Who we are

Bissau Kernel Co. is a cashew processing and export business registered in Guinea-Bissau, with its processing operation and commercial office in Bissau. In this policy, "we", "us" and "our" refer to Bissau Kernel Co.

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR, Bissau Kernel Co. acts as the data controller for personal data collected through this website and through commercial correspondence with buyers, suppliers, investors and counterparties.

Questions, requests and complaints about personal data should be sent to privacy@bissaukernel.com, or to info@bissaukernel.com marked for the attention of the data protection contact. Post can be addressed to Bissau Kernel Co., Bissau, Guinea-Bissau.

Scope of this policy

This policy covers bissaukernel.com and its language versions in English, Portuguese and French, together with the enquiry, quotation and investor registration forms hosted on the site.

The site is intended for business users: procurement teams, ingredient buyers, distributors, importers, financial institutions and professional investors. It is not directed at consumers or at children.

Personal data we collect

We collect the following categories of personal data:

• Quotation and enquiry data: name, job title, company, business email address, telephone number, country, and the details of the grades, volumes, packing and shipment windows you ask us to quote.
• Investor registration data: name, organisation, business email address, country or jurisdiction and investor type, submitted to unlock the investor materials on this site.
• Correspondence: emails, call notes, meeting notes and the documents you send us in the course of a commercial or financing discussion.
• Contractual and compliance data: company registration details, banking and payment references, beneficial ownership and identification documents where anti-money-laundering, sanctions or know-your-customer checks apply to a transaction or an investment.
• Technical data: IP address, approximate location derived from it, device and browser type, operating system, language preference, referring URL and the pages you view.
• Marketing and campaign data: how you reached the site, which campaign or advertisement referred you, which emails you open and which links you follow.

How we use personal data and our lawful basis

We rely on the following lawful bases under Article 6 of the GDPR:

• Performance of a contract, or steps taken at your request before a contract: preparing quotations, negotiating supply agreements, arranging shipment and documentation, invoicing and settling payment.
• Legitimate interests: responding to business-to-business enquiries, maintaining a record of commercial correspondence, protecting the security of our systems, keeping our contact records accurate, and sending relevant trade information to business contacts who have dealt with us. We balance these interests against your rights and you may object at any time.
• Consent: setting analytics, advertising and social-media cookies and similar technologies; sending marketing communications where consent is required; and providing the investor materials you register to receive. Consent can be withdrawn at any time without affecting the lawfulness of earlier processing.
• Compliance with legal obligations: export, customs and phytosanitary record-keeping, tax and accounting law in Guinea-Bissau and in destination markets, sanctions screening, and anti-money-laundering and investor-suitability checks.

Analytics, advertising and social media

Where you consent, we use measurement and advertising technologies to understand how the site is used and to reach relevant business audiences. These involve cookies, pixels and software development kits operated by the providers below, which act as independent or joint controllers for their own processing:

• Google Ireland Limited and Google LLC: Google Analytics 4 for traffic and conversion measurement, Google Ads and Google Tag Manager for campaign delivery, conversion tracking and remarketing.
• Meta Platforms Ireland Limited: the Meta pixel and Conversions API for Facebook and Instagram campaign measurement, audience building and remarketing.
• TikTok Technology Limited: the TikTok pixel and events API for campaign measurement and audience building.
• LinkedIn Ireland Unlimited Company: the LinkedIn Insight Tag for business-audience measurement and campaign delivery.
• Microsoft Ireland Operations Limited: Microsoft Advertising conversion tracking and Microsoft Clarity for aggregated interaction analysis.

We have configured IP anonymisation in Google Analytics and we do not knowingly transmit special category data, financial account data or identification documents to any advertising platform. We do not sell personal data, and we do not permit these providers to use data collected on our behalf for unrelated purposes beyond what their own terms allow. Details of each cookie, its purpose and its lifetime are set out in our cookies policy, where you can also withdraw consent.

Who else receives personal data

In addition to the measurement and advertising providers named above, we share personal data with:

• Hosting, database and email providers who operate this website, store form submissions and deliver our correspondence, acting as processors under written data-processing terms.
• Banks, insurers, inspection agencies, laboratories, freight forwarders, shipping lines, customs brokers and port authorities, where this is necessary to perform a contract or to satisfy an export or import requirement.
• Professional advisers, including lawyers, auditors and financial advisers, under duties of confidentiality.
• Public authorities and regulators in Guinea-Bissau and in destination markets, where disclosure is required by law.
• A purchaser, investor or successor entity, and its advisers, in connection with a corporate transaction, subject to confidentiality undertakings.

International transfers

We operate from Guinea-Bissau and supply markets across Europe, the United Kingdom, the Gulf, North America and Asia, so personal data is transferred internationally in the ordinary course of business. Our hosting, database and email infrastructure is operated in the European Union and the United States.

Neither Guinea-Bissau nor the United States is covered by a general European Commission adequacy decision for all recipients. Where we transfer personal data from the European Economic Area or the United Kingdom to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies, and on our own assessment of the transfer supported by measures such as encryption in transit, access restriction, confidentiality obligations and data minimisation. Certain US recipients are certified under the EU-US Data Privacy Framework and its UK extension, and we rely on that framework where it applies.

A copy of the safeguards applying to a particular transfer is available on request from privacy@bissaukernel.com.

How long we keep personal data

We keep personal data no longer than necessary. Our standard periods are:

• Website enquiries and quotation requests: 24 months from our last substantive contact, unless a contract follows.
• Investor registrations and investor correspondence: 24 months from our last contact, or five years after the end of a completed investment relationship where financial-compliance records apply.
• Contracts, shipping, export and accounting records: ten years from the end of the financial year in which the transaction completed, reflecting commercial and tax record-keeping requirements.
• Marketing consents and preferences: for as long as the consent stands, plus a record of its withdrawal.
• Analytics data: up to 14 months in Google Analytics 4; advertising identifiers expire in line with the durations set out in our cookies policy.

Your rights

Where the EU or UK GDPR applies to our processing, you have the right to request access to your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to receive data you provided in a portable format, to withdraw consent, and not to be subject to marketing you have objected to.

Send requests to privacy@bissaukernel.com. We respond within one month and may extend that by two further months for complex requests, telling you if we do. We may ask for information to confirm your identity. There is no charge unless a request is manifestly unfounded or excessive.

If you are not satisfied with our response you may complain to your local supervisory authority, including the Information Commissioner's Office in the United Kingdom or the data protection authority of the EU Member State in which you live or work. We would welcome the opportunity to address the matter first.

Automated decision-making and profiling

We do not take decisions about you by automated means alone, and we do not carry out profiling that has legal effects for you. Advertising platforms may group audiences for campaign delivery where you have consented, which does not determine whether we trade with you or accept an investment.

Security

Data submitted through this site travels over TLS encryption and is stored in access-controlled systems with row-level access rules, restricted administrative accounts and audit logging. Employees and contractors are bound by confidentiality obligations and are given access only where their role requires it.

No system is entirely secure. Where a personal data breach is likely to result in a risk to your rights we will notify the competent supervisory authority within 72 hours of becoming aware of it, and will inform affected individuals without undue delay where the risk is high.

Children

This site is a business-to-business resource. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted data through this site, contact privacy@bissaukernel.com and we will delete it.

Changes to this policy

We review this policy at least annually and whenever we change how we use personal data. The date below records the current version. Material changes affecting how we use data you have already given us will be notified by email where we hold a valid address for you.