Privacy Policy

1. Data Controller

The data controller responsible for the processing of personal data through the Agrexa SaaS platform ("Platform") is:

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal data in compliance with the Ghana Data Protection Act, 2012 (Act 843), the EU General Data Protection Regulation (GDPR) where applicable, and other relevant data protection legislation.

2. Types of Data Collected

We collect and process the following categories of personal data:

2.1 Personal Identification Data

• Full name, email address, phone number, and alternate phone number
• Date of birth, gender
• Profile images
• National identification details (where required for verification)

2.2 Farm and Agricultural Data

• Farm location (region, district, community, GPS coordinates)
• Total land size and crop types cultivated
• Years of farming experience
• Crop yield data, quality grades, and moisture content
• Contract terms and delivery records
• Input distribution and credit records

2.3 Financial Data

• Bank account details (bank name, account number)
• Mobile money account information (provider, phone number)
• Payment transaction records (amounts, dates, statuses, references)
• Subscription billing information
• Credit scores and input credit balances

2.4 Location Data

• GPS coordinates of farm locations
• GPS coordinates of delivery and collection points
• Location data from mobile app usage (with consent)

2.5 Technical and Usage Data

• IP addresses, browser type, device information
• Access timestamps, pages visited, features used
• API usage logs and performance metrics
• Error logs and crash reports

3. Purpose of Processing

We process personal data for the following purposes:

• Service Delivery: To provide, maintain, and improve the Platform, including farmer management, contract management, delivery tracking, and payment processing
• AI and Analytics: To generate yield predictions, credit scores, risk assessments, quality detections, and side-selling risk analyses using anonymised and aggregated data
• Account Management: To manage user accounts, authentication, authorization, and role-based access control
• Payment Processing: To initiate and track payments to farmers via mobile money, bank transfer, and other supported methods
• Communication: To send transactional notifications (SMS, email, push) related to deliveries, payments, contract updates, and system alerts
• Compliance: To comply with legal obligations, including EUDR reporting, audit trail maintenance, and regulatory requirements
• Security: To detect, prevent, and respond to security incidents, fraud, and abuse
• Improvement: To analyse usage patterns and improve Platform features, performance, and user experience

4. Legal Basis for Processing

We process personal data on the following legal bases:

• Contractual Necessity: Processing necessary to perform our contract with you (providing the Platform services)
• Legitimate Interests: Processing necessary for our legitimate interests in operating, improving, and securing the Platform, provided these interests do not override your fundamental rights and freedoms
• Consent: Where you have given explicit consent, such as for location tracking via mobile app, marketing communications, or optional AI features
• Legal Obligation: Processing necessary to comply with applicable laws and regulations, including the Ghana Data Protection Act and tax regulations

5. Data Sharing and Third Parties

We share personal data only in the following circumstances and with appropriate safeguards:

5.1 Payment Providers

We share necessary transaction data with our integrated payment providers (Paystack, Flutterwave, Hubtel) to process payments to farmers. Shared data includes farmer name, phone number, payment amount, and transaction reference. These providers are bound by their own privacy policies and PCI-DSS compliance obligations.

5.2 AI Service Providers

For AI-powered features, we share anonymised and aggregated agricultural data with AI service providers (OpenAI, Anthropic) for model inference. No personally identifiable information is transmitted to AI providers. Data is stripped of names, phone numbers, and precise GPS coordinates before processing.

5.3 Infrastructure Providers

We use cloud infrastructure providers to host the Platform. These providers process data on our behalf under data processing agreements and appropriate security measures.

5.4 Legal Requirements

We may disclose personal data if required by law, court order, or government regulation, or if disclosure is necessary to protect our rights, safety, or property, or the rights, safety, or property of others.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, personal data may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

When the retention period expires, personal data is securely deleted or irreversibly anonymised. Deletion requests are processed within thirty (30) days.

7. Your Rights

Under the Ghana Data Protection Act and, where applicable, the GDPR, you have the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you
• Right to Rectification: You may request correction of inaccurate or incomplete personal data
• Right to Erasure: You may request deletion of your personal data, subject to legal retention requirements
• Right to Data Portability: You may request your data in a structured, machine-readable format (CSV or JSON) for transfer to another service
• Right to Restrict Processing: You may request that we restrict processing of your data in certain circumstances
• Right to Object: You may object to processing based on legitimate interests, including profiling
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Ghana Data Protection Commission or, if applicable, your local data protection authority

To exercise any of these rights, please contact our Data Protection Officer at dpo@agrexa.com. We will respond to your request within thirty (30) days.

8. Cookie Policy

The Platform uses cookies and similar technologies for the following purposes:

• Essential Cookies: Required for authentication, session management, and security (e.g., NextAuth session cookies, CSRF tokens). These cannot be disabled.
• Functional Cookies: Used to remember your preferences, such as language, timezone, and dashboard layout
• Analytics Cookies: Used to understand how the Platform is used, identify performance bottlenecks, and improve features. These are only set with your consent.

We do not use advertising or tracking cookies. You can manage cookie preferences through your browser settings. Disabling essential cookies may impair Platform functionality.

9. International Data Transfers

Your data may be processed in jurisdictions outside Ghana, including locations where our cloud infrastructure and third-party service providers operate. When data is transferred internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with all sub-processors
• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls limiting data access to authorised personnel only

10. Data Security

We implement industry-standard technical and organisational measures to protect personal data, including:

• Encryption of all data in transit using TLS 1.2 or higher
• Encryption of all data at rest using AES-256
• Password hashing using bcrypt with 12 rounds of salting
• Role-based access control (RBAC) with 7 defined roles and 22 granular permissions
• JWT-based authentication with secure token management
• Webhook signature verification for payment provider callbacks
• Rate limiting on authentication and API endpoints
• Comprehensive audit logging of all data access and modifications
• Regular security assessments and vulnerability scanning

11. Children's Privacy

The Platform is intended for use by businesses and adults. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have collected data from a minor, we will take steps to delete it promptly.

12. Ghana Data Protection Act Compliance

In accordance with the Ghana Data Protection Act, 2012 (Act 843) and its implementing regulations:

• We are registered with the Data Protection Commission of Ghana as a data controller
• We process personal data in accordance with the eight data protection principles set out in the Act
• We obtain appropriate consent before processing sensitive personal data
• We provide data subjects with information about the processing of their data
• We implement appropriate technical and organisational security measures
• We restrict cross-border data transfers to countries with adequate data protection standards or with appropriate safeguards in place

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. Material changes will be communicated via email or through the Platform at least thirty (30) days before they take effect. The "Last Updated" date at the top of this page indicates when the policy was most recently revised.

14. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact:

You also have the right to lodge a complaint with: