Privacy
Policy

Section 01

Who We Are

AFRIKAN Trade Post is a trading division of Tullany Holdings Limited, a privately held corporate group registered in Uganda with operations across the United Kingdom, the Caribbean and the United States. This website is operated at afrikantradepost.com.

Tullany Holdings Limited is the data controller responsible for the personal data described in this policy. This means we decide what personal data is collected, why it is collected, and how it is used.

This policy explains what personal data we collect when you visit this website, place an order, or contact us, and what we do with it. It applies to buyers in every country we trade with, and is written to meet the requirements of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and Uganda's Data Protection and Privacy Act 2019.

Section 02

What Personal Data We Collect

We collect only what we need in order to sell you goods and get them to you. Specifically:

• Order and delivery details — your name, delivery address, billing address, email address and telephone number, provided by you when you place an order
• Order contents — the products, quantities, weights and prices making up your order, and any special instructions you give us
• Correspondence — the content of emails and WhatsApp messages you send us, including enquiries, wholesale negotiations and seller applications
• Business details — for wholesale, trade and seller accounts, your company name, trading address, VAT or tax registration number and import licence details where these are required for customs clearance
• Technical data — your IP address, browser type and approximate country, logged automatically by our hosting provider in order to serve the site and protect it from attack. This is not linked to your name or your order

We do not knowingly collect any special category data — information about health, race, religion, political opinions, sexual orientation, trade union membership, genetics or biometrics. Please do not send us such information.

Section 03

How We Use Your Data, and Our Lawful Basis

Every use of your personal data has a lawful basis behind it. Ours are as follows:

• To process and fulfil your order — including taking payment, packing goods, arranging carriage and completing export paperwork. Lawful basis: performance of a contract with you
• To communicate with you about your order — confirmations, dispatch notices, tracking numbers and delivery problems. Lawful basis: performance of a contract with you
• To answer enquiries you send by email or WhatsApp, including wholesale and seller enquiries. Lawful basis: our legitimate interest in responding to people who contact us
• To meet customs, export and tax obligations in Uganda and in your destination country. Lawful basis: compliance with a legal obligation
• To keep accounting and business records as required by company and tax law. Lawful basis: compliance with a legal obligation
• To understand how the site is used and improve it, using aggregated visitor counts that do not identify anyone. Lawful basis: our legitimate interest in maintaining and improving the site
• To prevent fraud and protect the security of the site and our business. Lawful basis: our legitimate interest in protecting ourselves and our customers

We do not sell your personal data to anyone. We do not send marketing emails unless you have specifically asked us to, and if we ever do, every message will carry a one-click unsubscribe link.

Section 04

Who We Share Your Data With

We share your personal data only where it is necessary to complete your order or to run the website. The recipients are:

• Stripe Inc. and Stripe Payments Europe Ltd — payment processing. Stripe receives your name, email address, billing address and card details, and acts as an independent data controller for that information under its own privacy policy
• Shipping carriers — DHL Express, FedEx International and Uganda Post (Posta Uganda). They receive your name, delivery address and telephone number in order to deliver your goods and to contact you if there is a delivery problem
• Customs and border authorities in Uganda and in your destination country. They receive the consignee details and a description and value of the goods, as export and import law requires
• Cloudflare, Inc. — website hosting, content delivery and aggregated visitor statistics. Cloudflare processes your IP address and connection data in order to serve the site, protect it from attack, and produce anonymous visitor counts
• Our banks — where you pay by bank transfer, in order to identify and reconcile your payment
• Professional advisers, auditors and regulators — where we are legally obliged to disclose information, or where we need to establish, exercise or defend legal claims

Where we use a supplier who processes data on our behalf, we require them by contract to keep it secure, to use it only for the purposes we have specified, and to delete or return it when the work is finished.

We do not share your data with other sellers listed on the platform, with marketing companies, or with data brokers.

Section 05

International Transfers

We are an export business. Getting goods from Uganda to you necessarily means your delivery details cross borders — typically between Uganda, the United Kingdom, the European Union, the United States, Canada, Barbados, Spain and China, depending on where you are.

Where personal data is transferred out of the United Kingdom or the European Economic Area to a country without an adequacy decision, we rely on the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or the equivalent safeguards operated by the recipient. Stripe, Cloudflare and Google each operate their own approved transfer mechanisms.

Section 06

Cookies & Browser Storage

The only browser storage this site uses is essential to its operation:

• Your basket — held in your browser's session storage so your selections survive as you move around the page. It is cleared automatically when you close the browser, and it is never transmitted to us until you submit an order
• Stripe fraud prevention — when you reach the payment stage, Stripe may set cookies necessary to process a payment safely and to detect fraudulent transactions. These are strictly necessary to completing a purchase

Separately, our hosting provider Cloudflare produces aggregated visitor statistics — total page views, most-visited pages and visitor countries — derived from ordinary server request logs. This is done without cookies, without any identifier stored on your device, and without tracking individuals between visits or across other websites. It tells us how many people looked at the honey page; it cannot tell us who they were.

You are free to block or delete cookies through your browser settings. Blocking Stripe's cookies may prevent a card payment from completing, but nothing else on the site will be affected.

Section 07

How Long We Keep Your Data

We keep personal data only as long as we have a reason to:

• Order and transaction records — seven years from the end of the relevant financial year, to satisfy company, tax and customs record-keeping requirements
• Export and customs documentation — six years, as required by the authorities in the countries we ship to
• Enquiries that do not become orders — twenty-four months from the last contact, after which they are deleted
• Wholesale and seller account records — for the duration of the trading relationship, and seven years afterwards
• Server request logs — retained by Cloudflare on a short rolling basis and then discarded; aggregated visitor counts contain no personal data

When a retention period ends, data is deleted or irreversibly anonymised.

Section 08

Your Rights

Under the UK GDPR, and under equivalent provisions of Uganda's Data Protection and Privacy Act 2019, you have the right to:

• Be informed about how your data is used — which is the purpose of this policy
• Access a copy of the personal data we hold about you
• Rectification — have inaccurate data corrected and incomplete data completed
• Erasure — ask us to delete your data, where we have no overriding legal obligation to keep it
• Restrict processing — ask us to pause our use of your data while a dispute about it is resolved
• Data portability — receive the data you gave us in a structured, commonly used, machine-readable format
• Object to processing carried out on the basis of our legitimate interests, and to object to direct marketing at any time
• Withdraw consent at any time, where consent is the basis we rely on, without affecting anything done before you withdrew it

To exercise any of these rights, write to us at the address in Section 10. We will respond within one calendar month. There is no charge, unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity before we release personal data.

Please note that we cannot delete records we are legally required to retain — a completed customs declaration or a tax record, for example — until its statutory retention period has expired.

Section 09

Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. The site is served over HTTPS with TLS encryption. Access to order records is limited to the members of our team who need it to do their work. Payment card data never enters our systems.

No transmission over the internet can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where the risk is high, we will notify you directly without undue delay.

This site is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

Section 10

Contact & Complaints

For any question about this policy, or to exercise any of the rights set out in Section 08, contact us:

Data Protection & Admin: Afrikan-tradepost@tullany.org
Sales, Orders & Wholesale: trade-post-sales@tullany.org
WhatsApp: +256 742 014279

Data controller: Tullany Holdings Limited, trading as AFRIKAN Trade Post.

Section 11

Changes to This Policy

We may update this policy from time to time to reflect changes in our operations, our suppliers, or the law. The effective date at the top of this page shows when it was last revised. Where a change materially affects how we use your personal data, we will take reasonable steps to bring it to your attention.

This policy is governed by the laws of Uganda, without prejudice to any mandatory data protection rights you hold under the law of the country in which you reside.