PRIVACY & DATA POLICY

This Privacy and Data Policy governs the collection, use, processing, storage, transfer, disclosure, and deletion of all personal data and other information processed by Gixavo Producers in connection with the Oasis Smart Farms Service. This Policy forms an integral part of the Terms and Conditions and is legally binding on all Users.

1. IDENTITY OF DATA CONTROLLER AND DPO

1.1

Gixavo Producers is the data controller, incorporated under the laws of the Republic of Kenya.

1.2

The Company has appointed a Data Protection Officer (DPO) to oversee compliance with applicable Data Protection Law. Contact: Info@oasissmartfarms.com.

1.3

All privacy enquiries, data subject access requests, and rights exercises: Support@oasissmartfarms.com. Acknowledgement within five (5) working days.

2. CATEGORIES OF INFORMATION COLLECTED

2.1 Farm and Operational Data.

All Farm Data entered by Users including: flock configuration data (species, breed, age, sex, weight, quantity, coop assignments, and bird lifecycle events); production records (egg count, hatch rates, daily performance metrics, FCR, and meat yield); health and veterinary records (diagnoses, treatment records, medication logs, vaccination schedules, mortality events); feed and inventory data; financial records; equipment data; staff and task records; environmental and climate records; and IoT sensor data from devices integrated by the User.

2.2 Account and Identity Data.

Name or display name, email address, telephone number (where provided), account identifier, subscription status and history, and communication preferences. No government-issued identification is required for standard registration.

2.3 Technical and Device Data.

Device type, manufacturer, model, OS version, application version, IP address, approximate geographic location at country and region level only  not at precise GPS coordinate level app usage patterns, session duration, crash reports, push notification tokens, and network connectivity information.

2.4 User Content.

Content submitted to community forums, marketplace listings, messaging functions, or other interactive features of the Service.

2.5 Third-Party Derived Data.

Limited data from third-party services including attribution and installation data from analytics providers and payment status confirmations from payment processors. The Company does not purchase personal data from data brokers.

2.6 Data Not Collected.

The Company does not collect: precise GPS coordinates; biometric or genetic data; government-issued identification numbers; payment card numbers or bank account details; personal health data relating to individuals; or special category data unless specifically required for a feature separately consented to.

3. LEGAL BASES FOR PROCESSING

3.1 Performance of Contract.

Processing of account data, Farm Data, and technical data to deliver the Service, including account creation, Farm Data storage, AI recommendations, reporting, and customer support.

3.2 Legitimate Interests.

The Company processes Farm Data and Operational Data through the Data Intelligence System under legitimate interests (Article 6(1)(f) GDPR and equivalent Kenya DPA 2019 provisions). This basis applies to all Users regardless of plan type, including paid subscribers. 

The Company's legitimate interests are: (a) generating anonymised agricultural intelligence to sustain a commercially viable service across all plan tiers; (b) contributing to food security, disease surveillance, and productivity research in developing agricultural markets; and (c) providing B2B data products to feed manufacturers, NGOs, government bodies, and research institutions.

These interests do not override User rights because: (i) pipeline output is genuinely anonymised, not pseudonymous; (ii) data is aggregated to county level with a minimum of ten (10) contributing farms per data point; (iii) no personally identifiable information is present in the output; and (iv) all Users are informed of this processing at onboarding and may exercise applicable rights via Settings › Privacy.

3.3 Consent. 

Where the Company relies on consent  including for personalised advertising and marketing communications consent is freely given, specific, informed, and unambiguous. For EU and UK users, an explicit consent choice regarding Aggregate Data contribution for commercial resale is presented at onboarding. Consent may be withdrawn at any time via Settings > Privacy.

Advertising consent and Data Intelligence processing are governed by separate legal bases and are independent controls. A User's advertising preference has no effect on their participation in the anonymisation pipeline and vice versa. Both controls are accessible independently via Settings › Privacy.

3.4 Legal Obligation.

Processing required to comply with applicable law, regulatory requirements, court orders, and requests from competent authorities.

4. PURPOSES OF PROCESSING

The Company processes personal data and Farm Data for: (a) account creation, management, authentication, and security; (b) delivery, maintenance, improvement, and troubleshooting of the Service; (c) AI-powered recommendations, insights, and analytics; (d) subscription payment processing; (e) customer support; (f) fraud, abuse, and security incident prevention; (g) production of Aggregate Data and operation of the Data Intelligence System; (h) delivery of advertising to Free Plan users; (i) compliance with applicable law; (j) AI model training using anonymised data; (k) service communications; and (l) marketing communications to Users who have provided consent.

5. AGGREGATE DATA AND THE DATA INTELLIGENCE PRODUCT

5.1 Universal Scope. The Data Intelligence System receives Farm Data from all active Users regardless of plan type Free Plan, Starter, Standard, and Pro subscribers equally. Participation in the anonymisation pipeline is a condition of using the Service at all plan levels, not solely the Free Plan. This condition is disclosed at onboarding via an in-app permission screen and is incorporated into the Terms and Conditions.

5.2 Anonymisation Standard. Farm Data is processed through a proprietary pipeline that: (a) strips all direct identifiers on write, prior to pipeline entry; (b) aggregates to county administrative level only; (c) enforces a minimum of ten (10) distinct farms per published data point; (d) applies suppression rules to prevent mosaic re-identification. The resulting Aggregate Data does not constitute personal data under GDPR, UK GDPR, Kenya DPA 2019, or equivalent applicable law.

5.3 EU and UK Opt-Out Right. EU and UK Users have the right under GDPR Article 21 and UK GDPR to object to processing of their data under legitimate interests. This right is exercisable at any time via Settings › Privacy › Data sharing (toggle off). Opt-out requests are logged with timestamp and User identifier. Exclusion from the pipeline applies from the date of request. Aggregate Data already published or licensed prior to the opt-out cannot be recalled as it contains no identifiable information. Users outside the EU and UK do not have a statutory opt-out right for this processing. Their participation is a condition of Service use accepted at account creation, as disclosed at onboarding

5.4 User Participation and Opt-Out.

Farm Data contributes to Aggregate Data by default. For EU and UK users, an explicit consent choice for commercial Aggregate Data contribution is presented at onboarding. All Users may opt out at any time via Settings > Privacy > Data Contributions. Opt-out is prospective and has no impact on any feature or functionality.

5.5 DPIA. 

The Company has conducted a Data Protection Impact Assessment (DPIA) for the Data Intelligence System in accordance with EU GDPR Article 35 and Kenya DPA Section 31. The DPIA is available to supervisory authorities upon request and is published as a standalone document in the Oasis Smart Farms policy suite.

6. ADVERTISING

6.1

Advertising is served to Free Plan users through Google AdMob and other networks. Users enrolled in any paid Subscription Plan will not be shown third-party advertising within the Service, with the exception of the marketplace and prices pages.

6.2 Advertising Data.

Limited technical and behavioural data may be processed by advertising networks. The Company does not sell personal data to advertisers. Advertising partners receive only aggregated, non-personally-identifiable campaign performance metrics. No Farm Data, in any form, is shared with advertising partners.

6.3 Consent for Personalised Advertising. 

In the EU and UK, the Company implements a Consent Management Platform (CMP) compliant with IAB Transparency and Consent Framework (TCF) 2.2 prior to enabling interest-based advertising. Users who decline receive contextual, non-personalised advertising. Consent may be withdrawn at any time via Settings > Privacy > Advertising Preferences.

7. DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

7.1 No Sale of Personal Data.

The Company does not sell, rent, or otherwise transfer personal data in identifiable form to any third party for monetary consideration. This commitment applies universally and without exception.

7.2 Service Providers.

Personal data is disclosed to third-party service providers engaged to perform specific functions on the Company's behalf. Categories include: cloud infrastructure providers; mobile attribution and analytics platforms; advertising network providers; customer communication platforms; and security and fraud prevention services. All service providers are engaged under written data processing agreements restricting use of personal data to the specified purpose.

7.3 Disclosure Required by Law.

The Company may disclose personal data to competent authorities where required by applicable law, binding legal process, or lawful order. The Company will notify the User where legally permitted and reasonably practicable.

7.4 Business Transfers.

Personal data may be transferred in connection with a merger, acquisition, or corporate restructuring. Any transferee will be required to comply with this Policy or provide equivalent protections. The User will be notified.

8. INTERNATIONAL DATA TRANSFERS

All cross-border transfers are conducted under appropriate legal safeguards including Standard Contractual Clauses, International Data Transfer Agreements, and other mechanisms as applicable law requires. A copy of applicable transfer mechanisms is available upon written request to info@oasissmartfarms.com.

9. DATA RETENTION

9.1 Retention Principles.

Personal data is retained for no longer than necessary for the purposes for which it was collected, or as required by applicable law, whichever is longer.

9.2 Key Retention Periods.

• Active account data: retained for the duration of the account.

• Post-cancellation Farm Data: retained for transition export period before archiving.

• Post-deletion: personal data removed from live systems within thirty (30) calendar days.

• Financial records: typically seven (7) years as required by applicable tax law.

• Security and fraud prevention logs: minimum period necessary.

• Legal hold data: duration of the relevant legal matter.

• Backup copies: overwritten on a rolling ninety (90) day cycle.

• Aggregate Data: retained indefinitely as it contains no personal data.

• Deletion request audit records: five (5) years from date of completion.

10. SECURITY MEASURES

The Company implements technical and organisational security measures including: encryption of all data in transit and at rest using industry-standard protocols; access controls restricted to authorised personnel on a need-to-know basis; authentication controls and access logging; and regular security reviews. In the event ofa personal data breach likely to result in high risk to Users, the Company will notify the relevant supervisory authority within seventy-two (72) hours and notify affected Users without undue delay.

11. CHILDREN

The Service is not directed at children. Minimum ages: thirteen (13) globally; sixteen (16) in the EU and UK; eighteen (18) in South Africa and India. If the Company becomes aware personal data of a person below the applicable age threshold has been collected, it will delete such data promptly.

12. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING

12.1

The Service employs AI and machine learning technologies to generate personalised recommendations, insights, and alerts based on the User's Farm Data.

12.2

AI-generated outputs do not constitute professional veterinary, agronomic, financial, legal, or technical advice. The User is solely responsible for all decisions taken in reliance on AI outputs.

12.3 

EU and UK Users have an unconditional right to request human review of any automated decision that produces legal or similarly significant effects. All Users may exercise this right by contacting support@oasissmartfarms.com.

13. USER RIGHTS UNDER DATA PROTECTION LAW

13.1 Rights.

Subject to the exceptions and limitations under applicable Data Protection Law, Users have the right to: (a) access a copy of personal data held about them; (b) request rectification of inaccurate or incomplete data; (c) request erasure; (d) request restriction of processing; (e) receive data in a structured, machine-readable format; (f) object to processing based on legitimate interests; and (g) withdraw consent at any time.

13.2 How to Exercise.

Submit rights requests in writing to support@oasissmartfarms.com. The Company will respond within thirty (30) calendar days, with a possible extension of a further thirty (30) days for complex requests.

13.3 Supervisory Authorities.

Contact info@oasissmartfarms.com. for the relevant authority.

14. RECORDS OF PROCESSING ACTIVITIES 

The Company maintains Records of Processing Activities (RoPA) in accordance with EU GDPR Article 30 and equivalent provisions under applicable Data Protection Law. The RoPA is available to relevant supervisory authorities upon request.

15. MODIFICATIONS TO THIS POLICY

For material changes, not less than thirty (30) days advance notice will be provided by in-app notification or email. Non-material changes may be made without prior notice. Continued use after the effective date of any change constitutes acceptance of the updated Policy.

Privacy: support@oasissmartfarms.com. | DPO: info@oasissmartfarms.com | Last Updated: June 15 2026