Privacy Policy

Caramel ("Caramel", "we", "us", or "our") operates a lifestyle commerce platform accessible at www.caramel.ug and through our mobile applications. The platform enables users to shop for products, book events, reserve tables and hotel rooms, and access beauty, wellness, and fitness services from verified merchant partners.

This Privacy Policy explains how we collect, use, share, store, and protect your personal information when you use Caramel as a customer, merchant, or visitor. By accessing or using Caramel, you acknowledge that you have read and understood this Policy.

Caramel is a multi-category commerce platform that connects customers with local and regional businesses across shopping, dining, events, accommodation, beauty, and fitness services. We act as a data controller for personal information collected directly through the platform, and as a data processor for certain information processed on behalf of our merchant partners.

Registered business address: Caramel, Kampala, Uganda. Data protection queries should be directed to: privacy@caramel.ug.

Information You Provide Directly

• Registration data: full name, mobile number, email address, and password.
• Identity verification: national identification details where required for wallet or MicroLoan features.
• Payment information: Mobile Money number, card details (processed by our payment partner — not stored by Caramel), and Caramel Wallet balance.
• Booking and order data: delivery address, event attendance details, reservation preferences, and service selections.
• Communications: messages sent to merchants or to Caramel support through the in-app messaging system.
• Reviews and ratings: content you submit about merchants, products, or services.
• Merchant onboarding data: business registration details, trading licences, bank or mobile money disbursement accounts.

Information Collected Automatically

• Device and browser data: device type, operating system, browser version, and unique device identifiers.
• Usage data: pages visited, products viewed, searches performed, time spent, and click patterns.
• Location data: approximate location derived from IP address; precise GPS location only with your explicit permission.
• Transaction data: purchase history, booking records, payment status, and refund history.
• App behaviour: crash logs, feature usage, and performance data from the Caramel mobile app.

Information from Third Parties

• Payment processors (MTN Mobile Money, Airtel Money, Flutterwave): transaction confirmation and status.
• MicroLoan partner (Letshego): loan eligibility assessment outcomes.
• Social login providers (if you register via Google or Apple): name and email address.
• Fraud detection services: risk scores associated with transactions.

• To create and manage your Caramel account and Caramel Wallet.
• To process orders, bookings, reservations, and payments securely.
• To operate Caramel Escrow — holding funds and releasing them upon confirmed fulfilment.
• To verify merchant identities and maintain platform quality standards.
• To send booking confirmations, digital tickets, delivery updates, and payment receipts.
• To process refunds, returns, and dispute resolutions.
• To personalise your experience — recommended merchants, event suggestions, and relevant promotions.
• To send transactional SMS and email notifications (mandatory for account use).
• To send marketing communications about new merchants, offers, and features (opt-out available at any time).
• To detect, investigate, and prevent fraud, unauthorised access, and Terms violations.
• To comply with legal obligations including anti-money laundering (AML) and know-your-customer (KYC) requirements.
• To improve the platform — analysing usage patterns to develop better features and fix issues.
• To assess MicroLoan eligibility in partnership with Letshego Finance.

Caramel does not sell your personal information to third parties. We share data only in the following circumstances:

With Merchants

When you place an order, make a booking, or purchase a ticket, we share the necessary fulfilment information with the relevant merchant — typically your name, contact details, and booking reference. Merchants are contractually bound to use this information only to fulfil your order and not for any other marketing purpose.

With Service Providers

• Payment processors (MTN MoMo, Airtel Money, Flutterwave/card processors) — to process transactions.
• Letshego Finance — for MicroLoan eligibility assessment when you opt in.
• SMS and email delivery providers — to send you booking confirmations and receipts.
• Cloud hosting providers — Caramel data is hosted on secure cloud infrastructure.
• Analytics providers — anonymised usage data to improve platform performance.
• Fraud prevention services — risk signals to protect all users.

For Legal and Safety Reasons

We may disclose your information where required by Ugandan law, court order, or regulatory authority, or where disclosure is necessary to protect the rights, safety, or property of Caramel, its users, or the public.

We retain your personal information for as long as your account is active and for a further period as required by applicable law.

• Account data: retained for the life of your account plus 5 years after closure.
• Transaction and payment records: 7 years from the date of transaction (tax and financial regulations).
• Booking and reservation records: 3 years.
• Marketing opt-in/opt-out records: indefinitely (to honour your preference).
• Support communications: 2 years from resolution.
• Identity verification (KYC) records: 7 years from account closure (AML requirements).

Subject to applicable Ugandan law and our legitimate interests, you have the following rights regarding your personal information:

• Right of access: request a copy of the personal information we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your data where no legal retention obligation applies.
• Right to restrict processing: request that we limit how we use your data in specific circumstances.
• Right to data portability: request your data in a structured, machine-readable format.
• Right to object to marketing: unsubscribe from marketing communications at any time via the app or by emailing privacy@caramel.ug.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

Caramel implements industry-standard technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction.

• All data in transit is encrypted using TLS 1.2 or higher.
• Passwords are stored as salted, hashed values — we cannot read your password.
• Caramel Wallet transactions are authenticated via your personal 5-digit PIN.
• Payment card data is processed exclusively by PCI-DSS-compliant payment partners — Caramel does not store card numbers.
• Access to production systems is restricted to authorised personnel on a need-to-know basis.
• Regular security assessments and penetration testing are conducted on the platform.

Caramel uses cookies and similar technologies on our website and app to enable core functionality, improve performance, and personalise your experience.

• Essential cookies: required for login sessions, cart functionality, and security.
• Analytics cookies: anonymised data on how users navigate the platform (used to improve features).
• Preference cookies: remember your category preferences and settings.
• Marketing cookies: used only with your explicit consent to deliver relevant promotions.

You can manage cookie preferences via your browser settings. Disabling essential cookies will impair platform functionality. The Caramel mobile app uses equivalent SDK-based tracking which can be adjusted in your device privacy settings.

Caramel is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has registered an account, please contact privacy@caramel.ug and we will promptly investigate and close the account.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-app notification and email at least 14 days before the changes take effect. Continued use of Caramel after the effective date constitutes acceptance of the updated Policy.

The current version and effective date are shown at the top of this page.

For any privacy-related questions, requests, or complaints, please contact:

• Email: privacy@caramel.ug
• In-app: Settings > Help > Contact Support
• Post: Caramel, Kampala, Uganda
• Support hours: Monday–Friday, 8:30 am – 6:00 pm EAT