Loading
What personal data Kaawa collects, why, who sees it, and the rights you have. Farmer data is covered in its own section.
Last updated 30 October 2026
Kaawa runs kaawa.ug and the Kaawa platform, which helps Ugandan coffee exporters map the gardens they buy from, screen them, keep a chain of custody and file Due Diligence Statements. In this notice “we” means Kaawa [LEGAL REVIEW: registered legal name, Delaware entity number, registered address, and our EU representative under GDPR Article 27].
Questions about this notice or your data go to [email protected].
We are the controller of personal data about people who visit this website, ask for a quote or a demo, hold an account with us, or work for a survey partner.
We are a processor for the farmer and supplier records an exporter puts into the platform. The exporter decides why and how that data is used and is its controller; we act only on their instructions, under our data processing agreement. If you are a farmer or supplier, the exporter you sell to is your first point of contact.
Farmer personal data collected in Uganda flows into an EU regulatory system, so we apply the GDPR to it from the first record. On behalf of exporters we hold farmer names, plot boundaries, land-tenure documents, photographs and attestations. We protect them as follows:
When a statement is filed, its contents go to the European Commission's TRACES system, where the Commission processes them under Regulation (EU) 2018/1725.
We never sell farmer-level data and we do not trade on aggregated supply intelligence. That commitment is a term of our contract, not only of this notice (see our Terms).
We do not sell personal data.
Data moves between Uganda, the European Union and the United States. Where a transfer needs a safeguard under the GDPR, we use the European Commission's standard contractual clauses or another lawful mechanism [LEGAL REVIEW: mechanisms per transfer and the transfer impact assessment].
Compliance records, including statements, the evidence behind them and the custody ledger, are kept for five years and then deleted, in line with the EUDR's record-keeping period. Account data is kept for as long as the account is open, then for the period our legal obligations require. Enquiries that do not lead to a contract are deleted after 24 months [LEGAL REVIEW: confirm each period].
You can ask to access, correct or delete your data, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent you gave us. Write to [email protected] and we will reply within one month. If your data was given to us by an exporter, we will pass your request to them and help them answer it.
You can also complain to a data protection supervisory authority [LEGAL REVIEW: lead authority and Uganda's Personal Data Protection Office].
Each organisation's data is isolated in the database, access is logged, and support impersonation leaves an audit record the organisation's admins can read. Our Security & trust page lists our certification status as it really is.
We use cookies that are strictly necessary to sign you in and keep your session secure. We do not use advertising cookies. If we add analytics, we will ask before setting any non-essential cookie [LEGAL REVIEW].
When we change this notice we update the date at the top of the page. If a change materially affects how we use your data, we tell account holders by email first.