Privacy Policy

1. Who we are

The data controller responsible for your personal information is:

We operate retail shops, an online store, and a mobile app selling IAG single-origin coffee, Ela Beauty natural skincare, and ACP merchandise to customers in Uganda, across Africa, and internationally.

2. Information we collect

We collect information you provide directly and information collected automatically when you use the Services.

Information you provide

• Account details: name, email address, phone number, password (stored in encrypted form), and country of residence.
• Order & checkout: delivery and billing addresses, order history, product preferences, gift messages, and wholesale or B2B details where applicable.
• Payment-related data: payment method type (e.g. card, M-Pesa, MTN MoMo, Airtel Money). We do not store full card numbers on our servers; payment processing is handled by our payment partners.
• Customer support: messages, photos (e.g. for damaged-item claims), return requests, and call or email correspondence.
• Newsletter & marketing: email address and communication preferences when you subscribe or opt in.
• Farm visits & events: booking details, dietary requirements, and emergency contact information where you provide them.
• Sponsor a Tree programme: name, contact details, and certificate delivery information.

Information collected automatically

• Device & usage data: IP address, browser type, operating system, app version, pages viewed, products browsed, referring URLs, and timestamps.
• Location data: approximate location derived from IP address; precise location only if you enable it in the mobile app (e.g. for delivery tracking or store pickup).
• Cookies & analytics: see Section 7 below.

Information from third parties

• Payment confirmation and transaction status from Flutterwave and other payment gateways.
• Delivery and tracking updates from couriers such as Sendy, DHL Express, and local pickup partners.
• Social login or sign-in providers, if you choose to use them.

3. How we use your information

We use personal information to:

• Process, fulfil, and deliver your orders, including roasting, packing, and shipping coffee and beauty products.
• Manage your account, wishlist, order history, and subscription preferences.
• Process payments, issue refunds, and prevent fraud.
• Provide customer support, handle returns (RMA), and resolve disputes.
• Send transactional messages (order confirmations, shipping updates, password resets).
• Send marketing communications where you have opted in (promotions, new products, Africa Coffee Fest updates).
• Improve our website, app, product range, and shop operations through analytics.
• Comply with legal obligations, including tax, accounting, and consumer protection laws.
• Protect the security and integrity of our Services, staff, and customers.

4. Legal bases for processing

Where applicable under the EU/UK GDPR or similar laws, we rely on the following legal bases:

• Contract: to process orders and provide the Services you request.
• Legitimate interests: to improve our Services, prevent fraud, and communicate about your orders — balanced against your rights.
• Consent: for marketing emails, push notifications, and optional cookies where required.
• Legal obligation: to retain records for tax, regulatory, or law-enforcement purposes.

Under Uganda’s Data Protection and Privacy Act, 2019, we process personal data lawfully, fairly, and for specified purposes with appropriate safeguards.

5. Payments & fraud prevention

Payments are processed by third-party providers including Flutterwave and, where applicable, mobile money operators (M-Pesa, MTN MoMo, Airtel Money) and card networks. These providers collect and process payment data under their own privacy policies.

We receive limited payment information (transaction ID, amount, status, masked payment method) to confirm your order. We do not store your full card number or mobile-money PIN.

We may use automated tools and manual review to detect fraudulent transactions and protect our customers and business.

6. Shipping & delivery partners

To deliver your order, we share necessary details (name, address, phone number, order contents) with couriers and logistics partners such as Sendy, DHL Express, national postal services, and shop pickup locations across our network in Uganda, Kenya, and other countries.

Couriers process this data only to perform delivery services and are required to handle it securely and in accordance with applicable law.

7. Cookies & similar technologies

Our website uses cookies and similar technologies to:

• Keep you signed in and remember your cart and preferences.
• Understand how visitors use our site (analytics).
• Measure the effectiveness of advertising campaigns, where used.

You can control cookies through your browser settings. Disabling essential cookies may affect checkout and account functionality. Where required by law, we will ask for your consent before placing non-essential cookies.

8. Mobile app

Our Africa Coffee Park mobile shopping app may request permissions to:

• Notifications: send order updates and optional promotional alerts (you can disable these in app or device settings).
• Camera / photo library: only if you choose to upload images for returns or support requests.
• Location: only if you enable it for delivery tracking or finding nearby pickup points.

App usage data may be collected to fix bugs, improve performance, and understand feature usage. You can delete the app at any time; account deletion is described in Section 13.

9. How we share information

We do not sell your personal information. We may share it with:

• Service providers: hosting, email delivery (e.g. Mailchimp), analytics, customer support tools, and CMS/admin systems — only as needed to operate the Services.
• Payment & shipping partners: as described in Sections 5 and 6.
• Shop staff & managers: at ACP Flagship Ntungamo, Kampala Roastery, Ela Beauty Nakasero, and other locations — only information required to fulfil your order or assist you.
• Legal & safety: regulators, courts, or law enforcement when required by law or to protect rights, safety, and property.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with notice where required.

All third parties are bound by contractual obligations to protect your data and use it only for specified purposes.

10. International transfers

Africa Coffee Park is based in Uganda. If you access the Services from outside Uganda, your information may be transferred to and processed in Uganda and in countries where our service providers operate (including Kenya, Germany, the United States, and others).

Where required, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms to protect international transfers of personal data.

11. Data retention

We retain personal information only as long as necessary for the purposes described in this policy:

• Account data: while your account is active and for a reasonable period after closure.
• Order & payment records: typically 7 years for tax and accounting compliance.
• Support & returns: for the duration of the case and a reasonable period thereafter.
• Marketing preferences: until you unsubscribe or request deletion.
• Analytics & logs: for a limited period, then anonymised or deleted.

12. Security

We implement technical and organisational measures to protect your information, including encryption in transit (HTTPS/TLS), access controls, staff training, and secure payment processing through certified providers.

No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at hello@africacoffeepark.com.

13. Your rights & choices

Depending on your location, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and personal data, subject to legal retention requirements.
• Object to or restrict certain processing.
• Withdraw consent for marketing at any time (unsubscribe link in emails or account settings).
• Request a copy of your data in a portable format.
• Lodge a complaint with a data protection authority in your country.

To exercise your rights, email privacy@africacoffeepark.com with your name, account email, and request. We will respond within 30 days, or as required by applicable law.

14. Marketing communications

With your consent (or where permitted by law), we may send promotional emails and push notifications about new coffee releases, Ela Beauty products, farm events, and Africa Coffee Fest.

You can opt out at any time by clicking “Unsubscribe” in any marketing email, adjusting notification settings in the app, or contacting us. Transactional messages related to your orders cannot be opted out of while you have active orders.

15. Children’s privacy

Our Services are not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

16. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes will be communicated by email or a prominent notice on the website or app where required by law.

Continued use of the Services after changes take effect constitutes acceptance of the updated policy.

17. Contact us

For privacy questions, data requests, or complaints: