Privacy notice

This notice is issued by C.O.T.E TECH (U) LIMITED (URSB Reg. No. 80034883612253), trading as COTE Technologies, P.O. Box 500796, Wandegeya, Kampala, Uganda. We are the data controller for personal data collected through coteug.com.

Contact for privacy questions: info@coteug.com. Responsible person: Eng. Emmanuel Bahindi, Founder and CEO.

We process personal data under Uganda's Data Protection and Privacy Act 2019 and its regulations. Where we handle personal data of people in the European Union or United Kingdom, we do so on terms compatible with the GDPR and UK GDPR, and we sign a data processing agreement on request.

Contact form and bookings: your name, email, organisation, country, and your message, so we can reply and prepare for a call. Lawful basis: your consent and steps taken at your request before a contract.

AI readiness scorecard: your answers, to calculate your score. If you choose to give your email and tick the consent box, we also store your email to send the report. Without consent, we do not store your email.

Academy enquiries and funding conversations: the details you share with us, to respond and to manage enrolment or partnership.

The assistant answers questions about COTE using our published content. Messages you type are processed to generate a reply. Do not share sensitive personal data in the chat.

If you ask to speak to a person, we pass the conversation and any contact details you provide to our team so we can follow up.

We do not store chat transcripts. Our server keeps only anonymised usage records (for example, how long a reply took and whether it was handed to a person), with no names, email addresses or message text. The assistant runs on an open-source model (via Ollama) on our own server, so your messages are not sent to a third-party AI company, and they are never used to train AI models.

We sometimes email organisations we think we can help. We use business contact details that are published for that purpose, such as a role address on an organisation's website, or found in public tender and grant listings. We do not buy contact lists or scrape social networks.

Our lawful basis is legitimate interest in offering relevant services to organisations. Every message is reviewed by a person before it is sent, says who we are and why we are writing, and includes a one-click way to opt out, which we honour immediately.

We use Umami, a cookieless analytics tool, to count page views and a small set of events such as booking clicks and scorecard completions. It does not set cookies or build profiles of individual visitors. We do not use advertising trackers.

We share personal data only with service providers that help us run this website and our business, such as hosting, email and scheduling providers, under contracts that require them to protect it. We do not sell personal data.

Service providers: Contabo (our server host, which runs this website, the assistant and our analytics), Cal.com (booking calls), and our business email provider. Analytics (Umami) and the assistant are self-hosted on our own server.

Some providers may process data outside Uganda. Where that happens, we use providers that offer appropriate safeguards, as required by the Data Protection and Privacy Act 2019.

Enquiries and leads: 24 months after our last contact, unless we sign a contract. Scorecard emails: until you unsubscribe, and no longer than 24 months. Prospecting records: 12 months after last contact; if you opt out, we keep only your email address on a suppression list so we never contact you again. Client project records: for the duration of the contract and as required by Ugandan tax and company law.

You can ask to access, correct or delete your personal data, object to or restrict processing, withdraw consent at any time, and ask for a copy of your data. Email us and we will respond within 30 days.

You can also complain to Uganda's Personal Data Protection Office (PDPO). If you are in the EU or UK, you may contact your local supervisory authority.

We use encrypted connections, role-based access, two-factor sign-in for sensitive roles and regular backups. No system is perfectly secure; if a breach affects your data, we will notify you and the regulator as the law requires.