Privacy Policy

1. Introduction

Shamba Track Limited ("Shamba Track", "we", "our", or "us") is committed to protecting the privacy, confidentiality, and security of personal data entrusted to us.

This Privacy Policy explains how personal data is collected, used, processed, stored, protected, and disclosed when individuals access or use Shamba Track's products, services, websites, mobile applications, and related platforms, including AgEIS (Agricultural Enterprise Intelligence System).

This Privacy Policy applies to farmers, prospective farmers, agricultural support programmes, business partners, service providers, website visitors, and other individuals whose personal data is processed in connection with our services.

Shamba Track Limited is registered with the Office of the Data Protection Commissioner (ODPC) in Kenya as a Data Processor.

We process personal data in accordance with the Data Protection Act, 2019 of Kenya, applicable regulations, and other applicable legal and regulatory requirements.

2. Who We Are

Shamba Track Limited is an agricultural technology company that develops digital infrastructure to help farmers plan, manage, and maintain records of their agricultural enterprises.

Our flagship platform, AgEIS (Agricultural Enterprise Intelligence System), helps farmers plan and budget for agricultural production, manage farm-related payments, track expenditure against budget, and maintain structured enterprise records throughout the production cycle.

As farmers use AgEIS, the platform may generate a structured record of farm plans, budgets, activities, expenditure, income, transactions, and enterprise performance.

These records may help farmers understand and manage their agricultural enterprises and, where appropriate and authorised, support applications for agricultural programmes, financing, insurance, market opportunities, or other services.

Shamba Track Limited does not itself provide banking, deposit-taking, payment service, insurance, investment, or other regulated financial services unless separately authorised to do so.

3. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed through or in connection with:

• the ShambaTrack website;
• the AgEIS platform;
• ShambaTrack mobile applications;
• account registration and authentication;
• farm planning and budgeting;
• agricultural enterprise records;
• integrated payment and wallet functionality;
• identity verification and onboarding processes;
• customer support and communications;
• agricultural programmes delivered through or supported by the platform;
• other products and services offered by Shamba Track.

Where a third-party service is integrated with or accessible through ShambaTrack, this Privacy Policy applies to personal data processed by Shamba Track.

Third parties may process information under their own privacy policies, terms, regulatory obligations, and legal responsibilities. Users should review the applicable third-party policies where relevant.

4. Information We Collect and Process

The information processed depends on the services used and the individual's interaction with Shamba Track. We seek to collect and process only information that is reasonably necessary for providing our services, maintaining security, meeting legal or contractual requirements, and operating the AgEIS platform.

4.1 Personal Identification Information

This may include:

• first name;
• middle name;
• last name;
• national identification or passport number;
• date of birth, where required;
• gender, where required;
• identity documents;
• photographs or images used for identity verification;
• other information reasonably required to establish or verify identity.

4.2 Identity Verification and KYC Information

Where identity verification or Know Your Customer ("KYC") procedures are required in connection with integrated services, we may collect or facilitate the collection of information such as:

• front image of a national identification document;
• back image of a national identification document;
• selfie or identity-verification photograph;
• names appearing on identification documents;
• identification number;
• mobile telephone number;
• information relating to the status or outcome of an identity-verification process.

Such information may be transmitted to an authorised service provider where necessary to establish or provide a service requested by the user.

Shamba Track does not use KYC information for purposes unrelated to providing, securing, administering, or complying with requirements relating to the relevant services, except where otherwise permitted or required by law.

4.3 Contact Information

This may include mobile telephone number, email address, postal address, physical location, county, sub-county or ward, and other contact information provided by the user.

4.4 Farm and Enterprise Information

This may include farm location, farm or enterprise size, crop or livestock enterprise, production plans, production budgets, planned expenses, farming activities, operational records, expenditure, income, sales records, enterprise performance, photographs, supporting documents, and other agricultural records created or generated through use of AgEIS.

4.5 Financial and Transaction Information

Where a user accesses payment or wallet functionality integrated into AgEIS, we may process information necessary to initiate, reconcile, display, and maintain records of transactions.

This may include:

• wallet-related identifiers;
• payment amounts;
• payment recipients;
• payment references;
• transaction references;
• transaction dates and times;
• transaction status;
• payment channels;
• transaction charges;
• budget categories associated with transactions;
• transaction history.

4.6 Programme Participation Information

Where a user participates in an agricultural support programme or receives services through a partner organisation, information may include programme participation, training, enterprise support, eligibility information, programme activities, disbursements or support received, and monitoring or programme-related records.

4.7 Technical and Security Information

When our websites, applications, or digital services are accessed, we may process technical information such as device information, browser type, operating system, IP address, application usage information, login activity, authentication information, security events, system logs, and information reasonably necessary to maintain platform security, diagnose problems, prevent fraud, and administer the service.

4.8 Communications

We may process information provided when users contact us, request assistance, make enquiries, submit complaints, participate in surveys, provide feedback, or otherwise communicate with Shamba Track.

5. How We Collect Information

5.1 Information Provided Directly

We receive information when users register, complete onboarding, create farm plans, prepare budgets, initiate transactions, update permitted profile information, contact customer support, participate in programmes, or otherwise use our services.

5.2 Information Generated Through AgEIS

Use of AgEIS may generate records relating to farm plans, budgets, agricultural activities, payments, expenditure, income, enterprise performance, and other platform activity.

5.3 Information Received from Partner Organisations

Where services are delivered in conjunction with an agricultural programme or other participating organisation, we may receive information from that organisation where necessary to administer or provide the relevant service.

5.4 Information Collected Automatically

Certain technical and security information may be generated automatically when our websites, applications, APIs, or other systems are used.

5.5 Information Received from Service Providers

We may receive information from authorised service providers, including payment service providers, identity-verification providers, financial institutions, communication providers, hosting providers, or other technology providers where necessary to provide requested services, reconcile transactions, maintain security, or comply with applicable requirements.

6. Why We Process Personal Data

6.1 Providing and Operating AgEIS

This includes creating and managing accounts, authenticating users, providing farm planning and budgeting functionality, recording agricultural activities, maintaining enterprise records, tracking expenditure against budgets, and providing other requested platform functionality.

6.2 Identity Verification and Service Onboarding

Where required, information may be processed to verify identity, support KYC procedures, establish access to integrated services, prevent impersonation or fraud, and comply with requirements applicable to participating service providers.

6.3 Facilitating Transactions

We may process transaction information to transmit user-initiated payment requests, facilitate access to integrated wallet functionality, record transaction results, reconcile transactions, associate expenditure with farm budgets, display transaction history, and maintain accurate enterprise records.

6.4 Customer Support

We process information where necessary to respond to enquiries, investigate problems, handle complaints, provide technical assistance, and resolve user issues.

6.5 Service Communications

We may send communications relating to accounts, transactions, security, service changes, support requests, and other operational matters.

6.6 Improving and Securing Our Services

Information may be processed to diagnose technical problems, improve product functionality, monitor system performance, prevent fraud or abuse, investigate security incidents, and protect our systems and users.

6.7 Legal and Regulatory Compliance

Information may be processed where necessary to comply with applicable laws, regulations, lawful court orders, regulatory requirements, or legally valid requests from competent authorities.

7. Legal Basis for Processing

Depending on the circumstances and Shamba Track's role in the relevant processing activity, personal data may be processed on one or more of the following bases.

7.1 Performance of a Contract

Where processing is necessary to provide requested products or services or perform contractual obligations.

7.2 Consent

Where the individual has provided valid consent for a specified processing activity. Where processing is based on consent, consent may be withdrawn subject to applicable legal, regulatory, and contractual requirements.

7.3 Compliance with Legal Obligations

Where processing is required to comply with applicable laws, regulations, court orders, or other lawful obligations.

7.4 Legitimate Interests

Where permitted by law, information may be processed for legitimate interests such as maintaining system security, preventing fraud, improving services, managing operations, and protecting legal rights, provided those interests are appropriately balanced against the rights and freedoms of affected individuals.

7.5 Processing on Behalf of a Data Controller

Where Shamba Track acts as a Data Processor, personal data is processed on behalf of and in accordance with the lawful instructions of the relevant Data Controller, subject to applicable law and contractual arrangements.

8. Payment and Wallet Services

AgEIS includes technology that allows users to access payment and wallet functionality as part of managing agricultural enterprises.

The regulated payment infrastructure currently integrated with ShambaTrack is provided through SasaPay.

SasaPay is a payment service provider licensed by the Central Bank of Kenya.

Shamba Track provides the technology and enterprise-management layer through which users may initiate payment-related actions and through which confirmed transaction information may be incorporated into their agricultural enterprise records.

To provide these integrated services, information may be exchanged between Shamba Track and the payment service provider, including information necessary for:

• customer onboarding;
• identity verification and KYC;
• creation or administration of wallet services;
• transaction initiation;
• transaction processing;
• transaction confirmation;
• reconciliation;
• transaction status updates;
• regulatory compliance;
• fraud prevention;
• customer support.

The payment service provider may process information in accordance with its own legal and regulatory obligations and applicable privacy terms.

9. Your Enterprise Information

A core function of AgEIS is to enable farmers to build structured enterprise records as a consequence of managing their agricultural activities through the platform.

Enterprise records may include:

• farm plans;
• budgets;
• agricultural activities;
• expenditure;
• payments;
• income;
• transaction records;
• enterprise performance information.

These records may assist farmers in managing their enterprises and may, where appropriate, support applications for agricultural support programmes, financing, insurance, market opportunities, and other services.

Where a user requests or authorises a service involving another organisation, relevant information may be shared where reasonably necessary to provide that service.

Shamba Track does not sell users' enterprise information.

10. Sharing of Personal Data

Shamba Track treats personal data as confidential and does not sell or rent personal data.

Personal data may be disclosed only where reasonably necessary and permitted by applicable law, including in the following circumstances.

10.1 With the User's Authority

Information may be shared where the user requests or authorises a service involving another organisation.

10.2 Payment Service Providers

Information required to provide integrated payment, wallet, identity-verification, transaction, reconciliation, fraud-prevention, and related services may be exchanged with the applicable licensed payment service provider.

The payment services currently integrated into AgEIS are provided through SasaPay.

10.3 Technology and Operational Service Providers

Information may be processed by trusted providers supporting services such as hosting, infrastructure, communications, identity verification, security, technical support, and other technology required to operate the platform.

Such providers are expected to process information only for authorised purposes and to apply appropriate safeguards.

10.4 Agricultural Programmes and Business Partners

Where AgEIS is used in connection with an agricultural programme or partner service, relevant information may be processed or shared where necessary to administer the programme, provide the requested service, fulfil contractual obligations, or where otherwise lawfully authorised.

10.5 Legal and Regulatory Requirements

Information may be disclosed where required by law, court order, regulatory obligation, or lawful request from a competent authority.

10.6 Business Transactions

If Shamba Track is involved in a merger, acquisition, restructuring, investment, financing transaction, or transfer of all or part of its business, information may be transferred where appropriate, subject to applicable legal and confidentiality safeguards.

11. Data Retention

Shamba Track retains personal data only for as long as reasonably necessary for the purposes for which it was processed, subject to applicable legal, regulatory, contractual, security, dispute-resolution, and record-keeping requirements.

Different categories of information may therefore have different retention periods.

Financial and transaction records, identity-verification information, programme records, security records, and other information may need to be retained where required by applicable law, regulatory requirements, contractual obligations, fraud-prevention requirements, dispute resolution, or legitimate record-keeping needs.

When information is no longer required, reasonable measures will be taken to securely delete, destroy, anonymise, or otherwise dispose of it in accordance with applicable requirements.

Requests for deletion are subject to information that Shamba Track or participating service providers may be legally or contractually required to retain.

12. Information Security

Shamba Track implements technical, organisational, and physical safeguards designed to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

Measures may include:

• access controls;
• authentication controls;
• restricted access to personal and KYC information;
• employee and contractor confidentiality requirements;
• secure storage practices;
• security logging and monitoring;
• incident-management procedures;
• protection of systems and devices;
• controlled access to production systems;
• use of service providers expected to maintain appropriate security safeguards.

Although reasonable safeguards are maintained, no electronic system, transmission method, or storage technology can be guaranteed to be completely secure.

We therefore continually review security risks and seek to improve safeguards appropriate to the nature of the information and services involved.

13. International Transfers and Processing

Where personal data is transferred or processed outside Kenya, Shamba Track will take reasonable steps to ensure that the transfer or processing complies with applicable Kenyan data-protection requirements, including requirements relating to appropriate safeguards.

Where third-party service providers process information outside Kenya, their processing may also be subject to applicable contractual and legal safeguards.

14. Your Data Protection Rights

Subject to the Data Protection Act, 2019 and other applicable requirements, individuals may have rights relating to their personal data.

14.1 Right to Be Informed

You have the right to receive information about the collection and use of your personal data.

14.2 Right of Access

You may request access to personal data held about you, subject to applicable legal limitations.

14.3 Right to Correction

You may request correction of personal data that is inaccurate, incomplete, outdated, false, or misleading, as applicable.

Certain account information may not be directly editable through the platform where changes require identity verification or other security procedures.

14.4 Right to Deletion

You may request deletion of personal data in circumstances provided by law.

Deletion may not be possible where information must be retained to satisfy legal, regulatory, contractual, fraud-prevention, security, dispute-resolution, or record-keeping requirements.

14.5 Right to Object

You may object to certain processing in circumstances provided by applicable law.

14.6 Right to Restriction

You may request restriction of processing in circumstances provided by applicable law.

14.7 Data Portability

Where applicable, you may request personal data you have provided in a structured, commonly used, machine-readable format.

14.8 Withdrawal of Consent

Where processing is based on consent, you may withdraw that consent, subject to applicable legal and contractual requirements.

Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

14.9 Complaints and Regulatory Rights

You may contact Shamba Track regarding concerns about the processing of your personal data.

You may also exercise rights or make complaints to the Office of the Data Protection Commissioner in accordance with applicable Kenyan data-protection law.

15. Children's Privacy

ShambaTrack and AgEIS are intended for persons legally capable of creating and operating an account and using the relevant services.

Where a particular programme or service lawfully involves a minor, any processing of a minor's personal data must be undertaken in accordance with applicable law and any required parental, guardian, programme, or other lawful authorisation.

Shamba Track does not knowingly seek to provide regulated wallet or payment services to persons who are not eligible for those services under applicable requirements.

16. Third-Party Services and Links

ShambaTrack may integrate with or provide access to services operated by third parties.

These may include payment providers, financial institutions, identity-verification services, agricultural programmes, insurers, market participants, or other service providers.

Shamba Track is not responsible for the independent privacy practices of third parties acting outside Shamba Track's control.

Users should review the privacy notices and terms applicable to third-party services they choose to use.

17. Changes to this Privacy Policy

Shamba Track may update this Privacy Policy to reflect changes to our products and services, integrated service providers, applicable law or regulation, security or operational practices, or other legitimate business requirements.

Where material changes are made, reasonable steps will be taken to communicate them through appropriate channels, which may include the website, mobile application, email, or other service communications.

The effective date or last-updated date displayed at the beginning of this Privacy Policy will indicate when the current version became applicable.

18. Contact Us

Questions about this Privacy Policy, requests relating to personal data, or privacy-related enquiries may be directed to:

Shamba Track Limited is registered with the Office of the Data Protection Commissioner (ODPC) as a Data Processor.

We will handle privacy requests and enquiries in accordance with applicable data-protection requirements.