Data Protection Notice (Kenya)

This Data Protection Notice explains how Farmy (“Farmy”, “we”, “our”, or “us”) processes personal data in accordance with the Data Protection Act, 2019 (Kenya) and other applicable data protection laws.

This Notice should be read together with our Privacy Policy, which explains our general privacy practices.

Farmy is the data controller for the personal data collected through our services.

As the data controller, we determine the purposes and means of processing personal data in accordance with applicable law.

We process personal data that is necessary to provide, maintain, secure, and improve our services.

Depending on how you use Farmy, this may include:

• Contact and account information.
• Information you submit while using our services.
• Farm-related records and activities.
• Uploaded images, documents, voice notes, and other content.
• Technical and usage information.
• Customer support communications.

We collect only the information that is reasonably necessary for the purposes described in our Privacy Policy.

We process personal data to:

• Provide and operate our services.
• Maintain user accounts.
• Respond to requests and provide customer support.
• Generate reports, reminders, and insights.
• Improve the quality, security, and reliability of our services.
• Detect and prevent fraud, misuse, or security incidents.
• Comply with legal and regulatory obligations.

We process personal data only for legitimate and lawful purposes.

Where required under applicable law, Farmy processes personal data on one or more of the following lawful bases:

• Your consent.
• The performance of a contract or the provision of services you request.
• Compliance with legal or regulatory obligations.
• Our legitimate interests, provided those interests do not override your fundamental rights and freedoms.

Where processing is based on consent, you may withdraw your consent at any time, subject to legal or operational limitations.

Subject to the Data Protection Act, 2019 and other applicable laws, you may have the right to:

• Be informed about how your personal data is processed.
• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete personal data.
• Request deletion of personal data where applicable.
• Object to or restrict certain processing activities.
• Withdraw consent where processing is based on consent.
• Request a copy of your personal data where applicable.
• Lodge a complaint with the relevant supervisory authority.

We will respond to requests in accordance with applicable legal requirements.

We implement reasonable technical and organisational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

Access to personal data is limited to authorized persons who require it to perform their duties or provide our services.

We retain personal data only for as long as necessary to:

• Provide our services.
• Meet legal, regulatory, accounting, or operational requirements.
• Resolve disputes.
• Enforce our legal rights and agreements.

When personal data is no longer required, we will securely delete or anonymize it where reasonably practicable.

Your personal data may be processed or stored outside Kenya where necessary to provide our services.

Where personal data is transferred internationally, we take reasonable steps to ensure that appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

If you wish to exercise any of your rights or have questions about how your personal data is processed, you may contact Farmy through our official support channels.

We may request reasonable information to verify your identity before responding to your request.

If you believe that your personal data has been processed in a manner that does not comply with applicable data protection laws, you may contact Farmy so that we can investigate and address your concerns.

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC), Kenya, or any other competent regulatory authority where applicable.

We may update this Data Protection Notice from time to time to reflect changes in our services, legal obligations, or regulatory requirements.

The most recent version will be made available through Farmy and will take effect from the date it is published.