Version 2 – effective 2 November 2026. This notice explains how Decus collects and uses personal data, in line with Uganda's Data Protection and Privacy Act, 2019 and its Regulations, and, for users in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR).
1. Who we are
Decus Go, DecusBooks, eDecus, Decus Team and Decus Cloud are provided by Integrity Group of Kampala, Uganda, trading as Decus ("Decus", "we"). Contact for privacy questions and requests: info@decuscloud.com or WhatsApp +256 789 887684.
2. Our role
- For your account (sign-in details, licence and billing records, support conversations) Decus decides how the data is used and is the data controller.
- For the business data you put into the apps (your products, sales, customers, staff, jobs and photos, web-shop orders and service requests) your business is the data controller and Decus processes the data on its behalf, only to run the Service.
3. What we collect and why
- Web-shop orders: your name, mobile number, delivery address and note, so the shop can prepare, deliver and confirm your order. The shop receives them; Decus only stores them for the shop.
- Service requests (eDecus): your name, phone, place and what you need, sent only to the company you asked.
- Shop and company accounts: the data the business syncs (products, sales, customers, jobs, photos) so its phones and computers stay in step.
- Licence checks (DecusBooks, Decus Go): machine or phone ID, computer name, app version and licence status, so licences cannot be copied. Kept 12 months after the last check.
- Billing: plan, amounts, invoices and payment references. Card and mobile-money details are handled by the payment provider; we do not store full card numbers or PINs.
- Support: the messages you send us and the details needed to help you.
- Crash reports (only if the user turns them on): app version, phone model and the error, with no customer data.
- Website: two small cookies that remember your language and region choice. We do not use advertising or tracking cookies on decuscloud.com. Our server keeps short technical logs (such as IP address and time) for security.
4. Signing in (Google or e-mail code)
You sign in to Decus apps with Sign in with Google or with a 6-digit code sent to your e-mail. We do not use text messages (SMS).
- Sign in with Google: Google tells us your Google account ID, your name and your e-mail address (the "openid", "email" and "profile" permissions). We use them only to sign you in, to show your name in the app and to find your shops or companies. We do not read your Gmail, contacts, files or anything else in your Google account, we do not post anything, and we never sell this data, share it with third parties for their own purposes or use it for advertising.
- E-mail codes: your e-mail address, so we can send the code and recognise you next time.
- We store the account ID, e-mail and phone number as protected (keyed-hash and encrypted) values, never in plain text. Codes expire after 10 minutes.
- Decus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- You can remove Decus's access at any time at myaccount.google.com/permissions, and delete your Decus account from the app or with Delete an account.
5. Legal bases
We use personal data only where the law allows: to perform our contract with you (providing the Service, sign-in, licences and billing); to meet legal obligations (such as tax records); for our legitimate interests in keeping the Service secure, preventing piracy and fraud, and improving it, balanced against your rights; and with your consent where we ask for it (such as crash reports or WhatsApp updates), which you can withdraw at any time.
6. WhatsApp updates
If you tick the box, the shop may send you order updates on WhatsApp. You can say STOP at any time.
7. Who we share it with
We do not sell personal data. We share it only with: the business you deal with (for orders and service requests); service providers that help us run the Service under contract and confidentiality – hosting (OVHcloud), sign-in (Google), e-mail delivery and payment providers – who may use it only for that purpose; and authorities where the law requires it.
8. Where it is stored and international transfers
Data is stored on the Decus Cloud server run for us by OVHcloud, currently in Canada, and in its encrypted backups. Canada is recognised by the European Commission as giving adequate protection. When data leaves Uganda or your own country, we transfer it only where the law allows and with safeguards that give it a level of protection comparable to the law of Uganda and, where it applies, the GDPR.
9. How we protect it
Encrypted connections (HTTPS), encryption and keyed hashing of identifiers, access limited to staff who need it, two-step sign-in for administration, nightly encrypted backups and security logs. If a breach is likely to put your rights at risk, we will notify the Personal Data Protection Office and the people affected as the law requires.
10. How long we keep it
Tax records (sales, invoices, receipts and payments) are kept for 5 years, as Ugandan tax law requires of us; if your own country requires longer, keep your own copy (every app can export your records). Crash reports are deleted after 90 days, licence check records 12 months after the last check, support conversations 24 months after the last contact. Other personal data is erased when the account is deleted, and from backups within their normal rotation.
11. Your rights
You can ask to access, correct or delete your data, to object to or restrict its use, to receive it in a portable format, and to withdraw consent – under Uganda's Data Protection and Privacy Act, 2019, the GDPR where it applies, and the data protection law of your own country. Use Delete an account, e-mail info@decuscloud.com or WhatsApp +256 789 887684; we answer within 30 days. If the data was entered by a business you deal with, we will pass your request to that business. You may also complain to the Personal Data Protection Office of Uganda (pdpo.go.ug) or, in the EEA or UK, to your local data protection authority.
12. Children
The Service is for businesses and is not directed at children under 18. We do not knowingly collect their data.
13. Changes
We may update this notice. We will show the date of the current version here and tell account owners in the app or by e-mail about important changes.
Last updated 2 November 2026 (version 2). See also our Terms of use.