This Privacy Policy explains how AgriOps Technologies Limited ("AgriOps", "we", "us") collects, uses, stores, and protects personal data when you use the AgriOps platform ("Platform").

We are committed to handling personal data responsibly and in accordance with the Nigeria Data Protection Act 2023 (NDPA) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Who This Policy Applies To

This policy applies to:

• Authorised Users — employees or contractors of our Customers who access the Platform;
• Visitors to our marketing and documentation sites;
• Individuals whose personal data is uploaded to the Platform as part of supply chain records (e.g. farmer names, supplier contacts).

Our Role Differs by Data Type

This distinction matters, because it determines who is responsible for the data and who must act if something goes wrong.

• Account and user data — the information you and your colleagues provide in order to use the Platform. AgriOps decides the purposes and means of this processing, so AgriOps is the data controller. This policy governs it.
• Supply chain and operational data — farmer personal data, farm boundaries, supplier records and everything else uploaded or captured by a Customer. The Customer is the data controller and AgriOps acts only as a data processor, on the Customer's documented instructions. Those arrangements are governed by our Data Processing Agreement, not by this policy.

Where AgriOps is a processor, a farmer or other data subject should direct requests to the Customer who holds the relationship with them. We will support that Customer in responding, and we will notify them without undue delay of any breach affecting the data we process for them, so that they can meet their own obligations under the NDPA.

2. Data We Collect

Account and User Data

• Name, email address, job title, phone number;
• Login credentials (passwords are hashed and never stored in plain text);
• Role and permissions within the Customer's organisation;
• Login timestamps and IP addresses (for security and audit purposes).

Supply Chain and Operational Data

This data is entered by Customers and includes:

• Supplier names, addresses, contact details;
• Farmer names, farm locations (GPS coordinates and polygon boundaries), land area, harvest records;
• Purchase and sales order details, product and inventory records;
• EUDR compliance data including deforestation risk status and reference dates.

Usage and Technical Data

• Log data: pages visited, actions taken, timestamps;
• Device and browser information;
• Session data (managed via server-side session cookies).

3. How We Use Personal Data

• To provide the Platform — processing data to deliver the features and functions of the service;
• Security and fraud prevention — monitoring for suspicious activity, enforcing brute-force protections, maintaining audit logs;
• Customer support — responding to queries and resolving issues;
• Compliance — meeting our legal obligations under Nigerian law and, where applicable, EU regulations;
• Platform improvement — aggregate, anonymised analysis of usage patterns to improve the product.

We do not sell personal data. We do not use Customer Data for advertising or marketing purposes.

4. Legal Basis for Processing (GDPR)

Where GDPR applies, we process personal data on the following bases:

• Contract — processing necessary to perform our agreement with the Customer (Art. 6(1)(b));
• Legal obligation — processing required to comply with applicable law (Art. 6(1)(c));
• Legitimate interests — security monitoring, fraud prevention, and platform improvement (Art. 6(1)(f)).

5. Data Sharing

We do not share personal data with third parties except:

• Sub-processors — infrastructure providers (hosting, email delivery, satellite analysis) who process data on our behalf under data processing agreements. The current list is published at Sub-processors;
• Legal requirements — where required by applicable law, court order, or regulatory authority;
• Business transfers — in the event of a merger or acquisition, with appropriate data protection obligations transferred.

6. International Data Transfers

AgriOps is based in Nigeria. Customer Data may be processed or stored on servers outside Nigeria. Where Customer Data includes personal data of EU residents, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses) for any transfer outside the EU/EEA.

7. Data Retention

• Account data — retained for the duration of the Customer's Subscription plus 90 days post-termination for data export, then deleted;
• Audit logs — retained for 365 days per our internal policy;
• Supply chain records — retained for the duration of the Subscription; Customers are responsible for exporting data before termination;
• Login and access logs — retained for 90 days for security purposes.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion of your data (subject to legal and contractual obligations);
• Object to or restrict certain processing;
• Data portability — receive your data in a structured, machine-readable format;
• Lodge a complaint with a supervisory authority (e.g. the Nigeria Data Protection Commission (NDPC) in Nigeria, or your national DPA in the EU).

To exercise these rights, contact us at privacy@agriops.io. We will respond within 30 days.

9. Security

We implement technical and organisational measures including encrypted data in transit (TLS), hashed passwords, session timeouts, brute-force protection, organisation-scoped access controls, and audit logging of create, update, and delete actions. We conduct periodic security reviews and ongoing hardening of sensitive write paths.

10. Cookies

We use a minimal number of cookies necessary to operate the Platform. See our Cookie Policy for details.

11. Changes to This Policy

We may update this policy to reflect changes in law or our practices. Material changes will be communicated by email or in-platform notice. The effective date above indicates the most recent revision.

12. Contact

For privacy questions or to exercise your rights: privacy@agriops.io

Data controller for account and user data: AgriOps Technologies Limited (RC 9570434), No. 25, Temple Road, Dadin Kowa Loop, Off Miango Road, Jos, Plateau State, Nigeria.

For supply chain and operational data, the Customer is the data controller and AgriOps is a processor — see Data Processing Agreement.

13. Revision history

Effective	Change
12 Aug 2026	Section 5 amended. Our sub-processors are now published in full rather than listed on request, and satellite vegetation analysis is named as a processing purpose.
26 Mar 2026	Initial version.