Operator and contact
This service is operated by EurekaLinks LTD. For privacy and data requests, email info@eureka.ug or call +256 741 793871.
Purpose and scope
This draft sets out the intended handling of shop, customer and conversation data in Kaduuka. It complements the privacy policy; it is not a claim of certification or a substitute for the operator’s documented procedures.
Collect what the transaction needs
Use WhatsApp identity to associate a conversation with a customer. Collect name and delivery details when required for an order. Do not request passwords, mobile-money PINs or unrelated sensitive information in chat.
Access and use
Customer-facing tools must access only the verified sender’s own customer and order records. Internal cost prices and service credentials must not be exposed to the customer assistant. Staff access should be limited to authorised duties. Human handoff and assistant pauses must remain available.
Retention schedule to finalise
| Record type | Purpose / retention decision |
|---|---|
| Messages and customer details | Customer support and order continuity; operator to set a retention period and review cycle. |
| Orders and sales | Fulfilment and accounting; retention depends on applicable business obligations. |
| Security and diagnostic logs | Incident investigation; operator to set a short, documented retention period. |
| Backups | Recovery; operator to document rotation, access and deletion after expiry. |
Deletion and correction requests
Start by contacting the shop in the existing WhatsApp conversation. Include the request and relevant order reference, but no password or PIN. The shop should verify the requester, identify affected records and explain any legal retention exceptions. Removal from active systems and expiry from backups may occur at different times; the operator must publish these arrangements.
Providers and transfers
Maintain a current record of hosting, messaging and AI providers, their roles and processing locations. Send only the data needed for each service. Confirm contractual protections and applicable transfer requirements before production use.
Operational safeguards
Keep credentials on the server, restrict staff access, use HTTPS and verify webhook authenticity. Redact secrets from diagnostics. Audit sensitive changes and test restoration procedures. These controls require ongoing operational verification.
Incidents and accountability
The operator should investigate suspected unauthorised access, preserve relevant evidence and notify affected parties or authorities where required. Assign an accountable contact and document incident response, staff access reviews and retention enforcement before adopting this policy.