top of page

Data Privacy and Protection Policy

Who We Are.

Kijani Forestry Ltd. (“Kijani,” “we,” “our,” “us”) is a private company incorporated in Uganda, building and operating digital tools to support sustainable forestry and agroecology projects.

We operate:

  • The Kijani Forestry Manager mobile application

  • Our website: https://kijaniforestry.com

  • Related APIs and data systems (together, the “Platform”).

Contact:

  • Address: Jomo Kenyatta Road, PO Box 1259, Gulu, Uganda

Email: legal@kijaniforestry.com

Scope of This Policy

This Policy explains how we collect, use, share, store, and protect your data when you:

  • Visit our website

  • Use the Kijani Forestry Manager application

  • Interact with us as a farmer, partner, supplier, or research collaborator

  • Apply for employment or consultancy with Kijani

This Policy applies to all data processing activities carried out by Kijani, regardless of your location.

Key Definitions

  • Consent: Freely given, informed, and unambiguous agreement by the data subject to the processing of their data.

  • Data: Any information collected, recorded, stored, or processed by Kijani Forestry.

  • Data Processor: Any person or entity, other than a Kijani employee, processing personal data on behalf of Kijani.

  • Data Subject: Any individual whose personal data is collected, including farmers, customers, employees, and partners.

  • Processing: Any operation performed on personal data (collection, storage, retrieval, sharing, deletion, etc.).

Principles of Data Protection

  • Kijani Forestry commits to:

  • Accountability: We are accountable for all data we collect, process, and hold.

  • Fairness & Lawfulness: We collect and process data transparently and lawfully.

  • Data Minimization: We only collect data that is necessary and relevant.

  • Retention: We keep data only as long as needed for its purpose or as required by law.

  • Data Quality: We maintain the accuracy and quality of personal data.

  • Transparency: We inform data subjects of how their data is used and allow participation in updates or corrections.

  • Security: We protect data with appropriate technical and organizational safeguards.

 Legal Bases for Collecting and Processing Personal Data

  • Kijani Forestry collects and processes personal data lawfully, fairly, and transparently under the Uganda Data Protection and Privacy Act (DPPA, Sections 7–9) and, where applicable, the EU General Data Protection Regulation (GDPR, Article 6). We rely on one or more of the following lawful bases:

  • Consent: When you have provided clear, informed, and voluntary consent for us to collect or process your personal data for specific purposes, such as capturing your GPS location for tree registration. You may withdraw your consent at any time by contacting legal@kijaniforestry.com. If you withdraw your consent, Kijani will cease processing unless there is another lawful basis for continuing.

  • Performance of a Contract: Where processing is necessary to enter into or fulfill our contractual obligations with you, such as providing, maintaining, and supporting services on the Kijani Forestry Platform, or for tree registration, payment processing, or monitoring activities.

  • Legal Obligation: Where processing is necessary to comply with applicable laws, including forestry, tax, employment, and reporting requirements.

  • Public Interest: Where processing is necessary to perform tasks carried out in the public interest, including environmental monitoring and reporting.

  • Legitimate Interests: Where processing is necessary for Kijani’s legitimate business interests, such as securing our services, improving features, conducting analytics, and preventing fraud, provided that these interests do not override your fundamental rights and freedoms.

Personal Data We Collect

  • Information You Provide Directly

  • Account Data: name, contact details, role, parish, login credentials, and profile photograph.

  • Farmer Records: demographic details, national ID numbers and scans, biometric templates (e.g., fingerprint hash if used for verification), and farming information (land size, tree counts, and group membership).

  • Garden & Forestry Data: garden names, descriptions, GPS boundary polygons, species planted, planting dates, nursery capacity, tree-survival checks, uploaded documents, and photos.

  • Activity Logs: field visit notes, operation records, document scans, and comments.

  • Support & Feedback: messages, recordings, and survey responses.

  • Recruitment Data: CVs, educational history, referees, and interview notes (for job applicants).

  • Information We Collect Automatically

  • Location Data: device GPS coordinates and accuracy metadata.

  • Device & Usage Data: device model, OS version, app version, IP address, log files, crash reports, timestamped interaction events.

  • Cookies & Similar Technologies: first-party cookies, Firebase Analytics identifiers, and push-notification tokens (see Cookies Section).

  • Information from Third Parties

  • Analytics & Infrastructure Providers: Google Firebase, Mapbox, and AWS.

  • Government & Public Sources: land registries, public agroforestry datasets.

  • Research Partners: aggregated agronomic data contributed under collaboration agreements.

  • Kijani Forestry does not intentionally collect special categories of personal data (e.g., health data) unless strictly necessary and with the explicit consent of the individual.

Commitment to Transparency and Accountability

  • Kijani Forestry is committed to collecting only adequate, relevant, and necessary personal data to achieve our intended purposes. We handle all personal data responsibly, in compliance with applicable laws, ensuring privacy and transparency throughout our operations.

Screenshot 2025-07-12 at 22.08.22.png

Decision-Making and AI Use

  • Kijani Forestry does not currently use automated decision-making systems that produce legal or similarly significant effects on individuals without human involvement.

  • If we introduce such systems in the future, including those using artificial intelligence (AI) to make decisions about payments, eligibility, or resource allocation, we will:

  • Conduct a Data Protection Impact Assessment (DPIA) to evaluate risks

  • Provide clear notice to affected individuals

  • Ensure human review of significant decisions

  • Comply with applicable data protection laws and ethical standards

  • We are committed to transparency and fairness in all automated processes and will ensure our systems respect your rights and dignity.

Data Retention

  • Kijani Forestry retains personal data only for as long as necessary to achieve the purposes for which it was collected, unless:

  • Retention is required or authorized by applicable law,

  • Retention is necessary for a lawful operational purpose (e.g., audits, legal claims),

  • Retention is required under a contract with the data subject (e.g., tree registration agreements).

  • The data subject has provided explicit consent for longer retention for specified purposes.
     

  • Retention periods are determined based on operational requirements and applicable legal regulations. Kijani periodically reviews stored personal data to ensure it remains necessary, accurate, and relevant for its intended purpose.

  • At the end of the applicable retention period, personal data will be safely deleted, destroyed, or de-identified in a manner that prevents its reconstruction or retrieval in an intelligible form. Where immediate deletion is not feasible (e.g., legal holds or technical limitations), Kijani will restrict processing and pseudonymize the data until deletion is possible.

Screenshot 2025-07-12 at 22.08.30.png

We may retain data longer where necessary to establish, exercise, or defend legal claims, or to comply with statutory obligations.

Security Measures

  • We implement:

  • Encryption in transit and at rest.

  • Role-based access control and MFA.

  • Regular vulnerability assessments and penetration tests.

  • Backups with disaster recovery plans.

  • Secure coding and network security measures.

Data Processing Outside Uganda

  • When processing or storing data outside Uganda:

  • We ensure the receiving country has adequate data protection measures, or

  • Obtain explicit consent from the data subject.

Cookies & Similar Technologies

  • Kijani Forestry uses cookies, SDKs, and local storage objects to:

  • Maintain your login session and language preference.

  • Measure Platform performance (Firebase Analytics, Google Analytics 4).

  • Deliver push notifications.

  • Protect against fraud (reCAPTCHA, Cloudflare Bot Management).

  • You can manage cookies via the in-app Cookie Settings or your browser. Disabling cookies may reduce functionality.

Sharing & Disclosure of Personal Data

  • Kijani Forestry does not sell personal data. We only share personal data in a responsible, secure, and lawful manner, as described below:

  • Group Companies & Affiliates: For purposes consistent with this Policy, under binding agreements ensuring adequate protection.

  • Service Providers & Sub-Processors: Trusted providers for cloud hosting, analytics, and communications, processing data under instructions with confidentiality and security obligations.

  • Research & Academic Institutions: Aggregated/pseudonymized environmental datasets for research or public interest projects.

  • Regulators, Courts, and Law Enforcement: As required by law.

  • Business Reorganisation: In a merger or acquisition, with privacy protections consistent with this Policy.

  • With Your Consent: For specific projects or collaborations.

  • All third parties are contractually obligated to process data securely, lawfully, and solely for specified purposes under Kijani’s instructions.

  • We collect device identifiers including:
    - Android ID for device identification
    - Firebase Analytics identifiers for usage analytics
    - Push notification tokens for app notifications
    - Crash reports and diagnostic data to improve app performance

International Data Transfers

  • Kijani primarily hosts and processes data in Uganda and within the European Economic Area ( EEA). When transferring data outside Uganda, we comply with Section 19 of the DPPA and applicable international laws to protect your data, including:

  • Ensuring equivalent protection in the destination jurisdiction, or

  • Implementing appropriate safeguards (e.g., SCCs, transfer impact assessments, encryption).

Data Security

  • We protect the confidentiality, integrity, and availability of personal data using:

  • Encryption: TLS 1.2+ in transit, AES-256 at rest.

  • Access Controls: RBAC and MFA.

  • Secure Development Lifecycle: Secure coding, code reviews, SAST/DAST, and dependency scanning.

  • Network Security: Firewalls, VPC segregation, IDS/IPS, WAF.

  • Penetration Testing & Vulnerability Management: Regular assessments and third-party testing.

  • Backup & Disaster Recovery: Encrypted off-site backups, quarterly drills.

  • Incident Response: 24/7 monitoring with an incident response plan and statutory breach notifications.

  • Security practices align with ISO 27001 and NIST Cybersecurity Framework standards.

Rights of Data Subjects

  • You have the right to:

  • Access: Confirm if we hold your data and if we can access it.

  • Correction: Request correction of inaccuracies.

  • Deletion: Request deletion when no longer needed.

  • Restriction: Request restriction under certain conditions.

  • Data Portability: Request your data in a structured, machine-readable format.

  • Objection: Object to processing based on legitimate interests or for direct marketing.

  • Withdraw Consent: Withdraw consent at any time without affecting prior lawful processing.

  • Lodge a Complaint: With Uganda’s PDPO (or contact us first for resolution).

  • To exercise these rights:

  • Email: legal@kijaniforestry.com 

  • Write to: Kijani Forestry Ltd., Jomo Kenyatta Road, PO Box 1259, Gulu, Uganda

  • We will respond within 30 days and may request identity verification.

 Marketing Communications

  • We only send marketing communications with your explicit consent. You may unsubscribe at any time via the email link or app settings. Unsubscribing will not affect essential service-related communications.

Children’s Privacy

  • Kijani does not knowingly collect personal data of individuals under 18. If we learn that such data has been collected, we will promptly delete it. Contact legal@kijaniforestry.com  if you believe this has occurred.

Changes to This Policy

  • We may update this Policy periodically. Material changes will be communicated by:

  • Posting the updated Policy on our website and app.

  • Providing at least 30 days’ notice before changes take effect.

Complaints

  • If you believe your rights have been violated, you may contact Uganda’s Personal Data Protection Office (PDPO).  We encourage you to contact us first at legal@kijaniforestry.com  for prompt resolution.

Governing Law

  • This Policy is governed by the laws of the Republic of Uganda, including the Data Protection and Privacy Act 2019 and its Regulations, and, where applicable, the GDPR and other international data protection laws.

Contact Us

  • Kijani Forestry Ltd.,
    Jomo Kenyatta Road, PO Box 1259, Gulu, Uganda
    Email: legal@kijaniforestry.com
    Website: https://kijaniforestry.com

bottom of page