Compliance & Regulatory Standards

We prioritize the protection of personal and business data in line with global and regional standards:

• Uganda Data Protection and Privacy Act, 2019 (DPPA) and associated Regulations – including mandatory registration with the Personal Data Protection Office (PDPO)
• General Data Protection Regulation (GDPR) – for processing data of EU/EEA data subjects, with appropriate safeguards for international transfers (e.g., Standard Contractual Clauses)
• Other African data protection laws, such as Kenya Data Protection Act, Nigeria Data Protection Act, Rwanda Law N° 058/2021, and similar frameworks in jurisdictions where we operate
• Principles of lawfulness, fairness, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability

We maintain a robust security posture to protect the confidentiality, integrity, and availability of platform data:

• Alignment with ISO 27001 information security management principles
• SOC 2 Type II readiness (or equivalent independent attestation) focusing on security, availability, processing integrity, confidentiality, and privacy
• Implementation of encryption, multi-factor authentication (MFA), role-based access control (RBAC), and secure development lifecycle (SDLC)
• Regular penetration testing, vulnerability scanning, and security audits by independent experts
• Incident response plan, business continuity, and disaster recovery procedures
• Protection against DDoS, malware, and unauthorized access through services such as Cloudflare and advanced monitoring tools

We maintain a zero-tolerance policy toward bribery, corruption, facilitation payments, and conflicts of interest:

• Adherence to the Uganda Anti-Corruption Act
• Alignment with UK Bribery Act 2010, U.S. Foreign Corrupt Practices Act (FCPA), and OECD Anti-Bribery Convention standards
• Mandatory ABC training and annual certifications for all staff and relevant third parties
• Due diligence procedures for high-risk transactions, gifts, hospitality, and third-party relationships
• Clear whistleblower protections and confidential reporting channels

As a platform facilitating international B2B trade:

• Screening of users, suppliers, and transactions against global sanctions lists (UN, EU, US OFAC, UK, and others)
• Compliance with export control regulations and restricted goods/prohibited items policies
• Know Your Customer (KYC), Know Your Supplier (KYS), and enhanced due diligence for high-risk jurisdictions or entities
• Anti-money laundering and counter-terrorism financing measures in line with Financial Action Task Force (FATF) recommendations and local laws
• Support for users in meeting their own regulatory obligations through audit-ready documentation and compliance records

We help businesses achieve procurement excellence by enforcing:

• Automated approval workflows and spending controls to prevent maverick spend
• Contract lifecycle management with built-in compliance checks (terms, pricing, delivery, quality)
• Supplier qualification, onboarding, and ongoing monitoring, including verification of certifications, insurance, and regulatory compliance
• Immutable audit trails for all procurement actions (requisitions, POs, invoices, receipts)
• Enforcement of internal purchasing policies, preferred supplier lists, and budget thresholds

• Respect for third-party trademarks, patents, copyrights, and trade secrets
• Mechanisms for reporting and addressing IP infringements (notice-and-takedown processes)
• Protection of SouthCaravan's own IP assets
• Policies prohibiting upload or distribution of infringing or counterfeit materials

We promote responsible sourcing and support users in meeting their ESG goals:

• Encouragement of supplier disclosures on labor standards, human rights, environmental impact, and diversity
• Features to track and report on sustainable procurement practices
• Alignment with emerging regulations such as Corporate Sustainability Reporting Directive (CSRD) principles where relevant
• Commitment to ethical labor practices and avoidance of forced labor, child labor, or unsafe working conditions in supply chains

• Compliance with VAT/GST, digital services taxes, and invoicing requirements across operating jurisdictions
• Secure payment processing in line with PCI DSS standards (where payments are facilitated)
• Adherence to financial reporting standards (e.g., IFRS where applicable)
• Strong Customer Authentication (SCA) and fraud prevention measures

• Commitment to Web Content Accessibility Guidelines (WCAG 2.1 Level AA or higher)
• Ongoing efforts to ensure the platform is usable by individuals with disabilities, supporting diverse business users across regions

Depending on user sectors (e.g., healthcare, finance, government procurement), we support compliance with additional frameworks such as HIPAA principles (where relevant) or public procurement rules. We do not process health data as a core function but maintain controls to prevent unintended collection.