Top Farmer ("the App") is owned and operated by Optimerce Consulting Ltd ("we", "us", "our"), a company registered in the Republic of Kenya. This Privacy Policy explains what personal data we collect when you use the App, how we use it, who we share it with, and your rights under the Kenya Data Protection Act, 2019 and applicable regulations.
By installing or using the App, you agree to the collection and use of information in accordance with this Policy.
1. Who we are (Data Controller)
Optimerce Consulting Ltd
P.O. Box 1122-00217 Limuru, Kenya
Email: info@agrimis.org
Phone: +254 716 193 798
If you have questions about this Policy or want to exercise your rights, contact us using the details above.
2. Information we collect
We collect only data necessary to provide and improve the App's services. Categories of data:
a. Information you provide directly
- Account / identity data — full name, phone number, national ID number (optional, for KYC), county and ward.
- Farmer profile (KYC) data — animal details (breed, age, production), farm size, farm structures, income sources, and supporting photos you upload.
- Loan application data — requested loan amount, repayment period, and information you provide for credit assessment.
- Cooperative / SACCO membership — cooperative ID and name (if applicable).
b. Information collected automatically
- Device identifiers — Firebase Cloud Messaging (FCM) registration token used to deliver push notifications.
- Authentication tokens — JWT access and refresh tokens stored securely on your device to keep you logged in.
- Usage information — diagnostic logs, crash reports, and basic app interaction events used to improve stability.
c. Information from third parties
- Milk delivery and payment history — retrieved from your linked cooperative's AgriMIS system, with your consent, to compute your credit score.
3. How we use your information
We process your data for the following purposes:
| Purpose | Legal basis (DPA 2019) |
|---|---|
| Authenticate you and operate your account | Contract / consent |
| Provide KYC verification and farmer profile management | Contract / legal obligation |
| Compute AI-powered credit scores and process loan applications | Contract / legitimate interest |
| Send push notifications about loan status, payments, and updates | Consent |
| Detect fraud and ensure App security | Legitimate interest |
| Improve App stability via crash diagnostics | Legitimate interest |
| Comply with Kenyan financial-services regulations (CBK, ODPC) | Legal obligation |
We do not use your data for advertising or sell it to third parties.
4. Who we share your data with
We share data only when necessary and with appropriate safeguards:
- Lending partners — regulated lenders we work with to disburse loans receive the minimum data required to evaluate and disburse your facility.
- Cooperatives / SACCOs — your linked cooperative may access aggregated information related to your membership and deliveries.
- Service providers acting on our behalf:
- Google Firebase (Cloud Messaging, Crashlytics) — push notifications and crash reporting.
- Cloud hosting provider — secure backend storage of application data.
- Government authorities — where required by law, court order, or to comply with regulatory obligations (e.g., CBK, ODPC, KRA, courts).
All third parties are bound by confidentiality and data-protection obligations.
5. Data storage and security
- Data is stored on secure servers located in Hub Europe operated by our cloud provider.
- Authentication tokens and sensitive identifiers are encrypted at rest on your device using Android Keystore (
flutter_secure_storage). - All network traffic is encrypted in transit (HTTPS / TLS 1.2+).
- Access to production data is restricted to authorised personnel and audited.
- We retain personal data only for as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce agreements — typically 7 years from your last interaction, after which data is securely deleted or anonymised, in line with CBK record-keeping requirements.
No system is 100% secure. If we become aware of a personal-data breach affecting you, we will notify the Office of the Data Protection Commissioner (ODPC) and affected users in accordance with the DPA 2019.
6. Your rights
Under the Kenya Data Protection Act, 2019, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten"), subject to legal retention obligations
- Object to processing or request restriction of processing
- Data portability — receive your data in a structured, commonly used format
- Withdraw consent at any time, where processing is based on consent
- Lodge a complaint with the Office of the Data Protection Commissioner (www.odpc.go.ke)
To exercise any of these rights, contact us at the email above. We will respond within 30 days.
7. Children's data
The App is intended for users 18 years and older. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.
8. Permissions used by the App
The App requests the following Android permissions, used solely for stated features:
| Permission | Purpose |
|---|---|
| Internet | Communicate with our backend servers |
| Camera | Capture KYC photos (farm, animals, documents) |
| Read media images / external storage | Select existing photos for KYC upload |
| Use fingerprint / biometric | Secure access to sensitive credentials (optional) |
| Post notifications (Android 13+) | Deliver loan-status push alerts |
You can revoke permissions at any time in your device settings. Some features may not work without the relevant permission.
9. Third-party services
The App uses the following services. Their privacy policies govern data they collect:
- Google Firebase — firebase.google.com/support/privacy
- Google Play Services — policies.google.com/privacy
10. International data transfers
If your data is processed outside Kenya (e.g., on cloud servers in another region), we ensure the destination country provides adequate protection or that appropriate safeguards (e.g., standard contractual clauses) are in place, as required by Section 48 of the DPA 2019.
11. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be notified through the App or via the contact information you provided. The "Last updated" date at the top reflects the most recent revision. Continued use of the App after changes constitutes acceptance of the updated Policy.
12. Contact
Optimerce Consulting Ltd — Data Protection Officer
Email: info@agrimis.org
Phone: +254 716 193 798
Postal address: P.O. Box 1122-00217 Limuru, Kenya
You may also contact the Office of the Data Protection Commissioner (Kenya):
Website: www.optimerce.org
Email: info@agrimis.org