Applicable Law

Date: April 2026

This Privacy Notice is intended to comply with all applicable data protection legislation in the jurisdictions in which NALA operates, including:

The Data Protection and Privacy Act 2019 (Uganda), as amended — and Regulations made thereunder
The Personal Data Protection Act 2022 (Tanzania), as amended
Law N° 058/2021 on the Protection of Personal Data and Privacy (Rwanda)
The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (United Kingdom)
The Privacy and Electronic Communications Regulations 2003 (PECR) (United Kingdom)
Any other applicable data protection and privacy legislation in jurisdictions in which NALA operates or expands to from time to time

Higher standard commitment

Where the requirements of these laws differ in the protection they afford to your personal data, NALA will apply the higher standard of protection. This commitment applies across all markets in which NALA operates.

DPPA 2019

Data Protection and Privacy Act 2019 — Uganda. Regulator: PDPO https://pdpo.go.ug

PDPA 2022

Personal Data Protection Act 2022 — Tanzania. Regulator: PDPC https://pppcentre.go.tz

DPL 2021

Law N° 058/2021 on the Protection of Personal Data and Privacy — Rwanda. Regulator: RPDPA via NCSA https://ncsa.gov.rw

UK GDPR & DPA 2018

UK General Data Protection Regulation & Data Protection Act 2018 — United Kingdom. Regulator: ICO https://ico.org.uk

PECR

Privacy and Electronic Communications Regulations 2003 — United Kingdom (cookies, electronic marketing). ICO guidancehttps://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/

‍