1. Who is responsible

For this website and for our own business relationships, WHSPKAH Research and Business Network Ltd., Kampala, Uganda, decides how personal data is used and is the data controller.

For farmer, farm, delivery and field-officer records held in Whstrace, the cooperative, exporter or programme that uses the platform decides why the data is collected. WHSPKAH processes that data on its behalf, under a written agreement, and follows its instructions.

2. What we collect on this website

This website has no accounts and does not ask you to register. We collect only the following.

• What you type into the contact form: your name, email address and message.
• Technical details sent with that form, such as the time of submission and a hidden spam-check field. We use them only to stop automated abuse.
• Standard server logs: your IP address, browser type, the pages requested and the time. They are kept for security and troubleshooting.
• Anything you send us by email or phone, if you contact us directly.

At the time of writing this website sets no advertising or analytics cookies. If that changes we will say so here and ask for your consent where the law requires it.

3. What we handle in consultancy and software work

When we advise or build for a client we handle the business contact details of the people we work with, such as names, work emails, phone numbers and roles, and the project material they share with us. We use it to deliver the work, manage the relationship and keep the records the law requires.

4. What the Whstrace platform processes

On behalf of the organisations that use it, Whstrace processes the records needed for traceability and EU deforestation regulation compliance. Depending on the deployment this can include:

• Farmer details: name, gender, age range, phone number, national identification number where collected, cooperative membership and bank or mobile money details used for payments.
• Farm details: location, GPS boundary points and their photos, crops, land documents and questionnaire answers.
• Supply chain records: deliveries, receipts, quality checks, grading, lots and buyers.
• Field officer and user details: name, phone number, work email, the app version used to sign in, and an audit trail of what they changed.

These records are visible only to the people the controlling organisation authorises. Field officers can see only the records they registered themselves.

5. Why we use personal data, and on what basis

• To answer your enquiry and talk to you about our services. Basis: your consent and our legitimate interest in running our business.
• To perform a contract with a client, or steps you ask for before one.
• To keep the website and our systems secure and to prevent fraud and abuse. Basis: legitimate interest.
• To meet legal duties, such as tax, accounting and requests from the authorities.
• For Whstrace records, to deliver the traceability and compliance service the controlling organisation has asked for.

We do not sell personal data. We do not use it for automated decisions that have legal effects on you.

6. Who we share it with

We share personal data only where there is a reason to, and only the part that is needed:

• Service providers that host our systems, store files, send email and text messages, and provide maps and satellite data. They may use the data only to provide their service to us.
• Our clients, for the records that belong to them.
• Buyers, certification bodies and regulators, when a client asks us to prepare traceability or due diligence evidence for them. Plot locations are shared in the form the regulation requires.
• Professional advisers, auditors and the authorities, where the law requires or allows it.

7. Transfers outside Uganda

Some of our providers store or process data outside Uganda. Where that happens we use providers that give appropriate safeguards and we limit what is sent, in line with the Data Protection and Privacy Act, 2019.

8. How long we keep it

• Contact form enquiries: until the matter is closed and normally no longer than 24 months after our last contact, unless they lead to a contract.
• Client and project records: for the life of the contract and the period the law requires afterwards.
• Whstrace records: for the period set by the controlling organisation and the EU deforestation regulation, which asks operators to keep due diligence records for five years.
• Server logs: for a short period needed for security, then deleted.

9. How we protect it

We use measures proportionate to the risk, including:

• Encrypted connections, access controls and role-based permissions.
• Hashed PINs and passwords and one-time codes for sign-in.
• An append-only, tamper-evident audit trail for changes to platform records.
• Regular backups and updates, and training for the people who handle data.

No system is perfectly secure. If a breach affecting your personal data occurs we will act quickly and notify you and the regulator where the law requires.

10. Your rights

Under the Data Protection and Privacy Act, 2019 you can:

• ask whether we hold personal data about you and receive a copy;
• ask us to correct data that is wrong or incomplete;
• ask us to delete data we no longer need or have no right to keep;
• object to processing, or ask us to restrict it;
• withdraw consent you gave, without affecting what was done before;
• complain to the Personal Data Protection Office if you believe your rights were not respected.

If your data is in Whstrace, please contact the cooperative or organisation that collected it. We will help them respond. For anything else, write to us using the details below and we will reply within a reasonable time.

11. Cookies

This website does not set advertising or analytics cookies. Your browser may store the files needed to display the pages. You can clear or block them in your browser settings.

12. Links and third-party content

This website names and links to other organisations, such as data providers and funders. We do not control their sites or how they use data. Please read their own privacy notices.

13. Children

Our website and services are for organisations and working adults. We do not knowingly collect personal data from children under 18 through this website.

14. Changes to this policy

We will update this page when our practices change and show the date at the top. Material changes will be highlighted on the home page or sent to the people affected.

15. Contact us

WHSPKAH Research and Business Network Ltd., Kampala, Uganda. Email katoabdulhakim68@gmail.com or call +256 774 139 145. Please put "Privacy" in the subject so we can route your message.