Data processing agreement

1. Parties and scope

This agreement forms part of the Terms between Kaawa [LEGAL REVIEW: registered legal name and address] (the processor) and the organisation using the Platform (the customer, the controller). It applies whenever Kaawa processes personal data on the customer's behalf. Where it conflicts with the Terms on data protection, this agreement wins.

2. Details of the processing

• Subject matter and purpose: providing the Platform, meaning supplier onboarding, garden mapping, forest screening, contest cases, chain of custody, Statement filing and sharing with buyers.
• Duration: for as long as the Terms last, plus the retention period in section 9.
• Data subjects: farmers and other suppliers, their household or group members where recorded, and the customer's staff.
• Categories of data: names; contact details; national ID numbers (stored only as salted hashes); plot locations and boundaries; land-tenure documents; photographs; voice or written attestations; delivery records.
• Special categories: none are intended [LEGAL REVIEW: confirm, given photographs and attestations].

3. What Kaawa commits to

• Process personal data only on the customer's documented instructions, which are these Terms and the customer's use of the Platform, unless the law requires otherwise; we will tell the customer if we believe an instruction breaks the law.
• Make sure everyone who can access the data is bound by confidentiality.
• Keep the security measures in section 4 in place.
• Help the customer answer data subject requests and carry out impact assessments and prior consultations.
• Tell the customer about a personal data breach without undue delay, with the information they need to meet their own obligations [LEGAL REVIEW: fixed notification deadline].
• Make available the information needed to show we comply, and allow audits on reasonable notice [LEGAL REVIEW: audit frequency and cost].

4. Security measures

• Each organisation's data is isolated by row-level security in the database.
• Farmer names are encrypted at rest, and national IDs are stored only as salted hashes.
• Access is role-based; filing authority is restricted to Org Admins unless granted to a named member.
• Support impersonation and every Tier 2 and Tier 3 disclosure are logged, and the customer can read the logs.
• Records are hash-chained and kept immutable for the retention period.

5. Sub-processors

The customer authorises Kaawa to use sub-processors for hosting, email, payments and monitoring, and Survey Partners for field work. Each is bound by written terms at least as protective as this agreement, and Kaawa remains responsible for them. We keep a current list and tell the customer before adding or replacing one, so they can object on reasonable data protection grounds [LEGAL REVIEW: the list, the notice period and the objection process].

Survey Partners see only the gardens in their assigned jobs: farmer names, locations and job instructions. They never see the customer's volumes, prices, buyers or other suppliers.

6. Disclosure to buyers and authorities

Kaawa discloses data to buyers only at the tier the customer sets on a share link. It submits Statements to TRACES as the customer's agent, where the European Commission processes them as a separate controller under Regulation (EU) 2018/1725. We disclose data to other authorities only when the law requires it, and tell the customer first unless the law forbids it.

7. No sale of farmer data

Kaawa will never sell farmer-level data or trade on aggregated supply intelligence, as set out in the Farmer data clause of the Terms.

8. International transfers

Where personal data leaves the European Economic Area, or is sent to it from Uganda, Kaawa relies on the European Commission's standard contractual clauses or another lawful transfer mechanism [LEGAL REVIEW: modules, the annexes and Uganda's Data Protection and Privacy Act 2019].

9. Retention, return and deletion

Compliance records are kept for five years from the Statement they support, as the EUDR requires, and then deleted. When the Terms end, the customer can export their data; Kaawa deletes the rest within 90 days, except where the law requires us to keep it [LEGAL REVIEW: confirm periods].

10. Liability

[LEGAL REVIEW: how the Terms' liability provisions apply to this agreement.]

11. Contact

Data protection questions go to [email protected].