Bakertilly

Menu

Privacy Policy

1. Introduction

Baker Tilly Hem LLP is a member firm of the global Baker Tilly Network of independent accounting and advisory firms and is based in Uganda. This policy applies to personal data processed by the firm and, where relevant, other Baker Tilly member firms with whom resources, systems or client information are shared to deliver coordinated services. Each member firm remains a separate and independent legal entity.

This policy is issued in compliance with Uganda’s Data Protection and Privacy laws and explains how we collect, use, store, share, protect, retain and dispose of personal data and the rights available to the data subjects.

2. Scope of Policy

We process personal data relating to clients, employees, partners, contractors job applicants, suppliers, business contacts, regulators and website users. “Personal data” means information relating to an identified or identifiable natural person (e.g. name, ID number, location data or physical, financial, cultural or social identifiers).

We collect data directly from you (forms, contracts, interviews, CV) through our website and electronic systems, from clients and referees, from third-party service providers, from publicly available sources, and via cookies, always through lawful means.

Categories and purposes of processing

  • Job applicants: application details, qualifications and referee information used to assess candidates, verify eligibility and manage recruitment outcomes.
  • Employees, partners and contractors: contact, statutory, tax, payroll, performance and identification records, used to administer employment or engagement, benefits, statutory reporting and workplace safety.
  • Business partners, agents and directors: identity, contact and tax details used for communication, transactions, payments and due diligence.
  • Clients and professional service recipients: data needed to deliver audit tax advisory and related services and to meet quality, risk and regulatory obligations.
  • Visitors: identity and vehicle or contact details collected for access control and security.
  • Website and general inquiries: name and contact details used solely to respond to inquiries.

In every case, collection is limited to what is adequate, relevant and necessary for the stated purpose, and any further use must be compatible with that purpose.

3. Lawful Collection and Processing

We collect and process personal data fairly, lawfully and transparently, and only where a valid lawful basis applies. The lawful basis relied upon shall be identified and documented in relation to the relevant processing activity.

Personal data shall be processed only when at least one of the following lawful bases applies:

  • The data subject has given explicit consent.
  • Processing is necessary for the performance of a contract.
  • Processing is necessary for compliance with a legal obligation.
  • Processing is necessary to protect the vital interests of the data subject or another person.
  • Processing is necessary for the performance of a task carried out in the public interest.
  • Processing is necessary for legitimate interests pursued by the organization, provided that such interests do not override the data subject’s fundamental rights and freedoms.

4. Consent Management

Consent shall be managed in a transparent manner so that data subjects understand what they are agreeing to and retain meaningful control over their personal data. Where consent is relied upon as the lawful basis for processing, the organization shall ensure that valid consent is obtained and can be demonstrated.

Consent requirements include:

  • Consent must be freely given, specific, informed and unambiguous.
  • Consent requests shall be clearly distinguishable from other matters and presented in an intelligible and easily accessible form, using clear and plain language.
  • Data subjects have the right to withdraw consent at any time, and withdrawal shall be as easy as giving consent.
  • Records of consent, including when and how consent was obtained or withdrawn, shall be maintained to demonstrate compliance.

5. Rights as a data subject

Under this policy, you, the data subject, have the right to access the personal data we hold about you, request correction, blocking, erasure or destruction of inaccurate held data, Request that processing be stopped restricted or prevented where permitted by law or contract, be informed of and object to any decision based solely on automated processing that significantly effects you and requests your human review and lodge a complaint with us request on any issues in relation to your personal data.

Requests may be submitted at any time to dataprotectionofficer@bakertilly.ug. We record, verify and respond to all requests.

6. Sharing of Personal Data

Internal sharing

Data may be shared within the firm and the Baker Tilly network strictly for legitimate business, administrative, risk-management or compliance purposes accessible only to authorized personnel and protected by appropriate technical and organizational safeguards.

External sharing

We may disclose data to approved third parties i.e. legal and tax advisers, auditors, banks, regulators, technology and cloud-hosting providers where necessary for service delivery, contractual performance or compliance. Third parties processing that on our behalf are bound by written data processing agreements requiring confidentiality, adequate security, breach notification, restrictions on sub-processing and secure, return or deletion of data at the end of the engagement. We do not share data for independent marketing without consent.

Cross border transfers

Where data is transferred, accessed or stored outside Uganda, we first assess the recipient’s level of data protection and apply appropriate safeguards (contractual protections, transfer risk assessments, regulatory approval or informed consent) onsistent with cross border transfer requirements under the laws of Uganda.

Legal and regulatory disclosure

We may disclose data to courts, regulators or law enforcement bodies where required by law to prevent or investigate fraud or breaches or to establish or defend legal rights. We verify the requester’s authority and ensure a disclosure is lawful, necessary and proportionate before releasing any data.

7. Protection, Retention and Accuracy

We apply physical, technical and organizational safeguards including access controls, encryption, multi-factor authentication, staff training and regular security reviews to protect personal data against loss, misuse or unauthorized access. Security incidents are documented, investigated and reported as required by law though no system can guarantee absolute protection.

Personal data is retained only as long as necessary to fulfill the purpose of collection or to meet legal regulatory or professional obligations after which it is securely deleted, destroyed or anonymized. We take reasonable steps to keep data accurate and encourage data subjects to notify us of any changes.

8. Data Security

We implement appropriate technical and organizational measures to ensure the security of personal data and to protect it against unauthorized or unlawful processing, accidental loss, destruction or damage. These measures are proportionate to the nature and sensitivity of the personal data and the risks associated with its processing.

Security measures include:

  • Access controls and authentication mechanisms to restrict access to authorized personnel.
  • Encryption of sensitive personal data in transit and at rest.
  • Regular security assessments, vulnerability testing and timely remediation of identified weaknesses.
  • Secure disposal procedures for obsolete data and storage media to prevent unauthorized recovery or use.
  • Incident response and breach notification procedures to ensure security incidents are promptly contained, investigated, documented and reported as required by law.

9. Compliance, Enquiries and Policy Review

We conduct periodic privacy compliance assessments and internal audits with identified gaps assigned to responsible officers for remediation within agreed timelines. Independent audits may be conducted following significant system
changes.

For any question, request or complaint regarding this policy or the processing of your personal data, please contact our Data Protection Officer at dataprotectionofficer@bakertilly.ug.

This policy is reviewed regularly and may be updated from time to time to reflect changes in our practices or in applicable law.