Privacy Policy
Last updated: 16 October 2026
In short: we collect only what we need to run Webook, we never sell personal data, we protect it, and you can ask to see, correct, export or delete it. Waesta Enterprises U Ltd is certified by NITA-U (Uganda) and holds a Personal Data Protection Office (PDPO) data protection certificate issued through NITA-U. See our Trust page.
1. Who is responsible for your data
Webook is provided by Waesta Enterprises U Ltd ("Waesta", "we"). We handle personal data in two different roles, and it helps to know which applies to you:
- Our clients (businesses and their staff). For the information needed to open and run a Webook account, such as owner and staff names and emails, login security, billing and support, Waesta is the data controller.
- The customers of our clients. When a business uses Webook to take bookings, the people who book are that business's customers. The business decides why and how their details are used, so the business is the data controller and Waesta is its data processor. If you are a customer of a business and want to see or delete your details, contact that business first; we will support them in responding.
We follow the Data Protection and Privacy Act, 2019 of Uganda and its regulations, and we apply the same standards to clients in Kenya and elsewhere.
2. What we collect
| Who | What |
|---|---|
| Business owners and staff | Name, email address, role, a password that we store only as a one-way hash, the business name and settings, the plan chosen, and sign-in and security records (such as time of sign-in and IP address). |
| Customers of our clients | What the business or the customer enters when booking or being recorded: name, phone, email, the service and time booked, notes, and message history. We do not ask for or store card numbers. |
| Payments | When a business pays for a plan or a customer pays a business through mobile money, we keep the transaction reference, amount, currency, status and phone number used. Card and wallet credentials are handled by the payment provider, not by Webook. |
| Support and feedback | Reports you send through Report a problem, the scores and comments you give through Share feedback, and the emails you exchange with [email protected]. |
| Technical information | Error and security logs, and basic usage counts for each business (for example number of appointments), used to keep the service healthy and fair. These counts do not include customer names or contact details. |
3. Why we use it, and our legal basis
- To provide Webook (create your account, take bookings, send confirmations and reminders, issue invoices, take payments): needed to perform our agreement with you.
- To keep the service secure and working (prevent fraud and abuse, fix faults, back up data, monitor health): our legitimate interest in running a safe service, and our duty to protect personal data.
- To support you and improve Webook (answer reports, study feedback and anonymous usage trends): our legitimate interest, and your consent where you choose to send feedback.
- To meet legal duties (tax and accounting records, requests from authorities with the legal power to ask).
- To message you about your account (security, billing, changes to the service). We only send marketing about Webook where you have agreed, and every marketing message lets you opt out.
We do not sell personal data. We do not use customer details held for our clients to advertise or to build profiles for ourselves, and we do not make decisions about people by automated means that have legal or similarly significant effects.
4. Who we share it with
We share personal data only with people and services that help us run Webook, and only what each needs:
- Hosting and infrastructure providers that store the data and run the service for us.
- Email delivery. Messages are sent through the mail service configured for the platform or, if a business connects it, through that business's own Gmail or mailbox.
- Payment providers (mobile money and our payment partner, WaestaPay) to process payments you ask us to make.
- Messaging services such as WhatsApp and Telegram, once they are released and only for businesses that turn them on.
- Google, only if a business connects Google Calendar or Gmail. That connection is the business's choice and can be removed at any time.
- Waesta Operations HQ, our own internal support and operations system, which receives each business's plan status, health signals, usage counts and support tickets. It does not receive customer names or contact details.
- Professional advisers and authorities where the law requires or to protect rights, for example in a legal claim.
These providers may only use the data to provide their service to us, and must protect it. If our business is ever sold or merged, personal data may pass to the new owner, who must honour this policy.
5. Transfers outside Uganda
Some providers we use (for example email, hosting or Google services) may process data outside Uganda. Where that happens we only use providers that give the data a level of protection that meets the Data Protection and Privacy Act, 2019, or we rely on the person's consent or another basis the Act permits.
6. How long we keep it
- Account and booking data is kept while your account is active so the service works.
- When an account is deleted, its data is erased from our live systems. Copies in backups are removed as those backups are overwritten on a rolling basis.
- We keep limited billing and tax records for as long as the law requires.
- Security and error logs are kept only as long as needed to investigate problems, and reset or confirmation links expire within hours.
7. How we protect it
We use encryption in transit (HTTPS), one-way hashing for passwords, encryption at rest for integration keys and secrets, separation of every business's data from every other's, role-based access, sign-in protection, audit logging and regular backups. The details are on our Trust page. No system is perfectly secure. If a breach affects personal data in a way that risks people, we will notify the affected business and the Personal Data Protection Office as the law requires, and give the information needed to respond.
8. Your rights
Under the Data Protection and Privacy Act, 2019 you have the right to:
- know whether we hold personal data about you and get a copy of it;
- have inaccurate or incomplete data corrected;
- ask us to delete or destroy data we no longer have a lawful reason to keep;
- object to or ask us to restrict certain uses, including direct marketing, and withdraw consent you gave earlier;
- not be subject to a decision made only by automated means that significantly affects you.
Business owners can export their business's data and ask us to erase it. To use any right, write to [email protected]. We may need to confirm who you are first, and we will answer within the time the law sets. If you are a customer of one of our clients, we may direct you to that business because it controls your data.
9. Cookies and browser storage
Webook does not use advertising or tracking cookies. Once you sign in, your browser stores a sign-in token and a few preferences (for example, a reminder that you chose "Not now" on a feedback request) so the app works. Pages load fonts from Google Fonts, which means your browser contacts Google when a page opens. You can clear stored data in your browser settings, which signs you out.
10. Children
Webook is for businesses and is not aimed at children. A business that takes bookings for a child is responsible for handling that child's data lawfully, including getting a parent or guardian's consent where the law requires it.
11. Changes to this policy
We may update this policy as the service or the law changes. We will change the date above and, for material changes, tell business owners by email or in the app.
12. Contact and complaints
If you are not happy with how we handled your data, please tell us first so we can put it right. You also have the right to complain to the Personal Data Protection Office (PDPO) at the National Information Technology Authority, Uganda (NITA-U).