Privacy notice

1. Who we are

HAGRO Trading Limited is a company registered in the Republic of Kenya, with its registered office at Bemuda Plaza, Ngong Road, Nairobi. For the purposes of the Data Protection Act 2019, HAGRO Trading Limited is the data controller for the personal data described in this notice.

Our data protection contact is the Director of Legal, Compliance and Data Protection, reachable at hello@hagrotrading.com.

HAGRO Trading Limited is registered in Kenya under company number CPR/2013/105580, with its registered office at Bemuda Plaza, Ngong Road, Nairobi.

2. The personal data we collect

2.1 Website visitors

• Information you provide through our contact and subscription forms: your name, organisation, email address, telephone number and the content of your message
• Technical information collected automatically by our hosting provider, which may include internet protocol address, browser type and pages visited

2.2 Clients, partners and suppliers

• Business contact details for the individuals we work with at client, partner and supplier organisations
• Contractual and payment information necessary to deliver and invoice our services

2.3 Farmers and programme participants

This is the category we treat with the greatest care. Depending on the assignment, we may collect:

• Name, contact details and location, including county, ward and in some cases farm coordinates
• Household and demographic information where a funder requires it for targeting or reporting
• Farm enterprise data, including land size, production volumes, input costs, prices received and income
• Photographs, video and audio recordings where an individual has agreed to appear in documentary or communications material

Consent is specific. Agreeing to appear in a documentary is not agreement to have farm financial data included in a research dataset, and the reverse is also true. We seek and record consent separately for each purpose, in a language the person understands, and we explain who will see the data before it is collected.

3. Why we process personal data, and on what basis

4. Who we share personal data with

We do not sell personal data. We share it only where necessary and only with:

• Clients and funders, where an assignment requires it. Wherever a purpose can be met with aggregated or de identified data, we share it in that form instead.
• Service providers who help us operate, such as our website host, email provider and survey tools, under contracts that require them to protect the data.
• Regulators, auditors and authorities, where we are legally required to do so.

Our website is hosted by HostPinnacle and our email runs on Microsoft 365. Submissions from our contact and subscription forms are processed on our own server and delivered to those mailboxes; we do not use a third party marketing platform. Where an assignment uses a survey or data collection platform, that platform is named in the assignment agreement and in the consent given at the point of collection.

5. Transfers outside Kenya

Some of our service providers store data outside Kenya. Where personal data is transferred outside the country we take the steps required by the Data Protection Act 2019, including satisfying ourselves that appropriate safeguards are in place, and, where the Act requires it, obtaining consent for the transfer.

6. How long we keep it

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.

• Enquiry correspondence: 24 months from your last contact with us, unless the correspondence becomes part of a client record
• Client and contract records: seven years after the end of the contract, which is the period Kenyan tax and company law requires us to keep the records
• Research and programme datasets: for the period set in the assignment agreement. Where the agreement is silent, identifying information is deleted within 24 months of the assignment closing and only de identified data is kept
• Documentary footage: for as long as the material remains published, on the basis of the consent given at the time. Consent can be withdrawn, and we will remove the material from the channels we control

7. Your rights

Under the Data Protection Act 2019 you have the right to:

• Be informed of how your personal data is being used
• Access the personal data we hold about you
• Object to the processing of your personal data
• Have inaccurate or misleading personal data corrected
• Request deletion of false or misleading personal data
• Withdraw consent at any time, where consent is the basis on which we process

To exercise any of these rights, contact hello@hagrotrading.com. We respond within the period the Act requires. If you are not satisfied with our response you may complain to the Office of the Data Protection Commissioner of Kenya.

8. How we protect personal data

We apply access controls, device and account security, and staff training proportionate to the sensitivity of the data. Farmer datasets that contain identifying information are stored separately from analysis files wherever the assignment permits, and are shared in de identified form by default.

Personal data is held on access controlled systems. Accounts are individual rather than shared, access is limited to the people who need it for the assignment in hand, and access is withdrawn when an assignment ends or a person leaves. Devices used to collect data in the field are encrypted and passcode protected. Data in transit to and from this website is protected by TLS. Backups are taken regularly and held separately from the working systems. Where we become aware of a breach that is likely to result in harm, we investigate immediately, notify the Office of the Data Protection Commissioner within 72 hours as the Act requires, and inform the people affected where the law requires it.

9. Cookies

This website sets no analytics, advertising or tracking cookies, so there is no consent banner and nothing for you to dismiss. Our briefings blog sets a session cookie only for members of staff who sign in to publish. Our pages load two typefaces from Google Fonts, which means your browser makes a request to Google servers to fetch them; we do not use that request to identify you and we receive nothing from it.

10. Changes to this notice

We update this notice when our practices change. The version and date at the top of this page tell you which version you are reading.

11. Contact

HAGRO Trading Limited, Bemuda Plaza, Ngong Road, Nairobi, Kenya.
Email: hello@hagrotrading.com
Telephone: +254 714 11 88 55