Privacy Policy

Traford Farm Fresh is an agricultural produce company based in Kampala, Uganda. We sell fresh produce, meat, honey and groceries sourced directly from Ugandan farms, and deliver them to customers via our website and mobile app.

If you have any questions about this policy or how your data is handled, contact us at trafordexport@gmail.com.

We only collect data we genuinely need to operate the Service. We do not sell your personal data to anyone. The data we collect falls into the following categories:

We use your data strictly for the following purposes:

• To create and manage your account.
• To process your orders and arrange delivery.
• To process payments through our regulated payment providers.
• To send you transactional messages (order confirmations, dispatch and delivery notifications, password resets).
• To respond to your customer-support enquiries.
• To detect and prevent fraud, abuse, and security incidents.
• To comply with our legal obligations under Ugandan law, including the Data Protection and Privacy Act, 2019.
• To improve the Service — for example, fixing crashes, identifying slow pages, and prioritising new features. This is done with aggregated and de-identified data wherever possible.

We will not use your personal data for marketing unless you opt in. You can opt out at any time by emailing trafordexport@gmail.com.

We share the minimum amount of data required, only with the following categories of recipients:

• Delivery riders / dispatchers — receive your name, phone number and delivery address for the specific order they are delivering.
• Payment providers (e.g. Yo Payments, MTN MoMo, Airtel Money) — receive the order amount and a payment reference to process the transaction.
• Cloud infrastructure providers (Supabase for database and authentication; Cloudflare for hosting and content delivery) — store and serve data on our behalf under strict data processing agreements.
• Lawful authorities — only when we receive a valid legal request (court order, regulator demand).

We do not sell, rent, or trade your personal information to any third party.

Some of our infrastructure providers (Supabase, Cloudflare) operate data centres outside Uganda. Where personal data is transferred outside Uganda we ensure the receiving party offers an equivalent standard of protection as required by the Data Protection and Privacy Act, 2019.

• Account data — for as long as your account is active. If you delete your account we delete or anonymise your data within 30 days, except where we are legally required to retain it (see below).
• Order & payment records — retained for a minimum of 7 years to comply with Ugandan tax and accounting law.
• Security logs — retained for up to 12 months for fraud and abuse investigations.

• All traffic between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Passwords are stored as salted, one-way hashes — we never see your plain-text password.
• Access to production databases is restricted to authorised engineers under role-based access control, with all privileged actions written to an immutable audit log.
• We perform routine backups and have a documented incident response process.

Under the Data Protection and Privacy Act, 2019 you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your account and associated data.
• Withdraw consent (where processing is based on consent) at any time.
• Object to or restrict certain processing.
• Lodge a complaint with the Personal Data Protection Office (PDPO) of Uganda.

To exercise any of these rights, email trafordexport@gmail.com. We will respond within 30 days.

Account deletion: you can also request account deletion directly from the mobile app (Settings → Account → Delete account) or by emailing us. We will permanently delete your personal data within 30 days, except records we are legally required to retain (see Section 6).

The Service is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has registered an account, please contact us and we will delete the account.

Our website uses a small number of essential cookies and local storage entries to keep you signed in and remember the contents of your cart. We do not use third-party advertising cookies or cross-site trackers.

We may update this policy from time to time. If we make material changes we will notify you via email or an in-app banner before the changes take effect. The “Last updated” date at the top of this page always reflects the current version.

For any privacy-related question, request, or complaint: