Privacy Policy

Smart Shamba ("we", "us", or "our") operates the Smart Shamba livestock GPS tracking platform, accessible at smartshamba.io (the "Service"). This Privacy Policy explains how we collect, use, store, and protect your personal data, in accordance with the Kenya Data Protection Act 2019 (KDPA), the Computer Misuse and Cybercrimes Act 2018, the Kenya Information and Communications Act (Cap 411A), and - where our Service is accessed from Uganda - the Uganda Data Protection and Privacy Act 2019.

By creating an account or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Data Controller

The data controller responsible for your personal data is Smart Shamba, reachable at hello@smartshamba.io.

2. What Personal Data We Collect

We collect the following categories of personal data:

3. Legal Basis for Processing

We process your personal data under the following lawful bases as provided by the KDPA 2019:

• Consent - you provide explicit consent at registration for the processing of your personal and location data.
• Contract performance - processing is necessary to deliver the livestock tracking services you have subscribed to.
• Legitimate interests - improving the Service, preventing fraud, and securing the platform.
• Legal obligation - complying with applicable Kenyan laws and regulations.

4. How We Use Your Data

• Provide, operate, and maintain the Smart Shamba platform.
• Display live animal locations and movement history on your map.
• Send SMS and in-app alerts (geofence breaches, low battery, offline devices).
• Generate movement reports and analytics for your farm.
• Send transactional emails (email verification, password resets).
• Respond to your support requests.
• Improve the Service and fix technical issues.

We do not use your data for advertising, sell it to third parties, or use animal location data for any purpose beyond delivering the Service to you.

5. Data Sharing

We share your data only with the following categories of third parties, strictly to operate the Service:

• Cloud infrastructure providers - for hosting the platform and database (servers located within or compliant with applicable data residency requirements).
• Email delivery provider - to send you transactional emails (e.g. verification, password reset).
• SMS provider - to deliver geofence and alert notifications to your registered phone numbers.
• GPS data processing - a self-hosted GPS server processes location pings from your collars; no third-party cloud GPS provider receives your data.

All sub-processors are bound by data processing agreements and are prohibited from using your data for any other purpose.

6. Data Retention

• Your account data is retained for as long as your account is active.
• GPS location history is retained for up to 90 days for movement reports.
• Alert logs are retained for up to 90 days.
• Upon account deletion, all personal data is permanently erased within 30 days, except where retention is required by law.

7. Your Rights Under the KDPA 2019

As a data subject under Kenyan law, you have the following rights:

• Right of access - request a copy of all personal data we hold about you.
• Right to rectification - correct inaccurate or incomplete data.
• Right to erasure - request deletion of your account and all associated data.
• Right to data portability - download your data in a machine-readable format (JSON).
• Right to object - object to processing based on legitimate interests.
• Right to withdraw consent - withdraw your consent at any time; this does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, go to Settings → Account within the app, or email us at hello@smartshamba.io. We will respond within 21 days as required by the KDPA.

8. Security

We implement the following measures to protect your data:

• All data in transit is encrypted using TLS 1.2+ (HTTPS).
• Passwords are hashed using bcrypt - we never store plain-text passwords.
• Authentication uses short-lived JWT tokens.
• Database access is restricted to application servers only - no public exposure.
• Rate limiting is applied to all authentication and sensitive endpoints.

Despite these measures, no internet-based service can guarantee 100% security. In the event of a data breach that is likely to result in a risk to your rights, we will notify you and the Office of the Data Protection Commissioner (ODPC) within 72 hours of becoming aware.

9. Cookies and Local Storage

Smart Shamba does not use tracking or advertising cookies. We use browser localStorage to store your session token and user preferences (such as notification settings and SMS contacts). This data remains on your device and is not transmitted to third parties.

9b. SMS and Electronic Communications

Where we send you SMS alerts, we do so in compliance with the Kenya Information and Communications Act (Cap 411A) and the Kenya Communications (Consumer Protection) Regulations 2010. You may opt out of SMS notifications at any time via Settings → Notifications. Opting out of SMS alerts does not affect your account or in-app notifications.

9c. Cross-Border Data Transfers

Your data is stored and processed primarily on servers located in the region. Where data is processed by a sub-processor outside Kenya, we ensure appropriate safeguards are in place as required by Section 49 of the KDPA 2019, including standard contractual clauses or adequacy decisions. If you are accessing the Service from Uganda, we also comply with the Uganda Data Protection and Privacy Act 2019, including the requirement that any cross-border transfer is to a country with an adequate level of data protection.

10. Children's Privacy

The Service is intended for use by adults (18 years and above). We do not knowingly collect personal data from children under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately at hello@smartshamba.io.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

12. Contact Us

For any privacy-related questions, requests, or complaints, contact our Data Protection Officer at:

You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at odpc.go.ke.