1. Overview
Ukkoloo provides trust infrastructure for global agrifood trade. Our service is designed around a principle of data minimisation: we process the smallest amount of personal data possible to deliver verifiable identity, intelligent matching, and milestone-based settlement.
This policy explains what we collect, why, on what legal basis, how long we keep it, and the rights you have under the GDPR and equivalent EU/EEA law.
2. Data controller
The controller of personal data processed through the platform is Ukkoloo ("Ukkoloo", "we", "us"). For any privacy-related request you can reach us at [email protected].
Where Ukkoloo processes data on behalf of a business customer (for example, a verifier or a counterparty), that customer acts as controller and Ukkoloo acts as processor under a Data Processing Agreement.
3. What we collect
We collect only what is necessary to operate the service:
- Account information. Name, business name, work email, role, country, language preference.
- Identity references. Public identifiers of your decentralised identity (e.g. DID), credential issuer references, and credential schema metadata.
- Cryptographic commitments. Hashes (SHA-256 or equivalent) of documents and claims you submit to verifiers, used solely to prove integrity and to match claims against statements.
- Service metadata. Listing content you choose to publish, deal participation records, and audit events necessary for dispute resolution.
- Technical data. IP address, user-agent, request timestamps and security logs, processed for the security and integrity of the service.
- Communications. Messages you send via the contact form or to our support addresses.
4. What we never store
Ukkoloo is built so that the most sensitive material never reaches our servers in plain form:
- We do not store the source documents that back your credentials (certificates, contracts, identity documents, lab reports, photos). These remain on your device or with the issuer that produced them.
- We store only cryptographic hashes of those documents and claims, which are mathematically incapable of revealing the underlying content but allow any party to verify that a document presented later matches the claim made earlier.
- We do not see, copy, or retain the contents of credentials issued to your wallet. Selective disclosure occurs on your device; we only learn what you choose to disclose to a counterparty.
5. On-chain data
Ukkoloo records certain integrity anchors and references on a distributed ledger ("the chain"). Specifically, the following may be written to the chain:
- Public identifiers (DIDs) and revocation registries.
- Hashes and cryptographic commitments for claims and milestones.
- Smart-contract state required for escrow, dispute, and audit.
Important: data written to the chain is, by design, immutable and replicated across nodes Ukkoloo does not control. Once written it cannot be modified or erased by us. For this reason, only non-personal or pseudonymous, cryptographically minimised data is anchored on-chain. We do not write personal documents, plain-text personal data, or special categories of data to the chain.
Where on-chain pseudonymous data could in principle be linked back to a natural person (for example, by combining it with off-chain information), we treat it as personal data for the purposes of GDPR and apply the safeguards described in this policy. Your right to erasure is honoured by deleting the off-chain link tables and credentials so that the on-chain anchor becomes effectively non-attributable.
6. Purposes & legal basis
We process personal data for the following purposes and on the following legal bases under Article 6 GDPR:
- Performance of a contract (Art. 6(1)(b)): to create your account, operate matching, settle deals, and provide support.
- Legal obligation (Art. 6(1)(c)): to comply with anti-money-laundering, sanctions, tax, trade and accounting requirements.
- Legitimate interests (Art. 6(1)(f)): to keep the service secure, prevent abuse, improve performance, and maintain the integrity of the trust network. We balance these interests against your rights.
- Consent (Art. 6(1)(a)): for optional features such as marketing communications, where applicable. You can withdraw consent at any time.
7. Anonymised data and model training
Ukkoloo may use irreversibly anonymised data (data from which all identifiers and reasonably available means of re-identification have been removed in accordance with Recital 26 GDPR) to:
- Train, evaluate and improve our matching, scoring and risk models.
- Produce aggregate statistics, market insights and benchmarks.
- Detect fraud, abuse and systemic anomalies.
Once data is anonymised in this sense, it falls outside the material scope of GDPR and may be retained and used by Ukkoloo and its successors. We never train models on the contents of your private documents (which we do not hold), on raw credential payloads, or on personally identifiable communications. Where we use machine learning on personal data prior to anonymisation, we rely on Article 6(1)(f) and apply technical and organisational safeguards (pseudonymisation, access control, purpose limitation).
8. Retention
We keep personal data only as long as necessary for the purposes for which it was collected, plus any period required by law:
- Account data: for the life of your account and up to 24 months after closure.
- Deal records and audit trails: for the period required by applicable commercial, tax and AML law (typically 5 to 10 years).
- Security and access logs: generally up to 12 months.
- On-chain anchors: persist for the lifetime of the chain. See section 5.
9. Recipients and international transfers
We share personal data only with: (i) counterparties you actively engage with on the platform, to the extent you choose to disclose it; (ii) verifiers and issuers operating within the trust network; (iii) infrastructure sub-processors (cloud hosting, email delivery, analytics, fraud prevention); and (iv) competent authorities where legally compelled.
We host data primarily in the European Economic Area. Where transfers outside the EEA are necessary, we rely on adequacy decisions of the European Commission or on the Standard Contractual Clauses (Decision 2021/914) supplemented by appropriate technical measures.
10. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- access your personal data and obtain a copy;
- request rectification of inaccurate data;
- request erasure of personal data we hold off-chain (subject to the limits explained in section 5);
- restrict or object to processing based on legitimate interests;
- data portability for data you provided to us;
- withdraw consent at any time, without affecting the lawfulness of prior processing;
- lodge a complaint with the supervisory authority in your EU/EEA member state.
To exercise any right, write to [email protected]. We respond within one month, extendable by two further months for complex requests.
11. Security
We apply appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit (TLS) and at rest, key separation, least-privilege access, audited deployment, and regular review. No system is perfectly secure; in the event of a personal-data breach affecting your rights and freedoms we will notify you and the competent authority in line with Articles 33 to 34 GDPR.
13. Changes to this policy
We may update this policy to reflect changes in the service, the law, or our practices. The "Last updated" date at the top of this page indicates the latest revision. Material changes will be communicated through the service or by email.
14. Contact
Privacy questions, rights requests and complaints: [email protected]. General enquiries: contact form.