiry or enter a service agreement with us.
Service and transactional data: cargo descriptions, consignment references, routing instructions, customs documentation, and vehicle identification numbers.
Communications data: correspondence records including emails and meeting notes, retained for service delivery and dispute resolution.
Website technical data: IP address, browser type, and pages visited, collected via server logs. We do not use third-party analytics or advertising cookies.
Due diligence data: where required by law, we collect identifying documentation and beneficial ownership information to satisfy anti-money laundering and KYC obligations.
Every use has a stated purpose and legal basis.
Service delivery: to fulfil the logistics, customs, and transport services you have engaged us for. Legal basis: performance of a contract.
Client communication: to respond to enquiries, issue documentation, and provide service updates. Legal basis: performance of a contract and legitimate interests.
Compliance and legal obligations: to satisfy customs authorities, the Uganda Revenue Authority, and other regulatory bodies. Legal basis: compliance with a legal obligation.
Due diligence: anti-money laundering checks, sanctions screening, and KYC verification. Legal basis: compliance with a legal obligation.
Security and fraud prevention: protecting operational integrity and detecting unauthorised access. Legal basis: legitimate interests.
We do not sell, rent, or trade personal data to third parties for commercial purposes.
Disclosed only where necessary, only to the right parties.
Regulatory authorities: the Uganda Revenue Authority, Uganda National Bureau of Standards, and other government bodies with a legal entitlement to information in connection with a specific consignment.
Customs and freight partners: freight agents, port operators, bonded warehouse operators, and customs brokers engaged on a specific file, bound by confidentiality agreements.
Transport and escort partners: subcontracted vehicle and security operators on secure transport files, subject to the same data minimisation standards.
Legal and professional advisors: lawyers and auditors engaged on a specific matter, under professional confidentiality obligations.
We do not transfer personal data outside Uganda except where required by the corridor movement or customs filing. Where cross-border transfers occur, equivalent safeguards are applied.
Data is kept only for as long as required.
Client and transactional records: seven years from the last transaction, in compliance with Uganda's Companies Act and tax obligations.
Customs and regulatory documentation: seven years or as required by the Uganda Revenue Authority.
Due diligence records: seven years from the end of the client relationship, per anti-money laundering regulations.
Website technical logs: 90 days, unless retained in connection with a security incident.
General correspondence: three years, unless the correspondence forms part of a contractual or compliance record.
When personal data is no longer required, it is securely deleted or anonymised.
Rights under the Uganda Data Protection and Privacy Act 2019.
Right of access: you may request confirmation of whether we hold your personal data and a copy of that data.
Right to rectification: you may request correction of inaccurate or incomplete personal data.
Right to erasure: you may request deletion of your personal data where it is no longer necessary, subject to overriding legal obligations.
Right to restrict processing: you may request that we limit the way we use your data pending resolution of a complaint or query.
Right to object: you may object to processing based on legitimate interests where you have grounds relating to your particular situation.
To exercise any right, submit a written request to operations@granitegate.co.ug. We will respond within 21 days.
Measures proportionate to the sensitivity of the data.
We implement access controls restricting personal data to those who require it operationally, encryption of transmitted documentation, secure physical storage for paper records, and internal policies governing handling and retention of client files.
In the event of a personal data breach likely to result in risk to your rights, we will notify the Personal Data Protection Office and, where required, affected individuals within the timeframes prescribed by applicable law.
Information submitted through our website contact form is transmitted via TLS encryption.
We do not track you across the web.
This website does not use third-party advertising or analytics cookies. We use only the technical session data necessary to serve the site correctly.
Standard server logs record IP addresses and page requests for security purposes. These logs are retained for 90 days and are not shared with third parties except where required by law.
Questions and complaints.
For any question relating to this Privacy Policy, contact our operations team: operations@granitegate.co.ug or +256 772 480 921, Bukoto Kisaasi Road, Kampala, Uganda.
If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Data Protection Office of Uganda.
Effective date: 1 January 2025. Last reviewed: 1 May 2026.
§ · Close
Questions about your data.
We respond in writing.
Contact our operations team directly. A senior operator responds within four working hours.