Your data is yours.
Plain transparency.
How iMeanTech Limited protects your personal and farm data under the Kenya Data Protection Act 2019 (KDPA).
Summary for Farmers (Muhtasari wa Faragha)
We believe you should not need a law degree to understand how your farm information is handled. Here are the 5 core commitments we make to every farmer:
1. You own your data
Your livestock records, harvest numbers, and cash flow belong entirely to you. We do not sell your farm data to brokers, seed companies, or advertisers.
2. We never see your card or PIN
Payments are processed through Paystack (licensed by the Central Bank of Kenya). We never store your ATM card details or M-Pesa PIN.
3. Download your data anytime
Under the Kenya Data Protection Act, you have the right to export a complete copy of all your records in Settings whenever applying for a farm loan or cooperative grant.
4. Right to delete your account
If you ever decide to leave, you can request account deletion in Settings. Your personal credentials will be wiped after a 90-day safety grace period.
Kenya Data Protection Act (KDPA) Privacy Policy
1. Data Controller Identification
Wangari (available at wangari.imeantech.com) is designed and operated by iMeanTech Limited, a company registered in the Republic of Kenya. For the purposes of the Kenya Data Protection Act 2019 (the “KDPA”), iMeanTech Limited acts as the Data Controller for all personal data collected through the Wangari web application, mobile interfaces, and messaging integrations.
Entity Name: iMeanTech Limited
Physical Address: Nairobi, Kenya
Data Protection Contact: info@imeantech.com
Regulatory Authority: Office of the Data Protection Commissioner (ODPC), Kenya
2. Categories of Personal Data Collected
We collect only the minimum information necessary to provide you with farm management, reporting, and agricultural advisory services:
- Account & Identity Data: Your name, phone number, email address, password (stored solely in salted bcrypt hash form), and optional farm connection codes.
- Farm Operations Data: Livestock flock counts, egg and milk production logs, crop plantings and harvest yields, feed and medication inventory, customer delivery addresses, and worker attendance.
- Financial Records: Transaction amounts, invoices, customer receivables, feed purchase costs, and payment confirmation references.
- Billing & Payment Data: Subscription statuses, plan selections, and transaction references returned by our licensed payment gateway (Paystack). We never store credit/debit card numbers or M-Pesa PINs.
- Technical & Security Data: IP addresses, browser types, timestamps, and audit trails logged in our secure database for fraud detection and system security under the Computer Misuse and Cybercrimes Act 2018.
3. Lawful Basis for Processing (KDPA Section 30)
In accordance with Section 30 of the Kenya Data Protection Act 2019, we process personal data under the following lawful grounds:
Performance of Contract
To create your account, calculate feed requirements, synchronize offline records, and power your farm dashboard.
Legal Obligations
To retain commercial transactions and invoices for 7 years as mandated by the Kenya Income Tax Act and KRA audit regulations.
Legitimate Interests
To safeguard the platform against unauthorized access, brute force attacks, and system abuse (Computer Misuse and Cybercrimes Act 2018).
4. Authorised Third-Party Sub-Processors
We never sell or rent your personal information to third parties. We engage only reputable, contractually bound sub-processors that maintain robust security standards:
| Sub-Processor | Purpose | Compliance / Security Standard |
|---|---|---|
| Paystack (Stripe) | Payment processing & recurring billing | PCI-DSS Level 1 certified; licensed by CBK |
| Cloud Infrastructure (IBM Cloud VPS) | Application hosting & encrypted PostgreSQL database | ISO 27001, SOC 2 Type II, encrypted at rest |
| Google Gemini / AI Models | Agronomic and farming advisory assistant | Encrypted queries; no customer data used for model training |
| Meta WhatsApp Business API | Farmer messaging bot and delivery alerts | End-to-end transport encryption; opt-in only |
| Open-Meteo | Weather forecasting | Zero personal data transmitted; coordinates only |
5. Data Retention & Account Deletion Policy
We retain personal data only for as long as necessary to fulfill the operational purposes for which it was gathered:
- Active Accounts: Maintained for the duration of your registration.
- Account Deletion Requests: When you request account deletion in Settings, your account is immediately deactivated and placed into a 90-day grace period. After 90 days, your personal profile details (name, phone, email) are permanently scrubbed.
- Tax & Statutory Financial Records: Pursuant to the Kenya Income Tax Act, transaction journals and invoice summaries are archived in anonymized format for seven (7) years to satisfy statutory audit mandates.
- System Security Logs: Security audit logs are maintained on a 12-month rolling retention schedule and then purged.
6. Your Statutory Rights Under the KDPA
Under Sections 26 through 40 of the Kenya Data Protection Act 2019, you hold fundamental rights regarding your data:
Right to Access: You can request a summary of all personal information we hold about you.
Right to Data Portability (Section 38): You can export your full farm records, inventory, and transaction logs in structured JSON format at any time directly in Settings → Data.
Right to Rectification: You can edit your farm name, contact details, and location directly in your profile settings.
Right to Erasure (Section 40): You can schedule your account and personal identifiers for permanent erasure via Settings → Danger Zone.
Right to Object & Opt-Out: You can opt out of promotional communications at any time. For WhatsApp communications, texting “STOP” immediately pauses all automated messages.
7. Security Measures & 72-Hour Breach Notification
Wangari enforces comprehensive technical safeguards including TLS 1.3 encryption for data in transit, strict multi-tenant tenant isolation (`farmId` query boundary), salted password hashing, two-factor authentication (TOTP), and automated IP rate-limiting.
In the unlikely event of a security incident that impacts personal data, iMeanTech maintains a formal Incident Response Plan and will notify affected data subjects and the Office of the Data Protection Commissioner (ODPC) within seventy-two (72) hours of confirmed discovery, in accordance with Section 43 of the KDPA.
8. Inquiries & Regulatory Complaints
If you have any questions or wish to exercise your rights under the Kenya Data Protection Act, contact our team directly:
Email: info@imeantech.com · Subject: Data Protection Request
If you feel your privacy concerns have not been addressed adequately, you have the statutory right to lodge a formal complaint with the regulatory authority:
Office of the Data Protection Commissioner (ODPC)
Britam Tower, 13th Floor, Hospital Road, Upper Hill, Nairobi
Website: dataportal.odpc.go.ke
Email: complaints@odpc.go.ke
Start with one record.
See what it tells you.
Core plan is free forever, no card required — your records belong 100% to you.