Data Protection

Oasis Ruzi Car Dealers Ltd Last reviewed: 8 October 2026

Your personal information belongs to you, not to us. This page sets out the rights you have over it under Uganda's Data Protection and Privacy Act, 2019, and exactly how to use them. We also honour the equivalent rights under the EU and UK GDPR for anyone who deals with us from abroad.

1. The law we follow

Oasis Ruzi Car Dealers Ltd handles personal data in line with the Data Protection and Privacy Act, 2019 (Act No. 9 of 2019) and the Data Protection and Privacy Regulations, 2021. The regulator is the Personal Data Protection Office (PDPO), which sits within the National Information Technology Authority – Uganda (NITA-U).

2. The principles we are held to

Section 3 of the Act requires anyone handling personal data to observe these principles. We hold ourselves to them:

Accountability — we are answerable to you for the data we hold.
Lawfulness and fairness — we collect it lawfully, and we tell you what we are doing.
Purpose limitation — we use it only for the reason it was collected.
Minimality — we ask for what is adequate and relevant, never excessive.
Accuracy — we keep it correct and up to date.
Storage limitation — we keep it only as long as the law or the purpose requires.
Security and transparency — we protect it, and we involve you in decisions about it.

3. Your rights in full

Right	What it means in practice
To be informed	To know what we are collecting and why, before we collect it. That is what our Privacy Policy is for.
Access	To be told whether we hold data about you, and to receive a copy of it together with a description of what we use it for and who we have given it to.
Rectification	To have anything inaccurate corrected, and anything incomplete filled in. If your phone number or address changes, tell us and we will update it.
Erasure	To have data deleted where we no longer have a good reason to keep it. We cannot delete records we are legally required to retain, such as the accounting record of a completed sale.
Object to processing	To tell us to stop using your data where we rely on our legitimate interests, and to stop using it for direct marketing. For marketing, there is no exception — if you object, we stop.
Restrict processing	To have us pause and hold your data without using it, for example while we check whether something you dispute is accurate.
Withdraw consent	Where we rely on your consent, you may withdraw it at any time. That does not undo what was lawfully done before you withdrew it.
Not be subject to automated decisions	To require that a decision significantly affecting you is not made by a computer alone. We must answer such a request within 21 days. In practice every finance and hire purchase decision we make is reviewed by a person.
Data portability	To receive the data you gave us in a common, machine-readable format so you can take it elsewhere. We provide this as CSV or PDF.
To complain	To take a complaint to the Personal Data Protection Office, whether or not you have raised it with us first.

4. How to make a request

Email info@oasisruzi.com with the subject line "Data protection request".

Tell us which right you want to use and include enough detail for us to find your records — the name and phone number you dealt with us under is usually enough.

Proving who you are

Section 24 of the Act requires you to provide proof of identity before we release personal data. This protects you: we are not going to hand your records to someone who merely knows your name. A photograph of your National ID, passport or driving permit is sufficient. If someone is acting for you, we also need your written authority.

What it costs and how long it takes

There is no charge for a reasonable request.
We acknowledge within 2 working days.
We complete most requests within 7 days, and always within 30 days.
For a request about an automated decision, the Act gives us 21 days and we will not exceed that.
If a request is repetitive or clearly excessive we may charge a reasonable fee or decline it — and we will explain why in writing.

5. If we have to say no

Occasionally we cannot do what is asked. The usual reason is a legal obligation that outweighs the request — tax law requires us to keep the record of a completed sale for seven years, so we cannot erase it on request. Where we refuse, we will tell you in writing which exemption applies and remind you of your right to complain.

6. Data breaches

If personal data we hold is lost, stolen or accessed by someone unauthorised, the Act requires us to notify the Personal Data Protection Office immediately on becoming aware of it. Where the breach is likely to affect you, we will contact you directly, explain what happened, what it means for you, and what we are doing about it.

7. Complaining to the regulator

You can complain to the Personal Data Protection Office at any time:

Office	Personal Data Protection Office (PDPO)
Part of	National Information Technology Authority – Uganda (NITA-U)
Website	www.pdpo.go.ug

We would rather you came to us first so we can put things right — but it is your choice, and you lose nothing by going straight to the regulator.

8. Our Data Protection Officer

Section 6 of the Act requires institutions handling personal data to designate a Data Protection Officer. Ours is The Operations Manager, contactable at info@oasisruzi.com.