Privacy Policy – MkulimaHub

1. Who We Are

MkulimaHub ("we", "our") is an agricultural advisory platform serving Kenyan farmers and experts. This policy explains what personal data we collect, why we collect it, and how we protect it in accordance with the Kenya Data Protection Act, 2019.

2. Data We Collect

Registration data: your Safaricom phone number and full name.
Farmer profile: county, farming venture(s), crop or livestock type.
Expert profile: qualifications, specialisation, years of experience, and a short bio.
Payment data: M-Pesa receipt numbers, amounts paid, and timestamps. We do not store your M-Pesa PIN or full financial account details.
Usage data: pages visited, programme progress, questions asked, and forum activity.
Communications: SMS messages sent by or to your registered number.

3. How We Use Your Data

To create and manage your account.
To process enrolments and payments.
To deliver SMS notifications, OTPs, and programme updates.
To match farmers with relevant programmes and experts.
To improve the Platform through aggregated, anonymised analytics.
To comply with legal obligations, including tax and anti-fraud requirements.

4. Legal Basis for Processing

We process your data on the following grounds:

Contract performance – to deliver the services you signed up for.
Consent – for marketing communications, which you can withdraw at any time.
Legitimate interest – to secure the Platform and prevent fraud.
Legal obligation – where required by Kenyan law.

5. Sharing Your Data

We do not sell your personal data. We share it only with:

Safaricom M-Pesa – to process payments (your phone number and transaction amount).
SMS gateway provider – to deliver OTPs and notifications (your phone number).
Experts on the Platform – your name and farming venture when you enrol in their programme.
Law enforcement – when required by a valid Kenyan court order or statutory obligation.

6. Data Retention

We retain your account data for as long as your account is active, plus 5 years after closure for legal and tax purposes. Payment records are kept for 7 years as required by the Kenya Revenue Authority. You may request deletion of non-statutory data by contacting us.

7. Your Rights

Under the Kenya Data Protection Act you have the right to:

Access a copy of the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data (subject to legal retention obligations).
Object to or restrict processing in certain circumstances.
Withdraw consent for marketing communications at any time.

To exercise any of these rights, contact us at privacy@mkulimahub.co.ke.

8. Security

Your PIN is stored as a one-way cryptographic hash and can never be read in plain text — not even by our team. All data is transmitted over HTTPS. Access to production databases is restricted to authorised personnel only.

9. Cookies and Local Storage

We use a single session cookie to keep you logged in. We do not use third-party tracking cookies or advertising pixels.

10. Children's Privacy

The Platform is not intended for users under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has registered, contact us and we will delete the account promptly.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via SMS. The "last updated" date at the top of this page will always reflect the most recent revision.

12. Contact and Complaints

For privacy enquiries: privacy@mkulimahub.co.ke.
To lodge a complaint with the supervisory authority: Office of the Data Protection Commissioner, Kenya — odpc.go.ke.