Hunger Relief Africa ("we", "us", "our") operates HRA-FoDAS, an integrated digital humanitarian platform (Android app, iOS app, and web portal) that connects food donors with humanitarian organisations, refugee settlements, community-based organisations and vulnerable households in Uganda, in order to reduce food loss and waste and improve access to nutritious food.
This Privacy Policy explains what personal data we collect, why we collect it, how we use, share, protect and retain it, and the rights you have. By registering for or using HRA-FoDAS, you acknowledge that you have read this policy. We process personal data in line with the Uganda Data Protection and Privacy Act, 2019, humanitarian data protection principles, and, where applicable, GDPR good practice.
1. Who we are and who this applies to
Hunger Relief Africa is the data controller for personal data processed through HRA-FoDAS. This policy applies to all platform users, including:
- Food donors: commercial and smallholder farmers, cooperatives, processors, grain millers, supermarkets, hotels, restaurants, manufacturers, wholesale markets, corporate partners and individual households;
- Humanitarian agencies, NGOs, community-based organisations, faith-based organisations, schools, hospitals and health facilities;
- Refugee Welfare Committees/Councils, community volunteers and warehouse and logistics staff;
- District Local Governments, the Office of the Prime Minister and other government institutions;
- Beneficiary households registered on the platform; and
- Visitors to our web portal.
2. Information we collect
2.1 Information you provide
| Category | Examples |
|---|---|
| Account and identity data | Full name, phone number, email address, username, password (stored in hashed form), role, organisation name, profile photo (optional) |
| Verification data | National ID number or other identification document, business registration details, tax/licence information, approval status |
| Donor and donation data | Food type and category, quantity, quality grade, expiry dates, photos of food, pickup schedules, donation confirmations and acknowledgements |
| Beneficiary data | Household profile and composition, ages and sex of members, vulnerability score, nutrition status records, disability or elderly status, child-headed or women-headed household status, settlement or village, distribution history |
| Operational data | Warehouse stock records, batch/QR/barcode scans, delivery confirmations, driver and vehicle assignments, fuel and maintenance logs |
| Payment-related data | Mobile money number or payment gateway reference, where payments or sponsorships are enabled. We do not store card numbers. |
| Communications | Messages, feedback, support requests and survey responses |
2.2 Information collected automatically
- Location data: GPS coordinates of donor sites, warehouses, settlements, households (at the level you or an authorised registrar record), and real-time vehicle/driver location during assigned deliveries.
- Device and technical data: device model, operating system version, app version, language, IP address, crash logs, push notification token and unique app instance identifiers.
- Usage and audit data: log-in times, actions performed, and transaction audit trails (kept for accountability and fraud prevention).
2.3 Information from other sources
Where authorised and subject to data-sharing agreements, we may receive limited registration or verification data from government humanitarian information systems, refugee registration databases, partner agencies, or your organisation's administrator.
3. App permissions
The Android and iOS apps may request the following permissions. Optional permissions can be declined or revoked in your device settings, though some features may then be unavailable.
| Permission | Why we need it |
|---|---|
| Location (precise/approximate) | Capture donor, household and facility locations; map donations and collection points; route optimisation and delivery tracking. Background location is used only for drivers on active delivery assignments, where enabled. |
| Camera | Scan QR codes and barcodes for inventory and delivery confirmation; photograph food donations or documents you choose to upload. |
| Photos/media/files | Attach images or documents you select (for example, verification documents). |
| Notifications | Send donation, pickup, approval, delivery and alert messages. |
| Network/Internet access | Communicate with our secure servers and synchronise offline data. |
| Phone/SMS (where applicable) | Receive SMS verification codes or one-time passwords. We do not read your personal messages. |
| Contacts (optional) | Only if you choose to invite others; contacts are not uploaded without your action. |
4. How we use information
- Register, verify and approve users and organisations;
- List, match, schedule, collect, store, transport and distribute donated food;
- Identify and prioritise vulnerable households and ensure fair, transparent distribution;
- Track inventory, expiry dates, batches and cold-chain conditions, and maintain food safety;
- Operate GIS mapping, route optimisation and fleet management;
- Send service notifications by SMS, email and push notification;
- Produce aggregated and anonymised reports and analytics (e.g. tonnes recovered and redistributed, beneficiaries reached, carbon emissions avoided) for planning and donor accountability;
- Prevent fraud, duplication and misuse, and maintain audit trails;
- Secure the platform, troubleshoot issues, and improve features and performance; and
- Comply with legal obligations and respond to lawful requests.
We do not sell personal data, and we do not use personal data for third-party advertising.
5. Legal basis for processing
We process personal data on one or more of the following bases: your consent (for example, location sharing and optional uploads); performance of a contract or service you request; compliance with legal obligations; the performance of a task carried out in the public interest or humanitarian purpose; and our legitimate interests in operating a secure and accountable platform, where these are not overridden by your rights. Where consent is the basis, you may withdraw it at any time without affecting prior lawful processing.
7. Sensitive data and vulnerable persons
Some information handled on the platform, such as nutrition status, disability, health-facility records, refugee or displacement status, household vulnerability, and child-related data, is sensitive. We apply stricter access controls, collect only what is necessary for assistance, and require registrars and partners to follow humanitarian data protection principles, including "do no harm", purpose limitation, and data minimisation. Refugee data is shared only with authorised entities under data-sharing agreements.
8. Children's privacy
HRA-FoDAS is not directed to children under 18, and children may not create user accounts. Information about children (for example, household members, child-headed households, or childcare centre enrolment) is collected only through an adult household member, an authorised registrar, or a registered institution, solely to deliver food and nutrition assistance. If you believe a child has provided us data directly, contact us at privacy@hungerreliefafrica.org and we will delete it.
9. Data security
We use technical and organisational measures appropriate to the sensitivity of the data, including:
- AES-256 encryption for stored data and encryption of data in transit;
- Multi-factor authentication and role-based access control;
- Secure cloud hosting, daily automated backups and a secondary disaster-recovery environment;
- Audit logs for transactions and administrative actions;
- Regular security and penetration testing; and
- Staff and partner training on data protection.
No system is completely secure. Please protect your password and report any suspected breach to privacy@hungerreliefafrica.org. Where required by law, we will notify the Personal Data Protection Office and affected persons of a personal data breach.
10. Data retention
We keep personal data only as long as necessary for the purposes described, programme accountability, audit and legal requirements, in line with our data retention and archival policy. Typically:
- Account data is kept while your account is active and for a limited period after closure;
- Donation, distribution and audit records may be retained for the period required by donors, auditors and law; and
- Data no longer needed is deleted or irreversibly anonymised. Backups are overwritten on a rolling cycle.
11. International data transfers
Our cloud providers or partners may store or process data outside Uganda. Where this occurs, we ensure the recipient provides an adequate level of protection, as required under the Uganda Data Protection and Privacy Act, through contracts and safeguards.
12. Your rights
Subject to applicable law, you have the right to:
- Be informed about how your data is used and access a copy of it;
- Correct inaccurate or incomplete data;
- Request deletion of data that is no longer necessary or was unlawfully processed;
- Object to or request restriction of certain processing, including automated decision-making;
- Withdraw consent at any time; and
- Lodge a complaint with the Personal Data Protection Office (PDPO) in Uganda.
To exercise your rights, email dpo@hungerreliefafrica.org. We may need to verify your identity and will respond within the time required by law.
13. Account and data deletion
You can request deletion of your account and associated personal data at any time by:
- Using the account/profile settings in the app (where available);
- Visiting https://www.hungerreliefafrica.org/delete-account.php; or
- Emailing privacy@hungerreliefafrica.org with the subject "Delete my HRA-FoDAS account", from the registered email or phone number.
We will delete or anonymise your personal data, except records we must keep for legal, audit, food-safety traceability, fraud-prevention or donor-accountability purposes (for example, donation transaction logs), which are kept for the minimum period required and then removed. Beneficiary households may request removal through their Refugee Welfare Committee, registrar or directly with us; please note this may affect eligibility for assistance.
14. Offline use and synchronisation
For field operations, the app can store data on your device while offline and synchronise it when a connection is available. Offline data is encrypted on the device where supported. Please use a device lock (PIN, fingerprint or face unlock) and report lost or stolen devices to us so access can be revoked.
15. Third-party services
The platform may use third-party services such as Google Play services, Firebase (push notifications, crash reporting), mapping services, SMS gateways and mobile money providers. These providers have their own privacy policies, and we encourage you to review them. Links from the platform to external websites are not covered by this policy.
16. Changes to this policy
We may update this policy from time to time. We will post the updated version here with a new "Last updated" date and, for material changes, notify you through the app, email or SMS. Continued use after the effective date means you accept the updated policy.
17. Contact us
Hunger Relief Africa
Plot XX, Street Name, Kampala, Uganda
Email: privacy@hungerreliefafrica.org
Data Protection Officer: dpo@hungerreliefafrica.org
Phone: +256 000 000 000
Website: https://www.hungerreliefafrica.org