Privacy policy
Kagera is a small advisory practice led by Tom Deacon. This page explains what personal data we hold, why, and what you can do about it. It is written to be read, not filed.
Who we are
Kagera is Kagera FZE LLC, a company registered in Sharjah Publishing City Free Zone, United Arab Emirates. It operates this website and the Microsoft 365 environment (email, documents and shared folders) used to run the practice, and it contracts for and delivers client engagements. In this policy "Kagera", "we" and "us" mean Kagera FZE LLC.
Privacy contact: tom@kagera.ltd
If you have been sent a link to a shared document
When Kagera shares a document or folder with you from its Microsoft 365 environment, Microsoft will ask you, once, to accept that Kagera may "receive your profile data" and "collect and log your activity". This section explains exactly what that means.
What is collected. Your name, business email address and, if your organisation publishes one, your profile photo, as held by your own organisation's Microsoft account. Microsoft also keeps a log of when your account signed in to Kagera's environment and which shared files it opened. That is the full extent of it.
What is not collected. Nothing else from your account. Kagera has no access to your mailbox, calendar, files or anything held by your own organisation. The log covers only your use of what Kagera has shared with you.
Why. So that the document you have been sent opens for you and not for anyone who happens to have the link. This is Microsoft's standard mechanism for sharing between two organisations; the wording of the consent screen is Microsoft's and cannot be changed by us.
What happens technically. A guest record for you is created in Kagera's Microsoft 365 directory. It holds the data above and nothing more. It lets Kagera's environment recognise your work login without you needing a separate account or password.
Where it is held. Microsoft 365 data centres in the European Union, under Kagera's own tenant. Microsoft acts as our processor under its standard terms.
How long. For the duration of the engagement or relationship that led to the share, and for a record-keeping period afterwards of no more than six years, unless you ask for it to be removed sooner.
Your choice. You do not have to accept. If you would rather not, tell the person who shared the document and Kagera will send it to you another way. You can also withdraw at any time by emailing tom@kagera.ltd; the guest record is then deleted and any links stop working for you.
Website visitors
This website is a static site served through Cloudflare. We do not run analytics, advertising or tracking scripts, and we set no cookies of our own. Cloudflare processes connection data (such as IP address and browser type) to serve and protect the site, under Cloudflare's privacy policy. Fonts are loaded from Google Fonts, which receives your IP address when the page loads. If you email us from a link on this site, we hold that email as described under "Business contacts".
Business contacts
If you correspond with us, meet us, or are introduced to us, we hold your name, organisation, role and contact details, together with the correspondence itself, in our Microsoft 365 environment. We use this to conduct the relationship and to follow up on conversations you have had with us. We do not buy contact lists, we do not send marketing mailings, and we do not share your details with third parties except as set out under "Who else touches your data".
Client engagements
During an engagement, Kagera receives whatever the client chooses to share, which can include personal data about the client's staff, customers or suppliers. In that situation the client is the controller and Kagera is the processor: we use the data only to deliver the agreed services and under the client's instructions. The detail of how engagement data is held, where, who else touches it and how long it is kept is set out in Kagera's Supplier and Data Handling Statement, which is provided to every client's compliance or information security function and is available to any client on request.
Who else touches your data
We use a small number of service providers, each bound by confidentiality and data protection terms:
- Microsoft (Microsoft 365: email, documents, shared folders, directory), hosted in the European Union.
- Cloudflare (this website and its protection).
- Providers of AI tools used in our own work, on which model training is disabled and which are recorded in a register available to clients on request.
We do not sell personal data and we do not share it with anyone for their own marketing.
Legal basis and your rights
Kagera FZE LLC is subject to the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Where we hold data about people in the United Kingdom or the European Union, we apply the same standards and respect the rights those laws give you. Where we hold your data as described on this page, we rely on our legitimate interests in running an advisory practice, delivering engagements and communicating with the people involved in them, or on the contract with your organisation.
You can ask us what we hold about you, ask for it to be corrected or deleted, object to our holding it, or ask for a copy. Email tom@kagera.ltd and we will respond within one month. If you are not satisfied with our response, the UAE Data Office is the relevant supervisory authority; if you are in the UK you may also contact the Information Commissioner's Office.
Changes
We will update this page when the way we handle personal data changes, and show the version and date at the top. Nothing here overrides the terms of a signed contract between Kagera and a client.