Privacy Policy

AgroBridge Africa Ltd ("AgroBridge," "we," "our," or "us"), a company registered under the laws of the Federal Republic of Nigeria, is committed to protecting the privacy, security, and integrity of personal information entrusted to us by users of our digital agricultural marketplace platform accessible at www.agrobridge.com.ng (the "Platform").

This Privacy Policy ("Policy") describes how we collect, use, process, disclose, and safeguard personal information when you access or use our Platform, including our websites, mobile applications, and all associated services (collectively, the "Services"). This Policy applies to all users of the Platform, including farmers, buyers, logistics partners, business accounts, and visitors.

By creating an account, using our Services, or accessing our Platform, you expressly acknowledge that you have read, understood, and consent to the practices described in this Policy. If you do not agree with any part of this Policy, please do not use our Services.

This Policy is incorporated into and forms part of our Terms of Service. Capitalised terms not defined herein shall have the meanings ascribed to them in our Terms of Service.

We collect information about you in the following ways:

2.1 Information You Provide Directly

• Account Registration: Full legal name, email address, phone number, state/city of residence, account type (buyer, farmer, logistics partner, or business).
• Farmer / Vendor Profiles: Farm name, farm location and GPS coordinates, types of produce offered, National ID, BVN (Bank Verification Number) for payout verification, bank account details, farm photographs, and certification documents.
• Buyer Information: Delivery addresses, preferred pickup hub, saved payment methods (tokenised), order history, and communication preferences.
• Logistics Partner Information: Vehicle type, operating routes, driver's license, government-issued ID, and contact details.
• Payment Information: We do not store raw card data. Payment data is processed via our payment processors (Paystack and similar PCI-DSS compliant providers). We may retain tokenised references to facilitate future transactions.
• Communications: Records of your correspondence with us, including customer support tickets, dispute filings, and chat messages exchanged through the Platform.
• Verification Documents: Identity documents submitted for Know Your Customer (KYC) verification.

2.2 Information Collected Automatically

• Device Information: IP address, browser type, operating system, device model, and unique device identifiers.
• Usage Data: Pages viewed, links clicked, session duration, search queries, and features used.
• Location Data: Approximate location derived from your IP address; precise GPS location only with your explicit permission via your device settings.
• Cookies and Tracking Technologies: As detailed in our Cookie Policy.

2.3 Information from Third Parties

• Social sign-in providers (Google) may share your name, email, and profile picture when you use them to create an account.
• Payment processors may share transaction confirmation data.
• Government databases, where applicable, for identity verification purposes.

We use the information collected for the following lawful purposes:

• Service Delivery: To create and maintain your account, process orders, facilitate group buys, coordinate logistics, and process payments.
• Identity Verification & Fraud Prevention: To verify the identity of farmers and buyers, detect and prevent fraudulent activity, and protect the integrity of our escrow system.
• Platform Operations: To improve our Services, conduct data analytics, troubleshoot technical issues, and enhance platform security.
• Communications: To send transactional emails (order confirmations, delivery updates), service notifications, dispute resolutions, and where you have opted in, promotional communications about group buy opportunities and platform features.
• Dispute Resolution: To investigate and resolve disputes between buyers and farmers, including reviewing transaction records, communications, and evidence submitted by parties.
• Regulatory Compliance: To comply with applicable laws and regulations, including Nigeria's Data Protection Act 2023 (NDPA), Consumer Protection Council Act, and Anti-Money Laundering regulations.
• Research and Analytics: To understand market trends in Nigerian and African agriculture and improve our product recommendations and community features.

In accordance with the Nigeria Data Protection Act 2023 (NDPA) and applicable international data protection laws, we process your personal information on the following legal bases:

• Contract Performance: Processing necessary to provide the Services you have requested, including fulfilling orders and facilitating payments.
• Legitimate Interests: Processing required to operate our platform, prevent fraud, and improve our Services, where such interests do not override your fundamental rights and freedoms.
• Legal Obligation: Processing required to comply with applicable law, including anti-money laundering obligations, tax reporting requirements, and responses to lawful court orders.
• Consent: For optional activities such as promotional communications and the use of non-essential cookies. You may withdraw consent at any time without affecting prior processing.

We do not sell, rent, or trade your personal information. We may share your information with the following categories of recipients only as necessary to deliver our Services:

• Farmers and Buyers (Platform Counterparties): When you purchase produce, relevant order and contact details are shared with the farmer to facilitate fulfilment. Buyers' full personal information is never shared beyond what is operationally necessary for delivery.
• Logistics Partners: Delivery name, phone number, and pickup/delivery address are shared to facilitate order fulfilment.
• Payment Processors: Paystack and other PCI-DSS compliant payment service providers for processing transactions. They handle card data under their own privacy policies.
• Cloud Infrastructure Providers: Google Firebase (Firestore, Firebase Authentication, Cloud Storage), Cloudinary (media hosting), and Vercel (platform hosting). Data is stored on servers that meet applicable security standards.
• Communication Service Providers: Resend (transactional email delivery), SMS providers for OTP and notifications.
• Regulatory and Law Enforcement Authorities: Where required by applicable law, court order, or government authority; we shall notify you where legally permitted to do so.
• Professional Advisers: Legal counsel, auditors, and insurers under strict confidentiality obligations.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction, subject to equivalent privacy protections.

We retain your personal information for as long as is necessary to fulfil the purposes outlined in this Policy, subject to the following:

• Active Accounts: For the duration of your account and our business relationship.
• Closed Accounts: Transaction records and dispute history are retained for a minimum of seven (7) years in compliance with Nigerian financial record-keeping regulations.
• KYC Documents: Retained for a minimum of five (5) years after account closure as required by anti-money laundering regulations.
• Marketing Data: Retained until you withdraw consent or opt out.
• Support Records: Retained for three (3) years after ticket resolution.

After the applicable retention period, data is securely deleted or anonymised.

Subject to applicable law, you have the following rights regarding your personal information:

• Right of Access: Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal information.
• Right to Erasure: Request deletion of your personal information, subject to legal retention requirements.
• Right to Restriction: Request that we restrict processing of your information in certain circumstances.
• Right to Data Portability: Request that we provide your data in a portable, machine-readable format.
• Right to Object: Object to processing based on legitimate interests, including marketing communications.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, please submit a written request to legal@agrobridge.com.ng. We will respond within30 days. We may request proof of identity before processing your request.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at www.ndpb.gov.ng.

We implement industry-standard technical and organisational security measures to protect your personal information from unauthorised access, disclosure, alteration, and destruction. These measures include:

• Transport Layer Security (TLS/SSL) encryption for all data in transit.
• Encryption of sensitive data at rest within our database systems.
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis.
• Multi-factor authentication for administrative access to production systems.
• Regular security audits and penetration testing.
• Firestore Security Rules enforcing user-level data isolation.

While we take all reasonable steps to protect your information, no method of electronic transmission or storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and the Nigeria Data Protection Commission (NDPC) in accordance with applicable law.

Our Services are not directed at children under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at legal@agrobridge.com.ngand we will take prompt steps to delete such information.

Your data is primarily processed and stored in Nigeria. Where we use cloud service providers that may transfer data outside Nigeria (such as Google Firebase infrastructure), we ensure that adequate safeguards are in place consistent with the requirements of the Nigeria Data Protection Act 2023, including appropriate data processing agreements with such providers.

We reserve the right to update this Privacy Policy at any time. Where changes are material, we will notify you via email and/or by prominently posting a notice on our Platform at least 14 days before the changes take effect. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

Previous versions of this Policy are available upon request.

The data controller responsible for your personal information is:

• Company: AgroBridge Africa Ltd
• Head Office: Lagos, Nigeria
• Branch Office: Jos, Plateau State, Nigeria
• Email: legal@agrobridge.com.ng
• Support Email: support@agrobridge.com.ng
• Phone: +234 703 891 5555
• Website: www.agrobridge.com.ng