Privacy Policy

Effective date: 9 October 2026. Santon Aura Fashions operates SantonViva. This notice covers santonviva.com, the SantonViva mobile app, marketplace accounts, purchases, seller services, support and Lexa AI where available.

1 Contact and responsibility

For a privacy request or complaint, contact sales@santonviva.com with the subject Privacy request, or call +256 700 948 008. Identify the account or order concerned without sending a password, PIN or one-time code. Santon Aura Fashions is responsible for the processing it determines. Independent sellers, payment providers and other organisations may also have their own legal responsibilities for their separate processing.

2 Information involved

Information you provide can include your name, account username, email, phone number, delivery address, order details, messages, reviews and marketing choices. Seller onboarding may require business, verification and payout details relevant to operating a seller account. Payment records can include the amount, status, reference and limited payer information supplied by the provider. Enter full card credentials and Mobile Money authorisations only in the authorised payment-provider flow.

The website and its services can receive IP address, browser and device details, usage events, cookies and similar identifiers. An address you enter for delivery is different from precise device location; any request for device location should explain the purpose and use the relevant permission process. Public reviews and seller listings are visible to others, so do not include private customer information in them.

3 Why information is used

We use relevant information to create and administer accounts, process orders and payments, arrange delivery and returns, resolve support requests, verify sellers, prevent and investigate misuse, maintain service security and keep records required by law. Optional marketing and optional tracking require the choices and legal permissions applicable to that activity. We do not treat acceptance of purchase terms as consent to every use of personal data.

Processing must have a basis permitted by Uganda's Data Protection and Privacy Act, including consent where required or an applicable exception such as steps for a requested contract or compliance with a legal obligation. We must collect only information reasonably needed for the identified purpose and explain materially different uses before carrying them out where required.

4 Sellers delivery and service providers

The seller handling your order and the delivery provider may receive the name, contact details, delivery location, ordered items and instructions needed to fulfil or resolve it. Sellers must not reuse customer details for unrelated marketing or sell those details. Payment providers, including Flutterwave where used, process payments and related fraud or dispute information. Hosting, security, communication and analytics providers support the relevant services; their involvement depends on the feature used and applicable settings.

Information may also be disclosed where lawfully required to an authority or court, or to professional advisers handling a genuine legal matter under appropriate confidentiality. Any proposed business transfer involving personal data must have a lawful basis and appropriate safeguards. Sharing is limited to what is necessary for the relevant purpose.

5 Lexa AI and the mobile app

The SantonViva app displays marketplace web content, so the website's account, checkout, cookie and third-party processing can apply inside the app. Uninstalling the app does not automatically delete a marketplace account.

Lexa is an AI assistant using Google Gemini. If you choose to use it, your messages may be sent to Google to generate an answer and conversation information may be stored by the service or on your device. Provider processing and retention depend on the service terms and configuration. Do not enter passwords, PINs, identification documents, payment credentials, sensitive health information or another person's confidential data. Use ordinary support for account, payment and privacy matters. AI output can be inaccurate and does not itself decide an order, refund or legal entitlement.

6 Cookies and marketing choices

See the Cookie Policy for cookies, local storage and browser controls. Essential storage supports functions such as login, shopping baskets and security. Optional analytics or marketing technologies must be used with the permissions required by law. You may unsubscribe from promotional messages or ask us to stop marketing without charge. This does not stop essential order, security or service messages. Withdrawing consent affects future consent-based processing and does not make earlier lawful processing unlawful.

7 Processing outside Uganda

Some technology providers may process information outside Uganda. Such processing must meet Uganda's transfer requirements: adequate protection equivalent to the Act, or the data subject's consent where relied on under the law. Further transfer or processing in another country requires the applicable express consent under the Regulations. A provider contract alone is not a statement that every country is approved. Contact us for information about the providers and destinations relevant to your data.

8 Keeping and deleting records

Account information is kept while needed to operate the account and handle legitimate outstanding matters. Order, payment and accounting records may need to be retained after account closure to comply with tax and other legal requirements; applicable tax records generally require at least five years, and an audit or dispute may require longer. Support, security and AI records should be kept only for their justified purpose and period. We will explain the relevant retention basis when handling a request.

Account deletion removes or anonymises information that is no longer needed, while records that must lawfully be retained are restricted to their continuing purpose. Backups may retain residual copies until their retention cycle expires; they should not be used to restore deleted data to ordinary use. We do not promise that uninstalling the app instantly erases every record held by a seller, payment provider or backup service.

9 Security

We use reasonable organisational and technical measures to reduce unauthorised access, misuse, loss and disclosure. No system is completely risk-free. Protect your login and payment credentials and report suspicious activity promptly. We will handle a personal-data breach and any required notifications under Uganda law. This notice does not transfer our security responsibilities to you.

10 Your requests and complaints

You may request access, correction or deletion where the law provides it, object to incompatible processing or direct marketing, withdraw consent for consent-based processing, and raise concerns about a significant decision based solely on automated processing. We may need proportionate identity verification and will explain any lawful limitation or refusal.

Uganda's Regulations require written decisions on access requests and specified correction or deletion requests within seven days of receipt. Other rights have different statutory periods, including fourteen days for responses concerning incompatible processing and certain automated decisions. We will apply the period relevant to your request, not a single blanket thirty-day waiting period. Legal record-retention obligations can limit deletion, but do not justify keeping unrelated information indefinitely.

To close your account, use the instructions on the Delete Your SantonViva Account page or contact support. You may complain to Uganda's Personal Data Protection Office at pdpo.go.ug. Contacting us first can help resolve a concern but does not remove your right to approach the regulator.

11 Children and changes

The marketplace is intended for users with capacity to transact. A parent or guardian should handle a purchase for a child. Do not submit children's personal data unless necessary for a lawful purpose and with the permissions required by law. Contact us if a child has supplied information inappropriately so we can assess and address it.

We will publish changes with an effective date and provide any additional notice or consent process required for a material change. An updated notice does not authorise unrelated retrospective use of personal data.

Business location: Naggalama, Uganda. SantonViva operates online. Contact Santon Aura Fashions at sales@santonviva.com or +256 700 948 008.