Effective date: 29 September 2026
Webmailex is a branded webmail access service. It lets people sign in to an email mailbox that already exists on their own organisation's mail server (hosted with Namecheap, Bluehost, Hostinger or a similar provider) through one simple, secure page, instead of remembering a different address for every provider.
This policy explains what information we handle to provide that service, in line with Uganda's Data Protection and Privacy Act, 2019, and the Data Protection and Privacy Regulations, 2021.
Who we are
Webmailex is operated by Waesta Enterprises U Ltd, a company registered in Uganda and registered with the Personal Data Protection Office under the Data Protection and Privacy Act, 2019.
Registered address: Desert Tree Hostel, Banda, Kampala, Uganda
Data protection contact: [email protected]
What we collect, and why
- Your email address (as your sign-in username). Used only to work out which mail server to connect you to, and, once you're signed in, to apply your organisation's branding to the page you see.
- Your mailbox password. We do not store it. It is sent, over an encrypted connection, straight to your own organisation's mail server to check it's correct. We never keep a copy.
- Your mail messages, contacts and folders. These stay on your organisation's own mail server. While you are signed in, some of it is temporarily cached on our server purely to make the inbox load faster, and that cache is tied to your session.
- IP address. Kept briefly to detect and block repeated failed sign-in attempts (protecting your account from guessing attacks), and recorded in a short security log for administrator actions.
- Session cookies. Needed to keep you signed in as you move between pages. They are not used for advertising or tracking.
- Administrator activity. If you are an administrator of this system, actions you take (adding a domain, changing a brand, signing in) are logged with your admin username, the action, and your IP address, so there is an audit trail of changes to the system.
Legal basis for processing
We process this information because it is necessary to provide the email access service your organisation has asked us to provide (performance of a service), and because we have a legitimate interest in keeping the service secure (for example, blocking repeated failed sign-in attempts and keeping an audit trail of administrative changes).
Where data is processed
This service runs on shared hosting infrastructure that may be located outside Uganda. Your mail itself continues to be hosted by your own organisation's chosen provider, which may also be outside Uganda. Where personal data is transferred across borders, we take reasonable steps to ensure it continues to receive an appropriate level of protection.
How long we keep it
- Sign-in sessions end automatically after a period of inactivity, or when you sign out.
- Security logs (failed sign-in attempts) are kept only briefly, long enough to enforce rate limits, then cleared.
- Administrator audit log entries are kept for as long as reasonably needed for security and accountability, and can be reviewed on request.
Who we share it with
We do not sell or rent personal data. Information is only shared with:
- Your own organisation's mail server, to authenticate you and deliver your mail (this is the whole purpose of the service).
- Our infrastructure providers (web hosting and Cloudflare, used for security and performance), acting only on our instructions.
- Authorities, where we are required to by Ugandan law.
Your rights
Under the Data Protection and Privacy Act, 2019, you have the right to ask us what personal data we hold about you, to have inaccurate data corrected, to ask us to delete data we no longer need, to object to certain processing, and to lodge a complaint with the Personal Data Protection Office (NITA-U) if you believe your rights have been breached. To exercise any of these, contact [email protected].
Security
Connections to this site and to your mail server are encrypted. Passwords are never stored. Administrator access is protected by rate-limited sign-in and an audit log. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
Children
This service is intended for use by working adults accessing business email accounts and is not directed at children.
Changes to this policy
We may update this page from time to time. The effective date above will change when we do.