Legal
Privacy Policy
Effective date: 2026-08-22
Avepo Smart Farm ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains what data we collect, why, how we protect it, and the rights you have over it, in line with the Kenya Data Protection Act, 2019, and international data protection standards including the EU General Data Protection Regulation (GDPR) principles. It applies to our website, customer portal, and any offline interactions (e.g. in-person or phone orders) where your data is recorded in our systems.
1. Who is responsible for your data
2. What personal data we collect
- Identity and contact data: name, email address, phone number, delivery/collection location and address.
- Account data: your password (stored as a one-way cryptographic hash, never in plain text), customer number, and account status.
- Transaction data: orders, bookings, quotations, invoices, payments and payment method/reference (e.g. M-Pesa code), and credit account history where applicable.
- Communications data: messages you send us (e.g. via our contact form), and service/support notifications we send you.
- Technical data: IP address, device/browser information, and session identifiers, collected automatically to keep your account secure and our website working correctly — see our Cookie Policy.
We do not knowingly collect special categories of data (such as health or biometric data) through our website.
3. How and why we use your data
We use your personal data only where we have a lawful basis to do so:
- To perform our contract with you — creating and managing your account, processing orders, bookings and payments, arranging delivery/collection, issuing invoices and receipts, and providing customer support.
- With your consent — which you give when you register for an account, and which you may withdraw at any time (see Section 6). Withdrawing consent does not affect processing already carried out, or processing we need to do to fulfil an existing order or legal obligation.
- To comply with legal obligations — such as tax, accounting and record-keeping requirements.
- For our legitimate interests — such as keeping our systems secure, preventing fraud, improving our services, and maintaining business records — carried out in a way that does not override your rights and interests.
We do not sell your personal data. We do not send marketing communications unless you have separately opted in.
4. Who we share your data with
- Our staff, on a need-to-know basis, to process your orders, bookings, payments and support requests.
- Service providers who process data on our behalf under contract — for example our hosting, database and file-storage providers, and payment channels (e.g. M-Pesa, banks) you choose to use — solely to provide those services to us.
- Authorities, where required by law, regulation, or a valid legal process.
We do not share your personal data with third parties for their own marketing purposes.
5. How long we keep your data
We keep your account and transaction data for as long as your account is active, and afterwards for as long as necessary to meet our legal, tax and accounting obligations, resolve disputes, and enforce our agreements — after which it is deleted or anonymised.
6. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Request erasure of your data, where we are not required to keep it (e.g. for tax records);
- Restrict or object to certain processing of your data;
- Data portability — receive a copy of the data you provided to us in a structured, commonly used format;
- Withdraw consent at any time, where we rely on consent to process your data; and
- Lodge a complaint with the Office of the Data Protection Commissioner (Kenya), or your local data protection authority.
To exercise any of these rights, contact us at . We may need to verify your identity before acting on your request, and will respond within the timeframe required by applicable law.
7. Keeping your data secure
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), password hashing, access controls limiting staff access by role, and audit logging of sensitive actions. No system is completely secure, but we work to keep your data protected and to respond promptly to any incident.
8. International transfers
Some of our service providers (such as cloud hosting and file storage) may process data outside Kenya. Where this happens, we take steps to ensure your data continues to receive an appropriate level of protection, consistent with the Kenya Data Protection Act, 2019 and comparable international standards.
9. Children
Our services are not directed at children, and we do not knowingly collect personal data from anyone under 18 without the involvement of a parent or guardian.
10. Changes to this policy
We may update this Privacy Policy from time to time; the "Effective date" above shows when it was last revised. Where changes are material, we will take reasonable steps to notify registered customers.