Privacy policy and notice
How Uhambo Atlas Pty Ltd handles personal information in its website, accounts, research services, payments and optional integrations.
Last updated 20 October 2026
Who is responsible and how to contact us
Uhambo Atlas Pty Ltd is responsible for personal information processed for the purposes described here. Contact research@uhambo.online with a privacy question or rights request. For information supplied in an organisation-managed workspace, that organisation may also determine the purposes of processing; contact its administrator where appropriate.
Information we process
- Enquiries and support: the name, work email, organisation, role, message and documents you choose to supply.
- Accounts and access: username, name, organisation, role, plan, authentication records, password hashes where password login is used, and the identifiers and claims needed for enabled single sign-on. We do not retain your account password in readable form.
- Billing: order, plan, seat count, currency, amounts, billing period, payment-provider identifiers, receipt and subscription status. Paddle or another named payment provider processes card and payment details in its own checkout; Atlas does not need your full card number or card security code.
- Service use and security: session identifiers, request and device information, IP addresses, dates, logs, audit records and activity needed to operate and protect the service.
- Content you submit: research queries, uploaded material, saved work and feedback, where those features are used. These may contain personal information if you include it.
- Public-source research: professional and public-office information from identified sources, and permitted information supplied by professional Network applicants. The politically exposed persons register is explained separately below.
Purposes and legal bases
We use information to provide and administer the requested service, authenticate users, fulfil orders, answer enquiries, support research, prevent abuse, maintain evidence and audit records, comply with legal duties and address disputes. We do not sell personal information for advertising or share it with third parties for their independent marketing.
Depending on the purpose and applicable law, we rely on performing or preparing a contract, legal obligations, legitimate interests in service operation, security and lawful research, or consent where required. When consent is the basis, you may withdraw it without affecting earlier lawful processing. A privacy notice is information about processing, not a blanket request for consent.
Service providers, payments and international transfers
Information necessary for a service may be processed by hosting, database, email, authentication, payment and support providers. We may also disclose information where legally required, to protect rights or security, or to professional advisers subject to appropriate obligations. Access is limited to the relevant purpose.
For purchases processed by Paddle, Paddle acts as merchant of record and processes payment and transaction information under its own privacy notice. The checkout may collect billing details, tax information and fraud-prevention signals. Follow the provider's notice for its processing and rights-request process.
Our infrastructure and providers may process information outside your country, including in the United Kingdom and other locations used by the selected service. Where applicable, transfers require the safeguards recognised by the relevant law, such as contractual protections or another lawful transfer basis. Contact us for information about a particular processing arrangement; no claim is made that every service is confined to one country.
AI features and local or external processing
AI processing depends on the feature and deployment you use. A local or offline function may process material on your device. A cloud model or connected provider may receive the prompt, selected source material and context needed for that request. Offline availability is not a promise that all functions remain local when connected features are enabled.
Do not submit personal, sensitive or confidential material without authority. Follow your organisation's controls and review the selected provider's terms. We do not promise that every external provider has identical retention or training practices. Research outputs require human verification and are not a substitute for decisions by qualified people.
Cookies, browser storage and device copies
Atlas uses cookies and local storage needed for sign-in, security, interface preferences and enabled offline functions. Authentication can include additional short-lived cookies for SSO and account-recovery flows. The main signed-in session uses an HttpOnly cookie; session expiry and reauthentication depend on the login flow and security controls.
Payment checkout and optional external integrations may set their own cookies or storage under their notices. Atlas does not currently use third-party advertising trackers on its public site. Blocking necessary cookies may prevent login or checkout. You can clear browser storage or remove downloaded data on your device, but doing so may remove saved work or offline access. Sign out and protect devices shared with other people.
Retention and security
We keep personal information for the period necessary for its purpose, including the active account or contract, support, legal accounting and tax duties, security investigations and disputes. Financial and audit records may need to remain after access ends. The appropriate period depends on the record, applicable law and any legal hold; we do not promise that all records are automatically erased on a single fixed schedule.
We use access controls, secure transport, password hashing and other safeguards appropriate to the service. No system or downloaded copy can be guaranteed immune from unauthorised access. Backups and evidence records may expire or be restricted separately from active records. Requests for deletion are assessed against lawful retention obligations, and we will explain a refusal or limitation where required.
Your rights and complaints
Subject to applicable law, you may request access, correction, deletion, restriction or portability of your information, object to processing, or withdraw consent where we rely on it. Write to research@uhambo.online and identify the information or service concerned. We may request proportionate information to verify your identity; do not send identity documents unless we arrange a secure channel. We respond within the period required by applicable law.
You may complain to South Africa's Information Regulator or the competent data-protection authority where you live. Using our contact process does not prevent you from approaching an authority. The register-specific correction process and response commitment are set out below.
Children and changes to this notice
Atlas is intended for professional and organisational use, not for children. If you believe a child has supplied personal information inappropriately, contact us. We publish material changes here with the updated date and provide additional notice or seek consent where legally required. Continued use is not treated as consent to unrelated new processing.
The register of politically exposed persons
Uhambo Atlas compiles a register of politically exposed persons: people who hold, or have held, a senior public office in the African states we cover. Members use it to screen the people they deal with, as anti-money-laundering rules expect. Being in the register is a statement that a person holds or held a public office. It is not an allegation of wrongdoing.
If you are in the register, we did not collect your information from you. This section is our notice to you of what we hold, why, and what you can ask us to do.
- What we hold: your name and any other names you are publicly known by, the office, how senior it is, the country, the dates of the term, and the official document that records the appointment.
- What we do not hold in the register: your party membership, your political opinions, your contact details, or anything about your private life.
- Where it comes from: we compile it ourselves from official sources and records we hold. Every published entry rests on the official instrument of the institution that holds the office (a gazette, a presidency or parliament notice), and each entry says which document it rests on.
- Family members and close associates: we never publish them. We hold such a link only for screening, and only where an official source itself names it.
- Who sees it: our members, under their subscription and our data terms, for screening and due diligence. We do not sell it, and we do not use it for marketing.
Our legal basis for the register
We hold and share register entries on the basis of legitimate interests: our members' interest in knowing who holds public office in the states they deal with, which the anti-money-laundering rules of many countries require them to check. That basis is set for each jurisdiction:
- South Africa: Protection of Personal Information Act 2013 (POPIA), legitimate interests of Atlas and its members (POPIA section 11(1)(f)).
- United Kingdom: UK GDPR and the Data Protection Act 2018, legitimate interests (UK GDPR Article 6(1)(f)).
- European Union: General Data Protection Regulation (GDPR), legitimate interests (GDPR Article 6(1)(f)).
- Kenya: Data Protection Act 2019, legitimate interests, as that Act provides for.
- Nigeria: Nigeria Data Protection Act 2023, legitimate interests, as that Act provides for.
- Every other state the register covers: that state's data-protection law, where one is in force, legitimate interests where that law provides for it; the same standard is applied where no law is in force.
Accuracy and how long you stay in the register
- We check the lists of office-holders at least once a month, and again whenever an appointment is announced.
- A person remains in the register for 24 months after leaving office. After that we review, case by case, whether the person should stay in it.
- When we remove an entry, it is no longer shown or supplied to anyone. We keep the removed entry for 5 years so that we can show what we held and when, and then delete it.
- The register is held on servers in London, in the United Kingdom.
- Holding it in London, and supplying entries to members outside the country an entry concerns, rest on the same basis of legitimate interests, with transfer safeguards. The safeguards: only published entries leave the register, each resting on the institution's own official document, and family or associate links never do; entries are supplied for screening only, to signed-in members who may not resell them or use them for marketing; a removed entry is withdrawn from everything we supply, offline copies included; and your rights to correction and removal are the same wherever you or the member are.
Correcting or removing your register entry
Anyone may ask us to correct their entry or to remove it, using the form below or by writing to research@uhambo.online. You do not need a reason to ask for removal, though it helps us if you give one.
- We answer within 30 days of the day we receive your request.
- One of our reviewers looks into it and proposes an answer; a second reviewer decides. The person who proposed the answer never decides it.
- Every step is recorded in a tamper-evident log, so the handling of your request can be checked later. The log records the decision, not your contact details.
- If we correct your entry, the correction is recorded against it. If we remove it, it is withdrawn from everything we supply to members, including the offline data they hold.
- We keep your contact details for 24 months after we answer you, and then delete them.
- If you are not satisfied with our answer, you may complain to the Information Regulator (South Africa) or to the data-protection authority where you live.