Privacy Policy

Effective 21-04-2023 · Last updated 12-09-2026

CityDealers is a marketplace where people in Uganda and beyond list things for sale, find sellers near them, message each other and pay through the platform. Doing that needs personal data. This page sets out exactly what we collect, why, who else sees it, and what you can tell us to do about it.

1Who we are

CityDealers is operated by JD online Solutions, a company registered in Uganda under registration number 80020003433293, with its registered office at Bugolobi Kampala.

For the purposes of the Data Protection and Privacy Act, 2019 (Uganda), we are the data controller for the personal data described here.

In this policy, “we”, “us” and “CityDealers” mean that company. “You” means anyone who uses the website at citydealers.in, our buyer/seller mobile app, or our courier app.

2What this policy covers

This policy applies to the CityDealers website, the CityDealers mobile app, the CityDealers Courier app, and our API. It covers buyers, sellers, couriers and anyone who simply browses without an account.

It does not cover what a seller, buyer or courier does with your information after you deal with them directly. When you share your phone number or address with another user to complete a sale, that person becomes responsible for how they handle it. It also does not cover other websites we link to.

3What we collect

Information you give us

Data	When we collect it
Name, email address, password	When you register an account
Phone number, second phone number, WhatsApp number	When you complete your profile or post a listing
Business name, business address, profile photo or logo, biography, years of experience	When you set up a seller profile
Town, district and country	From your profile settings or when you post a listing
Identity documents — National ID, passport or driving permit	Only if you apply for a verified badge
Listing content — titles, descriptions, prices, photos, video, category details	Each time you post or edit an advert or product
Messages, voice notes, images and reactions you send in chat	When you use CityDealers Chat
Delivery address and delivery pin	When you place an order for delivery
Reviews, ratings, questions and answers, abuse reports	When you post them
Bank or mobile money payout details	When a seller or courier requests a payout

Information we collect automatically

Device and connection data — IP address, browser type, device type, operating system, and the pages or screens you open.
Usage data — which listings you view, when a phone number is revealed on your listing, when you were last active, and counts of views and saves. Listing views are counted once per visitor per listing per day using a cookie, so refreshing a page does not inflate a seller’s numbers.
Approximate country — worked out from your IP address so we can show you listings from the right country. You can override this with the country switcher.
Security data — failed login attempts and the IP addresses they came from, kept so we can block brute-force attacks and abusive traffic.

Information from other sources

Social sign-in — if you sign in with Google or Facebook, we receive your name, email address and profile picture from them. We never receive your password.
Payment providers — Flutterwave tells us whether a payment succeeded, the amount, and a transaction reference. Full card numbers never reach our servers.
Couriers and delivery partners — delivery status and proof-of-delivery confirmations.

We do not collect special categories of data. Do not put health information, political or religious views, or anyone else’s identity documents into a listing, a message or a review. If you do, we may remove it.

4Why we use it

Under the Data Protection and Privacy Act, 2019 we must have a lawful basis for every use. Ours are set out below.

What we do	Lawful basis
Create and run your account, publish your listings, run chat, process orders and escrow, pay out sellers and couriers	Performance of a contract with you
Show buyers where a seller is based, and match sellers to couriers by distance	Performance of a contract, and your consent for precise GPS
Verify seller identity and review abuse reports	Legitimate interest in a safe marketplace, and your consent for documents
Detect fraud, block attacks, enforce our terms	Legitimate interest in protecting users and the platform
Send transactional notices — order updates, chat alerts, payment receipts, verification outcomes	Performance of a contract
Send marketing emails, WhatsApp messages or push notifications about offers and features	Your consent, which you can withdraw at any time
Generate listing descriptions with AI when you ask us to	Your consent, given when you press the button
Produce seller performance charts and site analytics	Legitimate interest in improving the service
Respond to lawful requests from courts, the police or regulators	Compliance with a legal obligation

Where we rely on consent, you can withdraw it at any time in your account settings or by contacting us. Withdrawing consent does not undo anything we did lawfully before you withdrew it.

5What other users can see

CityDealers is a public marketplace, so some of your information is visible by design. On your listings and public profile, other users can see:

Your display name or business name, profile photo, biography and years of experience
Your verified badge, if you have one — but never the documents behind it
Your town and district, a map pin showing the area you operate from, and your business address if you entered one
Your listings, prices, photos and answers to buyer questions
Your ratings and reviews, your ad count, and whether you are online or when you were last seen
Your average reply time in chat

Your phone number and WhatsApp number are shown on your listings so buyers can reach you. Your email address is never shown publicly.

The map pin on a listing shows the area a seller is based in. If you would rather show only your town instead of a precise point, clear the GPS pin in your profile settings and choose your town from the list instead.

Anything you publish on a public listing can be copied, screenshotted or indexed by search engines while it is live. Think about that before you put a home address or a personal photo in an advert.

6Who we share it with

We do not sell your personal data. We share it only in these situations.

Other users, to complete a deal

When you buy, sell or arrange a delivery, we pass the other party what they need: your name, contact number, delivery address and order details. A courier assigned to your order sees the pickup and delivery details.

Service providers who run parts of the platform

Provider	What they handle
Flutterwave	Card, mobile money, bank transfer and Google Pay payments, and payouts
[HOSTING PROVIDER]	Servers and databases where the site and your data live
OneSignal	Push notifications to your browser and phone
Google	Maps that show seller locations, fonts, and Google sign-in if you use it
OpenStreetMap (Nominatim)	Turning GPS coordinates into a town name when you tap “detect my location”
ip-api.com	Working out your country from your IP address
Anthropic and OpenAI	Generating listing descriptions when you ask for AI help
Facebook, TikTok	Publishing listings to our social pages, and Facebook sign-in if you use it
[WHATSAPP / SMS PROVIDER]	Sending WhatsApp or SMS notifications
[EMAIL PROVIDER]	Sending transactional and marketing email

These providers may only use your data to do the job we hired them for.

Legal and safety

We will disclose personal data where we are required to by law, a court order or a lawful request from a regulator or law enforcement body, and where we reasonably believe disclosure is necessary to prevent fraud, investigate a crime, protect someone’s safety, or establish or defend a legal claim.

Business transfer

If CityDealers is sold, merged or restructured, your data may transfer to the new owner. We will tell you before that happens and the new owner will remain bound by this policy until it is properly replaced.

7Location data

Location is central to a local marketplace, so it is worth being specific.

Country — estimated from your IP address, or taken from the country switcher if you have used it. Stored in a cookie and on your account.
Town and district — whatever you chose from the location list on your profile or on a listing.
A GPS pin — only if you tap “detect my location” and your browser or phone asks for permission and you grant it. We use it to place a map pin on your listings, to show you on the sellers map, and to calculate courier distance and delivery pricing.
Delivery pin — the coordinates you confirm at checkout, used to work out the delivery fee and to guide the courier.

We never track your location continuously or in the background. A pin is captured only when you press the button, and you can clear it at any time in your settings. Denying location permission does not stop you using CityDealers — we fall back to the town you selected.

8Cookies and similar tools

We use cookies and similar browser storage for these purposes:

Essential — keeping you signed in, holding your session, and protecting forms against cross-site request forgery. The site cannot work without these.
Preferences — your chosen country, display currency, light or dark theme, and language.
Measurement — a short-lived cookie that stops the same visitor being counted more than once a day in a seller’s view count.

You can clear or block cookies in your browser settings. If you block essential cookies, you will not be able to sign in.

[If you add Google Analytics, Meta Pixel or any advertising tag, list it here and describe what it does.]

9Sending data outside Uganda

Some of the providers listed above process data on servers outside Uganda, including in the United States, the European Union and [OTHER COUNTRIES].

Section 19 of the Data Protection and Privacy Act, 2019 allows a transfer outside Uganda where the destination has adequate protection, or where you consent to the transfer after being informed of the risk. Before we use an overseas provider we check what safeguards they offer, and we put a written data processing agreement in place. By using CityDealers and choosing to pay, chat or receive notifications through these services, you consent to your data being processed in those countries.

10How long we keep it

Data	Retention period
Account profile and listings	While your account is open, then deleted when you close it
Chat messages	While your account is open, so you can refer back to a deal
Orders, wallet transactions, payouts and commission records	[7] years after the transaction, to meet tax and accounting law
Identity verification documents	[12 MONTHS] after a decision is made, then deleted
Abuse reports and moderation records	[24 MONTHS], or longer if a dispute is live
Security logs and failed-login records	[90 DAYS]
Listing view statistics	Kept in aggregate; individual view records expire after [90 DAYS]

You can close your account yourself from your settings. Closing it permanently deletes your profile and all your adverts and products — we ask you to confirm several times because it cannot be undone. We keep transaction and accounting records after closure where the law requires it, and we may keep a minimal record of a banned account so the ban cannot be evaded.

11How we protect it

All traffic to the website and apps is encrypted with HTTPS.
Passwords are stored as salted hashes, never as readable text.
App and API access uses signed tokens that expire.
Repeated failed logins trigger a temporary lockout, and the API is rate-limited against abuse.
Staff access to personal data is limited to those who need it to do their job.
Payment card details are handled entirely by Flutterwave and never touch our servers.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the Personal Data Protection Office as required by Regulation [X] of the Data Protection and Privacy Regulations, 2021.

12Your rights

Under the Data Protection and Privacy Act, 2019 you have the right to:

Be told what personal data we hold about you and why.
Access a copy of that data.
Correct anything inaccurate or out of date — most of it you can fix yourself in your account settings.
Delete your data, subject to records we must keep by law. Closing your account does this immediately.
Object to processing based on our legitimate interests, and to stop marketing at any time.
Withdraw consent you previously gave, such as location or marketing consent.
Prevent processing that causes or is likely to cause you unwarranted damage or distress.
Complain to the Personal Data Protection Office.

To exercise any of these, email [PRIVACY EMAIL]. We will respond within [X] days. We may ask you to confirm your identity first, so that nobody else can request your data.

13Children

CityDealers is not for people under 18. We do not knowingly collect data from children. If you believe a child has created an account, tell us at [PRIVACY EMAIL] and we will delete it.

14Changes to this policy

We update this policy when the platform changes or the law does. The date at the top always shows the current version. If a change materially affects how we use your data, we will tell you by email or an in-app notice before it takes effect.

15Contact and complaints

Data Protection Officer

JD Online Solutions

Bugolobi Kampala

Email: info@citydealers.in · Phone: 256 789551420

CityDealers · JD Online Solutions · Kampala, Uganda