Privacy Policy

Effective date: 24 October 2026

1. Who we are

This website, agrictrail.africa, is operated by AgricTrail Trade Ltd, a company registered in Nigeria under RC 9059061, with its address at House 5, Road 2, Peace Estate, Odoiragunshin, Epe, Lagos, Nigeria.

In this policy, "AgricTrail", "we", "us" and "our" refer to AgricTrail Trade Ltd.

AgricTrail Trade Ltd determines how personal data collected through this website is used and is responsible for handling that data in accordance with applicable data protection law, including the Nigeria Data Protection Act 2023 (NDPA) and applicable guidance issued by the Nigeria Data Protection Commission (NDPC). AgricTrail Trade Ltd is registering with the NDPC as a data controller of major importance.

For questions about your personal data, to exercise your rights, or to raise a privacy concern, contact:

Email: support@agrictrail.africa

Data Protection Officer: Obalolu Okeowo, obalolu@agrictrail.africa

Postal address: House 5, Road 2, Peace Estate, Odoiragunshin, Epe, Lagos, Nigeria.

This policy covers the public website at agrictrail.africa. The AgricTrail application at app.agrictrail.africa may process additional information, including identity, farm and payment data. Please refer to the app's separate privacy notice for information about those activities.

2. Personal data we collect and why

We collect information that you provide through our website forms and chat assistant, together with limited technical information needed to operate and protect the website.

2.1 Information submitted through forms

Contact enquiries. We collect your name, email address, topic, country and message. You may also provide your organisation. We use this information to respond to your enquiry and manage any necessary follow-up. Our lawful basis is our legitimate interest in responding to communications directed to us.

Resource requests. We collect your name, email address and the resource you request. You may also provide your organisation, role and a message. We use this information to provide or respond to your resource request and, where appropriate, follow up about that request. A resource request does not automatically subscribe you to marketing or build updates. Our lawful basis is our legitimate interest in fulfilling and responding to the request.

Ecosystem directory submissions. We collect information about the organisation you want listed, including relevant organisation details, and your name, email address and relationship to the organisation. We use the organisation information to create and manage a directory listing and use your contact details to communicate with you about it.

The organisation details displayed publicly may include its name, country, organisation type, website, description, value chains, services and areas covered. Your personal name and email address are never published.

We rely on your consent, given by ticking the box on the form, to publish the listing; you can withdraw it at any time. We use your contact details to manage the submission and listing on the basis of our legitimate interest in administering the directory. You should submit an organisation's information only if you are authorised to do so.

Partnership enquiries. We collect your name, organisation, email address and, where supplied, your role, country, interests and message. We use this information to consider and respond to partnership enquiries. Our lawful basis is our legitimate interest in assessing and responding to communications about potential collaboration. Submitting an enquiry does not automatically subscribe you to updates or establish a partnership.

Agriculture Pulse newsletter and build updates. For Agriculture Pulse, we collect your email address or WhatsApp number, your role and your state. For build updates, we collect your email address. We use these details to send the updates you requested: the Agriculture Pulse every two weeks, or AgricTrail build updates. Role and state information is used to make later issues more relevant to you.

Our lawful basis is your consent, given by ticking the box on the form. For email, we also ask you to confirm your subscription through a link in a first confirmation email. You can withdraw consent or unsubscribe at any time.

Careers interest. We collect your name, email address and area of interest. We use this information to contact you about relevant roles or opportunities. Our lawful basis is your consent. Submitting an expression of interest does not guarantee an interview or employment.

Investor interest. We collect your name, organisation, email address, country, type of interest and message. We use this information to respond to investment-related enquiries. Our lawful basis is our legitimate interest in assessing and responding to communications about potential investment.

Please do not submit identity documents, bank details, passwords, confidential financial documents or other sensitive information through any website form, including the investor form. If further information is needed, we will ask for it through an appropriate channel and explain what is required.

2.2 Chat assistant

You may enter questions into the website's AI-powered chat assistant. We use the questions you submit to generate responses through our AI service provider, Anthropic. Our lawful basis is our legitimate interest in answering visitors' questions.

Please do not enter passwords, authentication codes, identity numbers, payment card details, confidential business information or other sensitive personal information into the chat assistant.

AgricTrail does not store chat transcripts in its own website database. Anthropic deletes submitted questions within 30 days, keeping them longer only to enforce its usage rules or where the law requires.

2.3 Automatically collected technical information

To help prevent repeated spam submissions, the website temporarily keeps a one-way fingerprint derived from your network address in server memory for 10 minutes. It is not saved and cannot be turned back into the network address.

Our hosting infrastructure records technical server logs, such as page requests and errors. These logs are retained for 30 days.

We also keep separate records of changes made to our systems by authorised staff. These records are retained for 400 days.

We keep form contents out of these technical logs.

2.4 Analytics and advertising

The website does not use analytics or advertising tracking tools.

If we introduce analytics or other tracking technologies, we will update the relevant notices before doing so and obtain consent where required.

3. How we use personal data

We use personal data to:

• respond to enquiries and resource requests;
• administer and maintain public directory listings;
• communicate about partnership, careers and investment enquiries;
• send newsletters and build updates to people who have subscribed;
• operate the website and chat assistant;
• protect the website against spam, misuse and security incidents;
• comply with applicable legal obligations and establish, exercise or defend legal claims where necessary.

We do not sell personal data.

We do not use an enquiry submission as automatic permission to send unrelated marketing communications.

4. Who processes personal data for us

We use third-party service providers to operate the website and deliver the functions described in this policy. Our current providers are:

Google Firebase and Cloud Firestore. Used to store website form submissions. Location: Johannesburg, South Africa.

Google App Hosting. Used to run the website and its technical server logs. Location: United States (Iowa).

Anthropic (Claude). Used to generate answers from the website's AI chat assistant. Location: United States.

Brevo. Used to send the website team email notifications about form submissions and to manage the Agriculture Pulse email list, confirmation emails and newsletter distribution. Location: Belgium (Brevo's data is stored on Google Cloud).

Go54. Used to host AgricTrail's team email. Form notifications are received in team mailboxes and may be forwarded to colleagues' AgricTrail mailboxes. Location: South Africa.

Dyrected. Used to host website content, including public ecosystem directory listings (organisation details only). Location: Europe.

Google Maps, YouTube and Vimeo. Used to display a map or videos on relevant pages. These external services are loaded only after you choose to display the map or play a video. When loaded, they may receive technical information such as your network address and browser details and may use their own cookies or similar technologies.

Provider services, infrastructure and contractual terms can change. We will review this list when material changes occur and update the policy where necessary.

5. International transfers

Some providers process or store information outside Nigeria: form submissions and team mailboxes in South Africa, the website and chat assistant in the United States, emails and the newsletter list in Belgium, and website content in Europe.

Before making or continuing a transfer, AgricTrail Trade Ltd assesses the applicable transfer mechanism and the protections available to the personal data under Part VIII of the Nigeria Data Protection Act 2023, including sections 41–43, and applicable NDPC guidance. We send personal data outside Nigeria only where the provider is bound by a data protection law or by contract terms that protect it, or where another lawful ground recognised by the Act applies. We document the transfer basis and our assessment of the relevant safeguards.

The fact that a provider has published terms, a privacy policy or a data processing agreement does not, by itself, establish that every transfer meets Nigerian legal requirements. We review the terms applicable to the service, the data involved, processing locations and relevant onward transfers.

6. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, subject to applicable legal obligations and the need to establish, exercise or defend legal claims.

Our retention schedule is:

• Contact, resource, partnership and investor enquiries: up to two years after our last contact with you.
• Newsletter and build-update subscriptions: until you unsubscribe or withdraw consent. After that we keep only your email address or WhatsApp number on a do-not-send list, so we never contact you again by mistake.
• Directory listings: while the listing remains published and for up to one additional year after removal, where necessary to manage questions or disputes relating to the listing.
• Careers interest: up to one year, unless a different period is justified and communicated for a particular recruitment process.
• Technical server logs: 30 days.
• Staff system-change records: 400 days.
• Spam-prevention fingerprints: 10 minutes, in server memory only.
• Chat assistant questions: not stored by AgricTrail; Anthropic keeps them for up to 30 days, as explained in section 2.2.

After these periods we delete the data or make it anonymous, including copies in team email inboxes and forwarded messages. We do not copy form submissions into spreadsheets. Our Data Protection Officer carries out this deletion every three months.

Our database is backed up daily and each backup is kept for 14 weeks; a separate recovery copy covers the previous seven days. Data we delete is therefore gone from every backup within 14 weeks. Backups are used only to restore the service after a fault, never to bring back deleted data for any other purpose. Where data is restored from a backup, we will apply appropriate procedures to honour valid deletion and retention requirements.

Retention periods are reviewed periodically and may be adjusted where necessary to meet legal, security or operational requirements.

7. Security

We use appropriate technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration, disclosure or misuse.

These measures include restricting access to form submissions to authorised AgricTrail staff, using encrypted connections for the website and keeping personal information out of technical logs.

No internet transmission or storage system can be guaranteed to be completely secure. We review and improve our safeguards as appropriate to the risks and nature of the processing.

8. Your data protection rights

Subject to applicable law and any relevant exceptions, you may have the right to:

• request access to personal data we hold about you;
• request a copy of that data;
• request correction of inaccurate or incomplete information;
• request erasure of personal data;
• request restriction of certain processing;
• object to processing where the law provides that right;
• request data portability where applicable;
• withdraw consent where processing relies on consent; and
• complain to the Nigeria Data Protection Commission.

To exercise a right, email support@agrictrail.africa. Please identify the form or interaction concerned and provide enough information for us to locate the relevant data. We may need to verify your identity before acting on a request.

We aim to respond within 30 days after receiving the information reasonably necessary to handle your request. This is our response target, not a statement that every statutory deadline is 30 days. Where a different statutory period, lawful extension or exception applies, we will handle the request in accordance with applicable law and explain the position where required.

We may retain information where the law requires it or where a lawful and necessary reason applies. Withdrawing consent does not invalidate processing that lawfully took place before withdrawal.

You may also contact the Nigeria Data Protection Commission through its official website: https://ndpc.gov.ng/.

9. Personal data breaches

We maintain procedures to identify, assess, contain and respond to suspected personal data breaches.

Where section 40 of the Nigeria Data Protection Act 2023 applies, we will notify the Nigeria Data Protection Commission within the statutory period, including within 72 hours of becoming aware of a breach where the Act's notification threshold is met. Where a breach is likely to pose a high risk to the rights and freedoms of affected individuals, we will notify those individuals as required by law.

We record relevant breaches, assess their effects, take steps to limit harm and implement appropriate remedial measures.

Privacy and breach reports can be sent to support@agrictrail.africa or to our Data Protection Officer at obalolu@agrictrail.africa.

10. Children

This website is intended for a general audience and is not directed at children under 18. We do not knowingly collect personal data from children through the website.

If you believe a child has submitted personal data to us, contact support@agrictrail.africa so we can assess the circumstances and take appropriate action.

11. Third-party websites and services

Our website may link to external websites or display content from third-party services. Those services are governed by their own terms and privacy practices. We encourage you to review their notices when you choose to access them.

The fact that we link to or display an external service does not, by itself, mean that AgricTrail endorses all of its content or practices.

12. Changes to this policy

We may update this policy when our website, processing activities, service providers or legal obligations change.

We will publish the revised policy on this page and update the "Last updated" date. Where required by law, we will provide additional notice or seek consent before implementing a material change.

13. Contact

For privacy questions, requests or complaints:

AgricTrail Trade Ltd

House 5, Road 2, Peace Estate, Odoiragunshin, Epe, Lagos, Nigeria

Email: support@agrictrail.africa

Data Protection Officer: Obalolu Okeowo, obalolu@agrictrail.africa