EzyAgric Privacy Policy

1. About this Privacy Policy

1.1This Privacy Policy explains how Akorion Company Limited, trading as EzyAgric (“EzyAgric”, “we”, “us” or “our”), collects, uses, shares, stores and protects personal data about you when you use the EzyAgric mobile app, our website, Ka-Ezy and our other Services, or when you deal with our staff, Agents and Partners.

1.2We are the data controller for the personal data described in this Privacy Policy. This means that we decide why and how that personal data is processed. Our contact details are in section 18.

1.3We comply with the Data Protection and Privacy Act, Cap. 97 (the “Act”), the Data Protection and Privacy Regulations, 2021 and the other laws of Uganda that apply to personal data. In this Privacy Policy, a reference to a section “of the Act” is to a section of that Act.

1.4This Privacy Policy applies to everyone whose personal data we process through our Services, including farmers, agro-input dealers, cooperatives and other agribusinesses, Agents, buyers, Service Providers and visitors to our website. Our staff are covered by a separate staff privacy policy.

1.5This Privacy Policy is a notice that explains how we handle personal data. It is not a contract and does not form part of the EzyAgric App Terms and Conditions. Where we need your consent, we ask for it separately, as section 5 explains. Some Services, such as EzyCredits, give you an additional privacy notice when you sign up for them.

1.6This Privacy Policy replaces all earlier versions of the EzyAgric Privacy Policy, including those issued in 2020 and 2023.

2. Key words used in this policy

2.1Table 2.1 explains the meaning of some words used in this Privacy Policy.

3. Personal data we collect

3.1We collect personal data in 3 ways: from you directly, from your use of the App and the Services, and from other people and organisations such as Agents and Partners. Table 3.1 lists the main types of personal data that we collect.

3.2You do not have to give us all the personal data that we ask for. However, some personal data is needed to provide a Service. For example, we cannot deliver an order without your phone number and delivery location, and we cannot assess you for EzyCredits without the information requested in the credit application. We will tell you when information is required and what happens if you do not provide it.

3.3We collect special personal data only where it is needed and only with your consent, as section 9 of the Act requires. EzyCredits requires financial information, which the Act treats as special personal data. Where a development programme needs to know whether you live with a disability, we ask for your consent first and use the answer only for that programme.

3.4We also receive personal data about you from:

• (a)Agents, who register you, map your garden or place orders for you on our behalf, with your consent;
• (b)cooperatives, farmer groups and agribusinesses that you belong to or buy through;
• (c)Partners whose Partner Channels you use to reach EzyAgric, which may send us your phone number, your request to join EzyAgric and the record of your consent;
• (d)payment service providers and mobile money operators, which confirm whether a payment has succeeded;
• (e)FinTech Partners and, with your consent, credit reference bureaus, about credit applications and repayments;
• (f)development programme partners, where you take part in a programme that we deliver with them; and
• (g)public and satellite sources, such as weather data and satellite images of the area around a garden that you have mapped.

3.5If a Partner sends us your details because you asked to join EzyAgric through its Partner Channel, we treat them only as a request to join until you register, and we send you a link to this Privacy Policy as soon as practicable.

3.6If you give us personal data about another person, such as a family member, guarantor, farm worker or a farmer you serve as an agribusiness, you must have that person’s permission and tell them about this Privacy Policy.

4. How we use your personal data

4.1We use personal data only for specific and lawful purposes connected with our Services. Table 4.1 sets out the main purposes and the legal grounds on which we rely.

4.2The Act requires your consent before we collect or process your personal data, except where section 7(2) of the Act allows processing without consent, for example where it is necessary to perform a contract with you, to comply with a legal obligation or to prevent or detect crime.

4.3We will not use your personal data for a new purpose that is not compatible with the purpose for which we collected it, unless you agree or the law allows it.

4.4We use de-identified and aggregated data, which does not identify you, to understand farming trends, improve our Services, prepare reports for Partners and support agricultural research. Properly de-identified data is no longer personal data, but we still protect it.

5. How we ask for your consent

5.1Consent under the Act must be freely given, specific, informed and unambiguous, and given by a statement or a clear action, such as ticking a box or tapping a button in the App, or an Agent recording your agreement.

5.2When you sign in to the App for the first time, you must accept the Terms and this Privacy Policy and consent to the processing of your personal data that is needed to provide the Services, including processing outside Uganda as section 10 explains. This consent is a condition of using the App, because the Services cannot work without it.

5.3We ask for your consent separately, and you are free to refuse it without losing access to the App, for:

• (a)sending you marketing messages;
• (b)sharing information with a Partner when you join or pay through its Partner Channel, which you give in that channel; and
• (c)using your financial information for EzyCredits, which you give when you register for EzyCredits.

5.4You can withdraw any consent at any time by changing your settings in the App or by contacting us. Withdrawing consent does not affect processing that took place before you withdrew it. If you withdraw the consent that you gave when you signed in, we will no longer be able to provide the App to you, and we will close your account if you ask us to.

5.5If an Agent helps you and you cannot read this Privacy Policy, the Agent must explain it to you in a language that you understand before you give your consent, and must record that they did so.

5.6Where we start to use personal data for a new purpose, we will ask existing users for their consent, for example through a prompt in the App, before we do so.

5.7We keep a record of each consent, including the wording that you agreed to, when you agreed and through which channel. Where we share personal data with a Partner on the basis of your consent, we may show that record to the Partner when it needs evidence of your consent.

6. Ka-Ezy and artificial intelligence

6.1Ka-Ezy is our artificial intelligence (AI) farm advisor. To answer you, Ka-Ezy processes the questions that you type or speak, photos that you upload, your language choice, your farm records and garden maps, your general location, and weather, satellite and soil information for your area. It also draws on agronomic content prepared or approved by EzyAgric.

6.2Ka-Ezy’s answers are generated automatically. They are suggestions to help you decide what to do on your farm. They are not decisions about you and do not change your rights or obligations. The EzyAgric App Terms and Conditions explain the limits of Ka-Ezy advice.

6.3We use carefully selected AI technology suppliers to run Ka-Ezy. They process your questions and photos on our instructions, under contracts that require them to keep the data confidential and secure. Our AI technology suppliers are not allowed to use your personal data to train their own AI models.

6.4To check that Ka-Ezy is accurate and safe, our team may review a sample of questions, photos and answers, removing names, phone numbers and other identifying details where we can. To improve Ka-Ezy, we and the licensor of our technology platform use only data from which names, phone numbers and other identifying details have been removed. You can ask us at any time not to use your conversations for these purposes by contacting us as set out in section 18. This will not affect your use of Ka-Ezy.

6.5Please do not share identification numbers, PINs, passwords or details about any person’s health in Ka-Ezy. Take photos of crops, animals and soil rather than people. If a photo shows a person, we do not use it to identify them.

6.6If you use Ka-Ezy on a Partner Channel, your questions, photos and Ka-Ezy’s answers pass through the Partner’s platform so that the Partner can show the service to you. We require the Partner to use them only for that purpose, and not to keep them or use them for anything else. For reporting, the Partner receives only usage information, such as whether and how often you used Ka-Ezy.

6.7EzyCredits may use automated tools, including scoring models, to help assess eligibility for credit. If you are unhappy with a credit decision, contact us and a person will review it, together with the FinTech Partner where relevant. We offer this review even though section 27 of the Act does not apply to decisions about entering into or performing a contract.

7. Who we share your personal data with

7.1We share personal data only where it is needed for the purposes in section 4, where you have agreed, or where the law requires or allows it. Table 7.1 shows the main recipients.

7.2We require our suppliers and the licensor of our technology platform, by contract, to process personal data only with our authorisation and on our instructions, and to keep it confidential and secure, in line with sections 21 and 22 of the Act. The licensor of our technology platform may not use your personal data for its own purposes.

7.3When you deal with a Partner through its own platform or service, such as a mobile money service or a FinTech Partner’s credit product, the Partner also processes your personal data under its own privacy notice. We encourage you to read it.

7.4We do not sell or rent your personal data to anyone. We do not give your contact details to Partners for their own marketing unless you agree.

7.5We may share de-identified or aggregated information, such as the number of farmers growing a crop in a district, with Partners, government agencies, researchers and the public. This information does not identify you.

7.6If EzyAgric, or part of its business, is restructured, merged or sold, personal data may be transferred to the new owner or operator so that the Services can continue. The new owner or operator must protect your personal data in line with this Privacy Policy, and we will tell you before your personal data is transferred.

8. Agents, cooperatives and business users

8.1Many users join EzyAgric through an Agent. Agents act on behalf of EzyAgric. An Agent may register you, map your garden, place orders and request services for you using the information that you provide. Agents must ask for your consent, explain this Privacy Policy to you, and use your information only to serve you on our behalf. We are responsible for how our Agents handle your personal data when they act for us.

8.2Agents are bound by confidentiality obligations. They must not copy, sell or use your personal data for their own purposes, and they must never ask you to tell them your PIN or your mobile money PIN. If you believe that an Agent has misused your information, please contact us.

8.3Agribusinesses, cooperatives and other business users may use EzyProduce and other tools in the App to keep records about their own farmers, members, customers or staff. For those records, the business user decides why the information is collected and is responsible for having a lawful basis and for informing the people concerned. We process those records to provide the tools to the business user and to keep them secure, and we use them for our own purposes only as this Privacy Policy allows.

9. Messages and marketing

9.1We send service messages by SMS, WhatsApp, push notification, phone call or email, such as verification codes, order and delivery updates, payment confirmations, subscription reminders, credit repayment reminders and security alerts. These messages are part of the Services.

9.2With your consent, we may send you information about our products, offers, events and farming tips, including offers from our Partners. Every marketing message that we send tells you how to stop such messages free of charge, for example by replying STOP. You can also stop them by changing your settings in the App or by contacting us. We will stop sending you marketing messages as soon as we receive your request, and we will confirm in writing within 14 days, as section 26 of the Act requires. Stopping marketing messages does not stop service messages.

9.3We may record calls to customer care for quality, training and the resolution of complaints. We will tell you at the start of a call if it is being recorded.

10. Transfers outside Uganda

10.1Some of our suppliers, affiliated companies and the licensor of our technology platform, including cloud hosting suppliers, AI technology suppliers and messaging platforms, store or process personal data outside Uganda. The countries concerned depend on the supplier, and we will give you the current list on request.

10.2Under section 19 of the Act, we transfer personal data outside Uganda only where the country of the recipient has data protection measures at least equivalent to those in the Act, or where you have consented. We also require recipients to protect your personal data by contract, and we keep a record of the basis and safeguards for each transfer.

10.3You give your consent to processing outside Uganda when you first sign in, as clause 5.2 explains. You may withdraw it, but the Services, including Ka-Ezy, cannot work without these transfers.

11. How we protect your personal data

11.1We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and destruction, as section 20 of the Act requires. These measures include encryption of data sent between the App and our servers, access controls that limit personal data to the staff and Agents who need it, protected storage of PINs and passwords, confidentiality agreements, security testing and regular backups.

11.2No system is completely secure. You can help by keeping your phone, PIN and verification codes private, locking your phone, and telling us immediately if your phone or SIM card is lost or stolen. No one from EzyAgric, our Agents or our Partners will ever ask you to tell them your PIN or your mobile money PIN. Enter your PIN only in the EzyAgric App, and your mobile money PIN only in the official mobile money prompt on your own phone.

11.3If a data security breach affects your personal data, we will notify the Personal Data Protection Office immediately, as section 23 of the Act requires. We will also tell you where the Office directs us to, or where you need to take steps to protect yourself. If the breach involves personal data that we have shared with a Partner, we will also notify that Partner so that we can deal with it together.

12. How long we keep your personal data

12.1We keep personal data only for as long as we need it for the purposes in this Privacy Policy, unless the law requires or allows us to keep it longer, as section 18 of the Act provides. Table 12.1 shows how long we keep the main types of personal data.

12.2When a retention period ends, we delete the personal data or de-identify it so that it cannot be reconstructed in an identifiable form.

13. Your rights

13.1Under the Act, you have the right to:

• (a)be told what personal data we collect, why we collect it, who receives it, how long we keep it and what your rights are, as this Privacy Policy does (section 13 of the Act);
• (b)ask us whether we hold personal data about you, for a description of that data, and which third parties have had access to it (section 24 of the Act);
• (c)ask us to correct or delete personal data that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully, or to destroy records that we no longer have authority to keep (section 16 of the Act);
• (d)require us, by written notice, to stop processing your personal data where the processing is causing or is likely to cause you unwarranted substantial damage or distress (section 25 of the Act);
• (e)require us to stop using your personal data for direct marketing (section 26 of the Act);
• (f)require that a decision that significantly affects you is not based solely on automated processing, except for decisions about entering into or performing a contract with you or decisions that the law authorises (section 27 of the Act); and
• (g)withdraw your consent at any time, without affecting processing that took place before you withdrew it.

13.2To use any of these rights, contact us using the details in section 18, or ask an Agent to help you contact us. We may ask you to confirm your identity first. We will correct or delete inaccurate personal data promptly, respond to a request for access within 30 days, respond to a notice to stop processing or to stop direct marketing within 14 days, and respond to a notice about an automated decision within 21 days, as sections 16 and 24 to 27 of the Act require. If your request concerns personal data that we have shared with a Partner, we will tell the Partner and work with it so that your request is dealt with. We do not charge you for making a request.

13.3Some rights have limits. For example, the right to stop processing does not apply where we process personal data without consent on a ground allowed by section 7(2) of the Act, such as performing a contract with you or complying with the law. We may also need to keep records that tax law requires or that relate to unpaid credit, and deleting some personal data may mean that we can no longer provide a Service to you. If we refuse a request, we will give you our reasons in writing.

13.4If you are not satisfied with how we handle your personal data, you may complain to the Personal Data Protection Office through www.pdpo.go.ug. The Office can investigate and, where personal data is inaccurate, order us to rectify, update, block, erase or destroy it (section 28 of the Act). You may also seek compensation from a court under section 33 of the Act. We encourage you to contact us first so that we can try to resolve your concern.

14. Children

14.1The App and the Services are for people aged 18 years and above, and we do not knowingly collect personal data about children under 18 years. Section 8 of the Act allows such data to be collected only in limited cases, such as with the consent of a parent or guardian.

14.2If we learn that we have collected a child’s personal data without that consent, we will delete it. If you believe that this has happened, please contact us.

15. Cookies and similar technologies

15.1Our website and the App use cookies, software development kits and similar technologies to keep you signed in, remember your settings such as language, keep the App secure, measure performance and understand how features are used.

15.2We also use attribution tools that tell us whether you installed or registered on the App after following a link from a Partner or a campaign. We may tell that Partner that an installation or registration came from its link, without giving it your other personal data.

15.3You can control cookies through your browser settings, and you can control App permissions such as location, camera and notifications through your phone settings. If you turn some of them off, parts of the Services may not work.

16. Third-party services

16.1The App may link to or work with services that we do not control, such as mobile money services, WhatsApp, app stores, Partner Channels and Partner websites. Those services have their own privacy notices, and we are not responsible for how they handle your personal data, except as section 6 explains for Ka-Ezy on Partner Channels.

17. Changes to this Privacy Policy

17.1We may update this Privacy Policy when our Services or the law change. The date at the top shows when it was last updated.

17.2If we make an important change, we will tell you through the App and on our website, and by SMS or WhatsApp where appropriate, at least 14 days before the change takes effect. Where a change needs your consent, we will ask for it and will not rely on your continued use of the Services.

18. Contact us

18.1If you have a question or a request about your personal data, please contact our Data Protection Officer using the details in Table 18.1.

18.2You can also contact the Personal Data Protection Office, the regulator for personal data in Uganda, through www.pdpo.go.ug.