E360 operates as the data controller for all personal data processed through this IT Asset Management System. This system is deployed and managed by the IT Department in accordance with company policy and applicable data protection legislation.

This system collects and processes the following categories of personal data:

• Employee Identity Data: Full name, email address, phone number
• Device Assignment Data: Device type, model, serial number, date of assignment, date of return
• Inspection Records: Device condition checklist results at assignment and return
• Photographic Evidence: Images of device condition
• Electronic Signatures: Employee acknowledgement signatures
• Maintenance Records: Technician name, email, maintenance dates and results
• Audit Trail Data: Timestamps of all system actions

Personal data is processed on the following legal bases:

• GDPR Article 6(1)(b) — Contract: Processing necessary for performance of an employment contract (device assignment obligations)
• GDPR Article 6(1)(c) — Legal Obligation: Compliance with ISO 9001, ISO 14001, and ISO 45001 documented information requirements
• GDPR Article 6(1)(f) — Legitimate Interests: Protecting company IT assets and maintaining accurate asset records
• Uganda DPA 2019 §15: Processing necessary for performance of a contract to which the data subject is party

• All data is stored locally in the browser's localStorage on the device running this system
• No data is transmitted to any external server or third party
• Access is protected by a 6-digit PIN authentication system
• Administrator (God Mode) access is separately PIN-protected
• Activity logs are restricted to administrators only (GDPR Article 5(1)(f) — integrity & confidentiality)
• Data export (CSV backup) is available to authorised users

• Assignment and return records: Retained for the duration of employment plus 7 years (statutory requirement)
• Maintenance records: Retained for 5 years from date of maintenance
• Audit logs: Retained for 3 years or as required by applicable law
• Only Administrators may delete records, and such deletions are logged per ISO 9001 §7.5

Under GDPR and the Uganda Data Protection and Privacy Act 2019, you have the following rights:

• Right of Access (Art. 15 GDPR / §26 Uganda DPA): Request a copy of your personal data held in this system
• Right to Rectification (Art. 16 GDPR / §27 Uganda DPA): Request correction of inaccurate personal data
• Right to Erasure (Art. 17 GDPR / §29 Uganda DPA): Request deletion of your data where no legal basis for retention exists
• Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, commonly used format (CSV export)
• Right to Object (Art. 21 GDPR / §31 Uganda DPA): Object to processing based on legitimate interests
• Right to Restrict Processing (Art. 18 GDPR): Request restriction of processing in certain circumstances

To exercise any of these rights, contact your IT Administrator or Data Protection Officer.

• ISO 9001 §7.5 — Documented Information: All records are controlled documents with defined access, retention and review procedures
• ISO 14001 §8.1 — Operational Control: Environmental aspects of IT equipment lifecycle are documented
• ISO 45001 §8.1 — Operational Planning & Control: Occupational health and safety risks related to IT equipment are recorded
• ISO 9001 §7.5.3 — Control of Documented Information: Only authorised personnel (God Mode administrators) may backdate or modify records

Personal data processed by this system is not shared with any third parties, external processors, or transferred outside the organisation except where required by law. CSV backups transferred between devices should be handled in accordance with company data handling procedures.

For all data protection enquiries, contact your organisation's Data Protection Officer or IT Administrator. Complaints may also be directed to the Personal Data Protection Office of Uganda (PDPO) or the relevant supervisory authority in your jurisdiction.