Privacy Policy

Last updated: 12 October 2026

VitalReturns (“VitalReturns”, “we”, “us”) provides a tax compliance and accounting platform operated under VitalWorks Limited, registered in Uganda. This Privacy Policy describes the categories of personal data we process, the purposes we use it for, and the rights available to data subjects under the Uganda Data Protection and Privacy Act 2019 (DPPA).

1. Data controller

VitalWorks Limited is the data controller for personal data processed through VitalReturns. Contact the data protection officer at privacy@vitalreturns.ug.

2. Information we collect

2.1 Account and identity data

• Name, email address, phone number, role, organisation.
• Password hashes (bcrypt), multi-factor authentication secrets (TOTP).
• Sign-in metadata: timestamp, IP address, device user-agent.

2.2 Taxpayer and filing data

• Taxpayer identification (TIN), legal name, trading name, entity type.
• Return workbooks, supporting documents, PRNs and payment receipts.
• Submission history and URA acknowledgement responses.

2.3 Operational and audit data

• Immutable audit trail of every mutation performed on the platform.
• Error reports, logs and performance telemetry (anonymised where possible).

3. How we use personal data

• Operating the service — preparing, filing and paying tax returns to URA.
• Verifying identity, enforcing access controls and detecting fraud.
• Compliance with Uganda Revenue Authority, URSB and NIRA record-keeping.
• Service improvement, support and incident response.

4. Sharing with third parties

We share personal data with service providers acting as processors on our instructions — including payment providers (MTN MoMo, Airtel Money, Flutterwave, Pesapal), bank reconciliation partners, URA for lawful filings, and infrastructure providers. We do not sell personal data.

5. Retention

Tax records are retained for ten years in line with URA record-keeping requirements. Account data is retained for the lifetime of the subscription plus one year, after which it is anonymised or deleted on written request.

6. Security

We encrypt data in transit (TLS 1.3) and at rest, enforce multi-factor authentication on every account, segregate production from non-production environments and maintain role-based access controls audited through an immutable trail.

7. Your rights

Under the DPPA you may request access, correction, erasure, restriction, portability and objection in respect of your personal data. Submit requests to privacy@vitalreturns.ug.

8. Changes to this policy

Material changes to this Privacy Policy will be notified in-product and by email at least 14 days before taking effect.