Privacy Policy

MFUGO CONNECT LIMITED ("MFUGO CONNECT", "MFUGO", "we", "us", or "our") operates the MFUGO CONNECT platform — a livestock technology platform designed to help farmers, breeders, processors, buyers, organizations, and other livestock participants manage their operations, understand their livestock, and connect with market opportunities. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our platform, website, or any related services (collectively, the "Platform"). It also explains your rights under applicable Kenyan data-protection law, including the Kenya Data Protection Act, 2019 (the "DPA") and any regulations made under it. Please read this Privacy Policy carefully. By registering for or using the Platform, you acknowledge that you have read and understood this policy. If you do not agree with how we handle personal data, you should not use the Platform. This policy applies to all users of the Platform, including farmers, breeders, processors, buyers, organizations, and platform administrators.

The data controller responsible for your personal data is: MFUGO CONNECT LIMITED Imara Daima, Nairobi, Kenya Phone: +254 748 497 407 Data Protection Contact: Francis Karani MFUGO CONNECT LIMITED is the entity that determines the purposes and means of processing personal data collected through the Platform.

We collect two broad categories of information through the Platform: A. PERSONAL DATA Personal data is information that identifies or can reasonably identify a living individual. Depending on how you use the Platform, we may collect: Account and Identity Information - Full name - Email address - Phone number - Password and authentication credentials - Account type (e.g. farmer, processor, buyer) Profile and Organizational Information - Farm name and details - Organization name and details - Processor organization information - Location information (county, region, locality) - Profile information you choose to provide Communications and Support - Messages you send through the Platform - Information you provide when contacting our support team - Communications preferences B. LIVESTOCK, FARM, BUSINESS, AND OPERATIONAL DATA The Platform allows users to maintain electronic records that may relate to animals, farms, and business operations rather than to identifiable individuals. This may include: - Animal records (species, breed, identification, ownership) - Breeding and litter records - Health and veterinary records - Nutrition and feed records - Growth and performance records - Farm operational records - Marketplace listings and offers - Supply requests and procurement records - Transaction-related records - Uploaded photographs and media (livestock, farms, listings) - Financial and operational records Important: Some livestock or business records may constitute or become personal data where they can be linked to an identifiable individual — for example, records that identify a specific farmer by name, phone number, or farm. Where this is the case, we treat such records as personal data and handle them accordingly. C. USAGE AND TECHNICAL DATA When you use the Platform, we and our analytics providers may automatically collect: - Device and browser information - IP address or network information - Pages and features visited - Usage patterns and session information - Referral and traffic source information - Approximate location information where provided by the analytics system - Other technical and usage information See Section 10 (Analytics and Similar Technologies) for more detail.

You are responsible for ensuring that: - Information you enter on the Platform is accurate and up to date. - You have the appropriate authority or permission to enter information relating to other people, farms, organizations, or animals. - You do not enter personal data about other individuals without a lawful basis for doing so. - You do not upload content that infringes the rights of third parties. Where you enter information about other individuals (for example, farm workers, co-owners, or other participants), you should ensure those individuals are aware that their information has been provided to the Platform and that it will be handled in accordance with this Privacy Policy.

We process personal data for the following purposes: Platform Operation - Creating and managing your account - Authenticating your identity when you log in - Providing the features and functionality of the Platform - Maintaining your livestock, farm, and operational records - Supporting processor organizations and their activities - Facilitating marketplace listings, supply requests, offers, and procurement - Connecting platform participants where relevant Communications - Sending account-related messages (e.g. registration confirmation, password reset) - Sending security and authentication messages - Sending platform notifications and service updates - Sending marketplace and procurement notifications relevant to your activity - Sending marketing communications where you have given appropriate consent or where otherwise permitted by law Platform Improvement and Analytics - Understanding how users interact with the Platform - Measuring usage and performance - Identifying and fixing technical issues - Developing and improving features and services Security and Integrity - Detecting and preventing fraud, misuse, and unauthorized activity - Maintaining the security and integrity of the Platform - Monitoring for suspicious activity where appropriate Legal and Compliance - Meeting our legal and regulatory obligations - Resolving disputes - Enforcing our agreements - Protecting the rights, safety, and interests of MFUGO, users, and third parties

Under the Kenya Data Protection Act, 2019, we process personal data on the following lawful bases: Performance of a Contract Where processing is necessary to provide the Platform services you have requested or to take steps before entering into an agreement with you — for example, creating your account, maintaining your records, and facilitating marketplace activities. Legal Obligation Where processing is necessary to comply with a legal or regulatory obligation applicable to MFUGO CONNECT LIMITED. Legitimate Interests Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests. This may include improving the Platform, maintaining security, preventing fraud, and communicating service-related information. Consent Where we rely on your consent — for example, for certain marketing communications. Where consent is the lawful basis, you may withdraw it at any time by contacting us or using the relevant preference controls. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and may mean that certain features or communications are no longer available to you. Other Lawful Grounds We may rely on other lawful grounds recognized under applicable Kenyan law where relevant. We do not require your consent for every form of processing. Where we rely on a basis other than consent, we will not ask for consent for that processing.

The Platform includes marketplace and procurement functionality designed to connect livestock participants. To enable these features, certain information you provide may be visible to other users or participants on the Platform. What May Be Visible to Others When you create a marketplace listing, supply request, processor profile, organization profile, or similar feature, information you provide for that purpose — such as your farm name, location, livestock details, pricing, and contact information — may be visible to relevant platform participants. Not all of your account information is publicly visible. Information you provide for private record-keeping purposes (such as internal health records or financial records) is not shared with other users unless you choose to make it available through a marketplace or procurement feature. Processor Organizations Processors may create or manage processor profiles and organizations on the Platform. Where organizational or business information is displayed to other users, we distinguish between organizational/business information and personal information relating to individual representatives. Individual representatives should be aware that their name or contact details may be visible to other users where they are associated with a public-facing profile. Your Responsibility You should carefully consider what personal information you include in listings, profiles, or other user-visible features. Avoid publishing personal information you do not want to be visible to other platform participants.

We do not sell your personal data. We may share your information in the following circumstances: Service Providers We use third-party service providers to help us operate the Platform. These may include providers of cloud hosting, database services, file and object storage, email delivery, SMS delivery, authentication and security services, analytics, communication services, and other infrastructure or technology services. Service providers process personal data on our behalf and are only given access to information necessary for their specific services. We require service providers to handle personal data in accordance with applicable law and appropriate contractual safeguards. Other Platform Participants As described in Section 7, certain information may be shared with other users where necessary to provide marketplace, procurement, or connectivity features. Payment Providers (Future) Payment functionality is not currently available on the Platform. When payment functionality is introduced, we may share relevant transaction information with third-party payment providers. We will update this Privacy Policy or provide additional notice before or when payment processing begins. Professional Advisers We may share information with our lawyers, accountants, auditors, and other professional advisers where necessary for legitimate business purposes, subject to confidentiality obligations. Legal and Regulatory Authorities We may disclose information to regulators, courts, law enforcement agencies, or other public authorities where required or permitted by applicable law — for example, in response to a court order, legal process, or regulatory requirement. Business Transfers If MFUGO CONNECT LIMITED is involved in a merger, acquisition, restructuring, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to applicable legal requirements and appropriate safeguards. Protection of Rights and Safety We may disclose information where reasonably necessary to protect the rights, property, or safety of MFUGO, our users, or third parties, or to detect, prevent, or address fraud, security issues, or misuse of the Platform.

We use Google Analytics and may use similar analytics tools to understand how users interact with the Platform and to improve our services. What Analytics May Collect Analytics tools may collect information such as: - Device and browser type - IP address or network information (which may be partially anonymized) - Pages and features visited - Usage patterns and time spent on the Platform - Session information - Referral and traffic source information - Approximate location information where provided by the analytics system - Other technical and usage information How This Information Is Used Analytics information is used to understand Platform usage, identify areas for improvement, measure the effectiveness of features, and improve the overall user experience. We do not use analytics data for advertising personalization. Third-Party Analytics Providers Google Analytics is operated by Google LLC. Information collected through Google Analytics may be processed on servers outside Kenya. Google's privacy practices are described in Google's Privacy Policy. You may opt out of Google Analytics data collection by using the Google Analytics Opt-out Browser Add-on or by adjusting your browser or device settings where applicable. We may use other analytics or measurement tools in the future and will update this policy accordingly.

The Platform may use cookies and similar technologies (such as local storage) to operate and improve the service. Essential Technologies Some technologies are necessary for the Platform to function — for example, to maintain your login session, remember your preferences, and ensure security. These cannot be disabled without affecting Platform functionality. Analytics Technologies As described in Section 9, we use analytics technologies to understand how the Platform is used. These are not required for the Platform to function but help us improve the service. Optional Technologies If we introduce additional optional technologies (such as preference cookies) in the future, we will update this policy and provide appropriate controls where required. We do not currently use advertising cookies or retargeting pixels. If this changes, we will update this Privacy Policy and provide appropriate notice. You can manage cookies through your browser settings. Disabling certain cookies may affect your ability to use some features of the Platform.

Users may upload photographs and other media to the Platform in connection with livestock records, farm profiles, marketplace listings, organization profiles, and other legitimate platform activities. Uploaded media is stored and processed by MFUGO and our infrastructure and storage service providers in order to provide the relevant feature. You retain ownership of photographs and media you upload. By uploading media to the Platform, you grant MFUGO a limited licence to store, display, and process that media for the purpose of providing the Platform features you have requested. We do not claim ownership of your photographs or media merely because they are uploaded to the Platform. You should not upload media that contains personal data about other individuals without appropriate authority, or media that infringes the intellectual property or other rights of third parties.

Some of our service providers may process or store personal data on servers located outside Kenya. Where personal data is transferred outside Kenya, we take steps to ensure that appropriate safeguards are in place in accordance with the requirements of the Kenya Data Protection Act, 2019 and applicable regulations. By using the Platform, you acknowledge that your personal data may be transferred to and processed in countries outside Kenya where our service providers operate. We do not transfer personal data internationally beyond what is necessary to operate the Platform.

MFUGO CONNECT does not currently process payments or collect payment card, mobile money, or other financial payment information through the Platform. Payment functionality is expected to be introduced in the future. When payment functionality becomes available, MFUGO may use third-party payment providers to process transactions. Payment providers may independently process certain financial and payment information in accordance with their own privacy policies and applicable law. We will update this Privacy Policy or provide additional notice before or when payment processing functionality is introduced.

We take the security of personal data seriously and implement reasonable technical and organizational measures to protect it. These measures include: - Access controls to limit who can access personal data - Authentication mechanisms to verify user identity - Encryption of data in transit where appropriate - Secure storage practices - Least-privilege access principles, so that staff and systems only access data necessary for their role or function - Monitoring and logging where appropriate to detect suspicious activity - Security updates and patch management - Backup and recovery practices where appropriate - Confidentiality obligations for staff and service providers - Incident response procedures No internet-based service can guarantee absolute security. While we work to protect your personal data, we cannot guarantee that unauthorized access, disclosure, alteration, or destruction will never occur. You are also responsible for keeping your account credentials secure and for notifying us promptly if you suspect unauthorized access to your account.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including: - Providing the Platform and its features - Maintaining records as required by law or regulation - Meeting legal and regulatory obligations - Resolving disputes and enforcing our agreements - Preventing fraud and security abuse - Legitimate operational and business purposes Deleting your account does not necessarily mean that every record associated with your account is immediately erased. We may retain certain information where retention is required or permitted by law, where it is necessary to resolve a dispute, enforce an agreement, prevent fraud, or for other legitimate purposes. Where personal data is no longer needed, we aim to securely delete or anonymize it in a manner that prevents re-identification. Anonymized data that cannot be linked back to an individual is not personal data and may be retained for analytical or operational purposes.

Under the Kenya Data Protection Act, 2019, you have the following rights in relation to your personal data: Right to Be Informed You have the right to be informed about how we collect and use your personal data. This Privacy Policy is part of how we fulfil that obligation. Right of Access You have the right to request a copy of the personal data we hold about you. Right to Rectification You have the right to request correction of inaccurate or incomplete personal data. Right to Erasure You have the right to request deletion of your personal data in certain circumstances — for example, where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and there is no other lawful basis for processing. Right to Object You have the right to object to processing of your personal data in certain circumstances, including where we rely on legitimate interests as the lawful basis. Right to Restriction You have the right to request that we restrict processing of your personal data in certain circumstances — for example, while a dispute about accuracy is resolved. Right to Data Portability Where processing is based on consent or contract and carried out by automated means, you may have the right to receive your personal data in a structured, commonly used, and machine-readable format. Right to Withdraw Consent Where we rely on consent as the lawful basis for processing, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Rights Relating to Automated Decision-Making Where we make decisions about you solely by automated means that produce legal or similarly significant effects, you may have the right to request human review, to express your point of view, and to contest the decision, subject to applicable law. How to Exercise Your Rights To exercise any of these rights, please contact us using the details in Section 20. We may need to verify your identity before processing your request. We will respond within the timeframes required by applicable law. Limitations Rights are not absolute. We may decline a request or limit our response where permitted by applicable law — for example, where fulfilling the request would adversely affect the rights of others, where retention is required by law, or where the request is manifestly unfounded or excessive.

The Platform is intended for individuals who are of legal age to enter into binding agreements and to manage livestock or business activities under Kenyan law. We do not knowingly collect personal data from individuals who are not of legal age to use the Platform. If you are not of legal age to enter into agreements under Kenyan law, you should not register for or use the Platform without the involvement of a parent, guardian, or authorized representative. If we become aware that we have collected personal data from a person who is not eligible to use the Platform, we will take steps to delete that information. You must be at least 18 years of age to register for or use the Platform. If you are under 18, you must not create an account or submit personal data through the Platform.

We may communicate with you through email, SMS, in-app notifications, and potentially other channels such as WhatsApp in the future. Necessary Service Communications Some communications are necessary to provide the Platform — for example, account registration confirmation, password reset messages, security alerts, and important service or operational notices. These are sent on the basis of our contract with you or our legitimate interests in operating a secure platform. You cannot opt out of necessary service communications while your account is active. Marketing Communications We are not currently sending marketing communications. We intend to introduce marketing communications in the future — for example, updates about new features, platform news, and relevant opportunities. When we do, we will only send marketing communications where you have given appropriate consent or where otherwise permitted by applicable law, and you will be able to opt out at any time by following the unsubscribe instructions in the communication or by contacting us. Marketplace and Procurement Notifications We may send you notifications related to your marketplace listings, supply requests, offers, and procurement activities. These are part of the Platform service and are sent on the basis of our contract with you.

We maintain procedures for identifying, containing, investigating, and responding to personal data security incidents. Where a security incident occurs that is likely to result in a risk to your rights and freedoms, we will notify affected users and/or the Office of the Data Protection Commissioner (ODPC) as required by the Kenya Data Protection Act, 2019 and applicable regulations. The nature, timing, and scope of notifications will depend on the circumstances of the incident and applicable legal requirements. We do not commit to notifying users of every security incident regardless of its nature or legal requirements. If you believe your account has been compromised or that your personal data has been accessed without authorization, please contact us immediately using the details in Section 20.

If you wish to delete your account or request deletion of your personal data, please contact us using the details provided below. We will process your request in accordance with applicable law and this Privacy Policy. As noted in Section 15, deletion of your account does not necessarily mean that every record is immediately erased where retention is legally or operationally required. To exercise any of your data protection rights, including access, correction, deletion, or portability, please contact us at: Phone: +254 748 497 407 Address: Imara Daima, Nairobi, Kenya Data Protection Contact: Francis Karani

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us: MFUGO CONNECT LIMITED Phone: +254 748 497 407 Address: Imara Daima, Nairobi, Kenya Data Protection Contact: Francis Karani We will aim to respond to your enquiry promptly and in accordance with applicable law.

If you are not satisfied with how we have handled your personal data or responded to your request, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya. Office of the Data Protection Commissioner (ODPC) Website: www.odpc.go.ke We encourage you to contact us first so that we have the opportunity to address your concern before you escalate to the ODPC.

We may update this Privacy Policy from time to time as the Platform, our technology, services, or applicable legal requirements change. For material changes, we will provide appropriate notice — for example, by posting a notice on the Platform, sending an email to registered users, or by other means where required by applicable law. The updated Privacy Policy will be effective from the date indicated at the top of the policy. We encourage you to review this Privacy Policy periodically. Continued use of the Platform after a change to this Privacy Policy constitutes your acknowledgement of the updated policy, subject to any additional consent requirements under applicable law.