Privacy Policy
Last updated 26 October 2026
Draft under review. This text is a draft and is still being reviewed. It may change before RadiusOne starts taking real payments.
1. Who we are
RadiusOne is a billing and Wi-Fi login platform for internet service providers (ISPs). It is operated by Imara Systems Limited (“RadiusOne”, “we”, “us”).
This policy explains what personal data the platform handles, why, who receives it, how long it is kept, and what your rights are. It follows Uganda’s Data Protection and Privacy Act, 2019 and the Data Protection and Privacy Regulations, 2021.
It covers:
- ISP staff and agents who use the RadiusOne dashboard;
- ISP customers: PPPoE subscribers and other customers an ISP enters in RadiusOne;
- hotspot users: people who log in to a hotspot that uses RadiusOne, or buy a voucher on its page;
- website visitors and people who contact us.
Questions about privacy: privacy@radiusone.africa.
2. Our role, and the ISP’s role
| Whose data | Who decides how it is used (controller) | Our role |
|---|---|---|
| ISP staff and agents, and the ISP’s account | RadiusOne | Controller |
| ISP customers and hotspot users | The ISP | Processor: we handle the data for the ISP, on its instructions |
| Mobile money payment records | The ISP, and RadiusOne for its own legal and payment-provider duties | Processor for the ISP, and controller for those duties |
| Website visitors and people who contact us | RadiusOne | Controller |
If you are a customer of an ISP, the ISP is your first contact for questions about your data. Its name is on the hotspot page, on your invoices and in its emails. You may also contact us and we will pass your request to the ISP or help it answer.
3. What we collect
3.1 ISP staff and agents
- Name, email address and phone number. Either one can be the login.
- Your password, stored only as a one-way hash that cannot be turned back into the password.
- Your role and the ISP or organisation you belong to.
- Records of what you do in the dashboard: who did what, to which record, when, from which IP address, and what changed. This is the audit log. It never records passwords or other secrets.
- Login sessions, and failed login attempts counted per account and per IP address.
- For self-registration: the ISP name, country, administrator name, email address, the IP address the form came from, and the time.
- For agents: the vouchers you sold, your float and your commission.
- For withdrawals: the mobile money number, its operator and the owner’s name, and who verified it.
- Documents for business checks (KYB): business registration documents and identity documents of directors and owners.
3.2 ISP customers (PPPoE and others)
The ISP enters this data, not us:
- name, phone number, email address, physical address and notes;
- customer code, subscriptions, packages and invoices;
- payments: cash payments recorded by staff, and mobile money payments with the paying number;
- login name and password for the internet connection. The password is stored encrypted;
- emails sent to the customer: invoices, reminders and cut-off notices, with their delivery status.
3.3 Hotspot users and voucher buyers
- When you buy a voucher or pay an invoice with mobile money: the phone number you pay from, the mobile money operator, the amount, the package, the transaction ID from the payment provider, the payment result and time, and your device’s hardware (MAC) address when the router passes it on. If you buy for someone else, also their phone number.
- Your voucher code, which is your login name and password at the same time.
- When you use the internet: the start and end of each session, its length, the data you upload and download, your device’s MAC address, the IP address the router gives your device, the router or access point, and why the session ended. The platform does not record which websites you visit or what you do online.
- When a login fails: the name or voucher code that was typed, the device’s MAC address, the reason, how many times it failed, and when. Failed logins are grouped by hour.
- SMS: if the ISP turns on SMS, the phone number and text of each SMS sent. This is not in use yet.
3.4 Website visitors and people who contact us
- The website does not use analytics or advertising cookies. Our hosting provider (Cloudflare) processes your IP address and browser details to deliver the pages and protect them from attacks.
- If you email, phone or message us, we keep your contact details and what you tell us.
4. Why we use it, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the platform to ISPs: accounts, logins, routers, vouchers, billing, wallet | ISP staff and account data | Contract with the ISP |
| Logging customers in, applying their package limits, and keeping usage records | Session, usage and login data | Contract between the ISP and its customer; we act for the ISP |
| Taking mobile money payments and paying ISPs | Payment records, phone numbers, withdrawal numbers | Contract; legal obligations; our obligations to pawaPay |
| Sending invoices, reminders and notices | Customer name, email, invoice details | Contract between the ISP and its customer; we act for the ISP |
| Helping buyers recover a lost voucher code | Paying phone number, transaction ID | Contract between the ISP and the buyer; we act for the ISP |
| Checking ISPs’ identity (KYB) and preventing fraud and money laundering | KYB documents, payment records | Legal obligations; our obligations to pawaPay |
| Security: audit log, failed-login records, limits on repeated attempts | IP addresses, login and audit records | Contract; our legal duty to keep personal data secure |
| Answering questions and complaints | Contact details and messages | Your request; contract |
We do not sell personal data. We do not use ISP customers’ or hotspot users’ data for our own marketing.
The platform makes some decisions automatically as part of the service, for example accepting or refusing a login, or stopping new voucher batches when an ISP is past its wallet limit. These decisions follow the rules of the contract. You can ask a person to look at a decision that affects you.
5. Who receives the data
| Recipient | What they receive | Why |
|---|---|---|
| The ISP | Data about its own staff, customers, hotspot users, sales and payments | It runs its internet service and is the controller of its customers’ data |
| pawaPay, its local payment partner in Uganda, and the mobile money operators (such as MTN and Airtel) | Paying phone number, amount, ISP name, transaction details; withdrawal numbers and owner names; ISP KYB documents | To collect and send mobile money, and for their own legal checks |
| Africa’s Talking | Phone number and text of each SMS, when SMS is used | To deliver SMS |
| Resend | Email address, name and content of each email | To deliver emails such as invoices and password links |
| Vultr | All platform data, stored on our server | Hosting, in Johannesburg, South Africa |
| Cloudflare | Encrypted database backups; DNS lookups; website visits | Backup storage, DNS, and website hosting |
| Our technical operator | All platform data, when needed | The developer who builds and runs the platform for us, based in Indonesia |
| Authorities | What the law requires | When a law, court or regulator requires it |
RadiusOne staff who support ISPs can see an ISP’s data when they need it to help. The audit log shows ISP administrators the names and roles of RadiusOne staff who acted in their account.
6. Data outside Uganda
The platform runs outside Uganda:
- South Africa: our server and its backup images (Vultr, Johannesburg).
- Western Europe: encrypted database backups (Cloudflare R2).
- Indonesia: our technical operator works on the servers from there.
- United States and Ireland: Resend stores email logs in the United States and sends email from Ireland.
- Other countries: pawaPay, Africa’s Talking, Cloudflare and Vultr may process data in other countries where they operate.
Ugandan law allows this where the other country protects personal data at least as well as Ugandan law, or where you have consented. We choose providers that protect data under their own laws and contracts, and we limit what each one receives to what it needs.
7. How long we keep it
| Data | How long |
|---|---|
| Failed login records | 30 days, then deleted automatically |
| Dashboard login sessions | They stop working after 30 days, or earlier at logout or password change |
| Audit log | Kept for the whole pilot. A deletion rule will be set after the pilot |
| Records of mobile money payments | As long as the law and our payment provider require. Our agreement with pawaPay requires us to keep them for 10 years |
| Database backups | Backups let us restore the database to any point in at least the last four weeks. Older backups are removed automatically. Server backup images are replaced daily, and only the last two are kept |
| Everything else | For as long as needed to provide the service and to meet legal obligations |
When an ISP leaves RadiusOne, we delete or return its customers’ data on its request, except what the law or our payment provider requires us to keep. Copies in backups are removed as the backups expire.
8. How we protect it
- The dashboard and API work only over encrypted connections (HTTPS).
- Passwords are stored as one-way hashes (Argon2id).
- Internet login passwords for customers, and keys for payment, SMS and email providers, are stored encrypted (AES-256-GCM).
- The database accepts connections only from inside the server. The server has a firewall, and remote login to it is limited to one named administrator using a key.
- Database backups are encrypted before they leave the server, and are stored with a different company from our hosting provider.
- Each ISP sees only its own data. The database enforces this as well as the software.
- Staff roles limit who can see and change what. Actions that move money ask for the password again, and withdrawal numbers must be verified by our staff.
- The audit log records actions taken in the dashboard and cannot be edited from it.
- Accounts are locked for a short time after repeated failed logins, and repeated attempts from one address are limited.
Some steps happen outside our systems. For example, hotspot logins travel over the ISP’s own Wi-Fi network and router, which we do not control. Many hotspots are open Wi-Fi networks, so treat your voucher code like cash.
If we learn that personal data has been accessed without permission, we will notify the Personal Data Protection Office as the law requires, and tell affected ISPs without undue delay.
9. Your rights
Under Ugandan law you have the right to:
- ask whether we hold data about you, get a description of it, and know who has received it;
- ask us to correct data that is wrong, incomplete or out of date;
- ask us to delete data that is no longer needed or was collected unlawfully;
- ask us to stop processing that causes you substantial damage or distress;
- ask us to stop using your data for direct marketing;
- ask that a decision that significantly affects you is not made only by automatic means;
- complain to the Personal Data Protection Office.
How to ask. Write to privacy@radiusone.africa. Tell us who you are and which ISP or account your request is about. We may ask for proof of identity before we answer. For a hotspot purchase, the paying phone number and transaction ID help us find the record.
If you are an ISP customer, we may pass your request to the ISP, because it is the controller of your data. We will help the ISP answer.
We answer requests to see your data within 30 days, and other requests within the time the law sets. If we cannot do what you ask, for example because the law requires us to keep a payment record, we will tell you why in writing.
10. Children
RadiusOne is a service for businesses. ISPs must not enter data about children without the consent of a parent or guardian, unless the law allows it. Hotspot services are run by ISPs, and ISPs are responsible for the rules about who may use them.
11. Cookies
- Dashboard: one cookie keeps you logged in. It is needed for the dashboard to work. The dashboard also stores your language and the last organisation you opened in your browser’s local storage.
- Hotspot and payment pages: no cookies.
- This website: no analytics or advertising cookies.
12. Complaints
If you are not happy with how we handle your data, contact us first at privacy@radiusone.africa. You can also complain to the Personal Data Protection Office (PDPO), part of the National Information Technology Authority – Uganda (NITA-U), at https://pdpo.go.ug.
13. Changes to this policy
We will update this policy when the platform or the law changes. The date at the top shows the latest version. If a change matters to ISPs, we will tell them by email or in the dashboard before it takes effect.
14. Contact
- Imara Systems Limited
- Privacy: privacy@radiusone.africa
- Support: support@radiusone.africa, +256 770 495 640