Privacy notice

The data controller is Canaan Minerals Global Ltd, based in Kampala, Uganda ([content] confirm with CMG (legal) for the registered office and any data-controller registration reference). CMG is an early-stage, Ugandan-owned minerals development and advisory company; this website is built and maintained on our behalf by an appointed website development partner acting as a data processor.

For any privacy question or request, contact us using the details in the How to make a data request section below.

We only collect the data you choose to give us through the forms on this site. Depending on the form, this may include:

• Enquiries and contact requests — your name, email address, the organisation you represent (if given), the enquiry topic and the message you write.
• Applications (for example, careers, partnership or supplier applications) — your contact details, the information you provide in the form, and any documents you upload (such as a CV or company profile).
• Controlled-resource access requests — your contact details, your organisation, and the reason you are requesting access to restricted documents or data.
• Newsletter sign-ups — your email address (and name, if provided).

We do not ask for special categories of data, and we ask that you do not include sensitive personal data in free-text fields or uploaded documents unless it is necessary. We collect no analytics-based personal data — see Analytics and cookies below.

We rely on your consent as the lawful basis for processing the personal data you submit through this website. Every form carries a consent checkbox and a link to this notice, and a form cannot be submitted until you have given that consent. We record that consent was given so we can demonstrate it if needed.

Where we later communicate with you about your enquiry, we do so to respond to the request you made. We will not use your data for unrelated purposes without asking you again.

• To respond to your enquiry and route it to the right team.
• To assess and respond to applications and access requests.
• To review and, where approved, grant time-boxed access to controlled resources (see Controlled resources and confidentiality).
• To send you the newsletter, where you have signed up (until you unsubscribe).
• To keep records of correspondence and to meet our legal obligations.

We do not use your data for automated decision-making or profiling, and we do not sell or rent it to anyone.

You can withdraw your consent at any time. Newsletter emails include an unsubscribe link, and for any other data you can ask us to stop processing and to delete it by contacting us (see below). Withdrawing consent does not affect processing we carried out before you withdrew it, and we may need to keep limited records where the law requires it.

We keep personal data only for as long as is necessary for the purpose it was collected, and then delete or anonymise it. Our specific retention periods for enquiries, applications, access requests and newsletter subscriptions are being finalised: [content] confirm with CMG (legal) for the confirmed retention schedule (for example, how long unsuccessful applications and their uploaded documents are retained).

Two periods are already fixed. We keep an internal record of changes made to this website by our own staff, so that we can account for who published or amended what. Where that record includes sign-in activity — which captures an IP address — we delete it after 180 days. The record of content changes is deleted after 24 months. Neither record stores the contents of your enquiry, application or access request.

We do not sell your personal data and we do not share it with third parties for their own marketing. We share it only with:

• Service providers (processors) who help us run this site and respond to you — for example our hosting and infrastructure providers. These currently include Vercel (hosting) and Supabase (database and secure file storage). [content] confirm with CMG (legal) for the full, confirmed list of processors and their locations.
• Our website development partner, which builds and maintains the site on our behalf. [content] confirm with CMG (legal) for the named partner, if CMG chooses to name it here.
• Authorities or advisers where we are legally required to disclose, or to establish or defend legal claims.

Where a provider stores data outside Uganda, we take steps to ensure it is protected to a standard consistent with the DPPA. [content] confirm with CMG (legal) for the confirmed position on cross-border transfers.

We apply appropriate technical and organisational measures to protect your data. This site is served only over encrypted HTTPS connections, access to submitted data is restricted to authorised staff on a least-privilege basis, and uploaded documents are held in access-controlled storage. Restricted documents and sensitive location data are never sent to your browser without an approved, time-boxed access grant.

We use privacy-friendly, cookieless analytics to understand, in aggregate, how the site is used (for example, which pages are visited). This analytics does not set cookies, does not track you across other websites, and does not collect personal data that identifies you.

Because we do not use tracking or advertising cookies, and the only cookie the site may set is the strictly-necessary sign-in cookie for authorised staff using the admin area, we do not show a cookie-consent banner — none is required under the DPPA for cookieless analytics and strictly-necessary cookies. We will revisit this if we ever introduce non-essential cookies.

Some information on this site — certain documents, project data and exact site coordinates — is confidential and is only released under an approved, time-boxed access grant. When you request access, we use the details you provide to assess the request. We handle this information with particular care and only make it available to the specific person the grant is issued to, for the period the grant is valid.

Under the Uganda Data Protection and Privacy Act, 2019, you have the right to:

• be told how your personal data is collected and used;
• access the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete your data or stop processing it, where the law allows;
• withdraw your consent at any time; and
• complain to the Personal Data Protection Office (PDPO) of Uganda if you believe your data has been mishandled.

To exercise any of the rights above, or to ask a question about this notice, please contact us via our contact form or at the address below:

Canaan Minerals Global Ltd — Data requests
Kampala, Uganda
Contact / Data Protection Officer: [content] confirm with CMG (legal)
Email for data requests: [content] confirm with CMG (legal)

We aim to respond to data requests within the timeframe required by the DPPA. If we need more information to verify your identity before acting on a request, we will let you know.

We may update this notice as our services and the law evolve. When we make material changes, we will update the “last reviewed” date at the top of this page.