Privacy notice
Last updated 10 November 2026
Who we are
GroCarbon [legal entity, registration number and address] runs this website and the GroCarbon platform. For the personal data described here, we are the controller [counsel to confirm where GroCarbon acts as a processor for its customers instead, for example households registered by a project developer].
What we hold, and why
| Whose data | What | Why |
|---|---|---|
| People with an account | Name, email address, legal name (encrypted), sign-in records | To provide the service, and to verify who acts for an organisation [legal basis: contract; legal obligation] |
| Households in a project’s benefit sharing | Name, village, phone number and mobile-money wallet (encrypted), payments made | To pay them their share of what credits earn [legal basis to be confirmed] |
| Field agents | The checks they record, with time and place | To show a project’s monitoring is real [legal basis to be confirmed] |
| People who contact us | Name, email address, phone number and message (encrypted), and the organisation and topic | To answer the enquiry and follow it up [legitimate interest] |
Who sees it
Only the people in your organisation whose role allows it, the people you choose to share with, and GroCarbon’s staff where their work needs it (verifying an organisation, reviewing a claim, or a support session your organisation agrees to). Our service providers process data for us under contract: see the list of sub-processors.
How long we keep it
Enquiries from the contact form are deleted after 12 months. [Counsel to set the retention period for each other kind of data, including what the 2025 regulations and tax law require us to keep.]
How it’s protected
Personal details are encrypted, each person’s with their own key; erasing someone destroys their key. Every table checks who’s asking before it answers, and changes are kept in an audit trail.
Your rights
You can ask to see the personal data we hold about you, to correct it, to have it erased, or to object to how we use it. Contact us to do so. You can also complain to Uganda’s Personal Data Protection Office [and, for Rwanda, the National Cyber Security Authority; counsel to confirm].
Cookies
We use only the cookies the service needs to work. See the cookie notice.