Privacy Policy

This Privacy Policy applies to Kilimora Company Limited by Guarantee ("Kilimora", "we", "us", "our"), registration number CLG-OZTKDDO8, a social enterprise registered in Kenya under the Companies Act, 2015. Our registered address is Baraza Media Lab, Keystone Park, 95 Riverside Drive, Nairobi, Kenya.

Kilimora is the data controller for personal data collected through:

• The AgriKonnekt platform (USSD, mobile app, and web interfaces)
• Our website at kilimora.africa
• Our advisory, grant-writing, and technical assistance programmes
• Our research activities and field data collection
• Any direct communications you initiate with us

We are committed to protecting your personal data and handling it responsibly under the Kenya Data Protection Act, 2019 and any applicable supplementary regulations.

Data you give us directly

• Name, phone number, and national ID or equivalent identification
• Location data (county, sub-county, GPS coordinates of enrolled plots)
• Cooperative or organisation name and membership details
• Bank account or mobile money details (M-Pesa) for payment processing
• Email address and any messages you send us through contact forms or email
• Documents submitted for advisory or fundraising engagements (financial statements, business plans, impact reports)

Data we generate through our services

• Soil sensor readings from IoT devices deployed on enrolled plots
• Satellite cross-validation data (Sentinel-2 imagery processed against enrolled plot coordinates)
• USSD session logs (anonymised by default, linked to phone number)
• Carbon credit verification records and payment timestamps
• Agricultural practice records submitted through training modules

Data collected automatically from this website

• IP address and approximate geographic location
• Browser type, operating system, and device type
• Pages visited, time on site, and referring URL
• Cookie identifiers (see Section 10)

We use personal data for the following purposes:

We do not use your personal data for advertising, sell it to third parties, or use it for any purpose other than those listed above.

Under the Kenya Data Protection Act, 2019, we process your personal data on one or more of the following lawful bases:

• Consent — where you have given us clear consent to process your data for a specific purpose, such as enrolling in AgriKonnekt or subscribing to our research publications. You may withdraw consent at any time.
• Contractual necessity — where processing is necessary to perform a contract with you or to take steps at your request before entering a contract, such as processing advisory engagements.
• Legal obligation — where processing is necessary to comply with a legal requirement, including donor reporting, KYC, or regulatory mandates under Kenyan law.
• Legitimate interests — where processing is necessary for our legitimate interests as a social enterprise, provided those interests are not overridden by your rights. This includes website analytics and programme evaluation.
• Vital interests — in rare cases where processing is necessary to protect someone's life, this may apply in field safety contexts.

Kilimora holds a foundational principle of data sovereignty: farmers and cooperatives own their data. We act as stewards, not owners.

Soil and plot data

Sensor data and satellite imagery processed for your enrolled plot is linked to your individual account. Aggregated, anonymised versions of this data may be used in research outputs. Individual plot data is only shared with verified carbon buyers after your explicit enrolment in a carbon credit programme.

Payment data

M-Pesa payment records are maintained for audit and compliance purposes. Individual payment records are not shared with third parties except as required by Safaricom's terms of service, applicable financial regulations, or court orders.

Training and practice records

Records of training modules completed and agricultural practices adopted are used solely for programme monitoring and impact reporting in anonymised, aggregated form.

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, loss, disclosure, alteration, or destruction.

Where your data is stored

Personal data is stored on servers located in Kenya or within the East African Community, wherever possible. Where data is processed by third-party service providers located outside Kenya, we ensure adequate data protection agreements are in place and that the relevant jurisdiction offers equivalent protection standards.

Security measures we apply

• Encryption of data in transit (TLS) and at rest for sensitive records
• Role-based access controls limiting staff access to the minimum necessary
• Regular security audits and vulnerability assessments
• Incident response procedures aligned with KDPA breach notification requirements
• Staff training on data protection and information security

We do not sell personal data. We share data only in the following circumstances:

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law or contract.

When data is no longer required, we securely delete or anonymise it in line with our data disposal procedures.

Under the Kenya Data Protection Act, 2019, you have the following rights with respect to your personal data:

To exercise any of these rights, contact our data team at hello@kilimora.africa. We will respond within 30 days. We may need to verify your identity before fulfilling a request. There is no charge for exercising your rights.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.

Our website kilimora.africa uses cookies and similar tracking technologies to provide basic website functionality and understand how visitors use the site.

We do not use advertising cookies, third-party tracking pixels, or any cookie that follows you across other websites. You can manage cookies in your browser settings at any time. Disabling analytics cookies will not affect your ability to use the site.

Kilimora's services are not directed at children under 18 years of age. We do not knowingly collect personal data from anyone under 18 without the consent of a parent or legal guardian.

Where Kilimora's programmes operate in community settings that involve young people in educational or observational roles (such as a child of an enrolled farmer attending a training session), any data recorded about those young people is limited to anonymised programme participation records and is subject to our enhanced safeguarding standards as described in our Safeguarding and Protection Framework.

If you believe that we have inadvertently collected personal data from a child, please contact us immediately at hello@kilimora.africa and we will take steps to delete it.

Kilimora primarily stores and processes data within Kenya and East Africa. In some cases, however, data may be transferred to or processed by service providers located outside Kenya — for example, cloud infrastructure providers or carbon registry platforms operating internationally.

Where international transfers occur, we ensure adequate safeguards are in place, including:

• Data processing agreements with standard contractual clauses
• Transfers only to jurisdictions that provide an adequate level of data protection as assessed under the KDPA
• Assessment of the recipient's data protection framework before any transfer takes place

You may request information about the safeguards governing any specific international transfer of your data by contacting us at hello@kilimora.africa.

We review and update this Privacy Policy periodically to reflect changes in our services, applicable law, or best practices in data protection. The current version is always available at kilimora.africa/privacy-policy.

When we make material changes to this policy, we will:

• Update the effective date at the top of this page
• Where possible, notify enrolled programme participants via USSD or SMS
• Post a notice on our website for a period of at least 30 days following any material change

Continued use of AgriKonnekt or our website after an updated policy has been published constitutes acceptance of the revised terms. If you do not accept a material change, you may withdraw from our services in accordance with Section 09.

This policy was last updated and became effective in January 2026.

For any question, concern, or request relating to this Privacy Policy or the processing of your personal data, please contact us:

If you are not satisfied with our response, you have the right to escalate your complaint to the Office of the Data Protection Commissioner (ODPC) of Kenya:

• Website: www.odpc.go.ke
• Email: info@odpc.go.ke