Legal

Data Protection

Last updated: 8 June 2026

Crib is operated by GeoBox Digital Services (U) Ltd, a company based in Kampala, Uganda. We collect and process personal data in line with Uganda’s Data Protection and Privacy Act, 2019 (the “Act”) and its regulations, which are administered by the Personal Data Protection Office (PDPO) under the National Information Technology Authority — Uganda (NITA-U). This page explains how those protections apply to your use of Crib.

1. Our role

For data your organisation enters into Crib about its properties, tenants, and staff (“Customer Data”), your organisation acts as the data controller and Crib (operated by GeoBox Digital Services (U) Ltd) acts as the data processor, handling that data only on your organisation’s instructions and as described in our Privacy Policy. For account and billing data relating directly to your use of our Service, Crib acts as the data controller and, where required, the registered data collector under the Act.

2. Lawful collection and use

In line with the Act’s principles, we collect personal data for specified, clearly stated purposes, only to the extent necessary to provide and improve the Service, and we do not process it in a way that is incompatible with those purposes. We process personal data on the basis of: performing our contract with you (running the Service you’ve signed up for), our legitimate business interests (such as keeping the Service secure), compliance with legal obligations (such as financial record-keeping), and, where applicable, your consent.

3. Your rights

Under the Act, you have the right to:

  • Access the personal data we hold about you;
  • Correct or update personal data that is inaccurate, out of date, incomplete, or misleading;
  • Object to the collection or processing of your personal data on reasonable grounds;
  • Request deletion of personal data that we are no longer authorised to retain, subject to legal record-keeping requirements; and
  • Be informed of the purpose for which your personal data is being collected, and whether it will be shared with third parties.

To exercise any of these rights, contact us through the “Email us” or “WhatsApp Us” links in the site footer. If your organisation entered the data on your behalf (for example, your landlord or property manager), we may direct your request to them as the data controller.

4. Cross-border data transfers

Where personal data is transferred or stored outside Uganda (for example, with our hosting or service providers), we take steps consistent with the Act’s requirements to ensure the data remains subject to a comparable standard of protection, including appropriate contractual safeguards with our processors.

5. Data protection by design

We apply role-based access controls, encryption, and audit logging across the Service, and we collect only the personal data that is necessary to provide and improve it — see our Privacy Policy for details on what we collect, how long we keep it, and how we secure it.

6. International users

Crib is built primarily for the Ugandan and wider African market, but some of our users — or the people whose data they manage — may be connected to other jurisdictions, including the European Union or European Economic Area. Where that is the case, we aim to handle personal data in a manner consistent with internationally recognised standards, including the principles of the EU General Data Protection Regulation (“GDPR”), in addition to our obligations under Ugandan law.

7. Contact us

Questions about how we handle your personal data, or wish to exercise your rights under the Act? Reach us through the “Email us” or “WhatsApp Us” links in the site footer. You may also have the right to lodge a complaint with the Personal Data Protection Office (PDPO) in Uganda.