Privacy Policy

The entity responsible for processing your personal data ("data controller") is:

We collect the following categories of personal data when you register for or use FarmOpt:

Account Data

Full name, email address, phone number, country of residence, preferred language, and user role (farmer, buyer, donor, agronomist, or organisation). This information is provided directly by you during registration or profile updates.

Farm & Livestock Data

Information you enter about your farm, including location (GPS coordinates or region), land area, crop types, planting and harvest dates, input usage (seeds, fertilisers, pesticides), yield records, livestock counts, health events, and any photos or documents you upload. This data is central to the service and is stored under your account.

Usage & Technical Data

IP address, device type and operating system, browser type and version, pages visited, features used, session duration, error logs, and approximate geolocation derived from IP. This data is collected automatically when you access FarmOpt to ensure platform stability and security.

Payment Information

Where paid subscriptions or marketplace transactions are applicable, we collect transaction reference numbers, payment method type (e.g., mobile money, card), and billing country. Full card numbers and sensitive payment credentials are processed exclusively by our PCI-DSS-compliant payment processors and are never stored on FarmOpt servers.

Communication Data

Any messages you send to our support team, posts and replies in the community forum, AI assistant queries, feedback submissions, and responses to surveys. If you contact us by email or phone, we retain a record of that correspondence.

We use your personal data for the following purposes:

• Providing the FarmOpt platform — creating and managing your account, displaying your farm dashboard, processing marketplace transactions, and delivering AI-powered recommendations.
• Improving features and performance — analysing aggregated, anonymised usage patterns to fix bugs, optimise the user interface, and develop new tools that better serve farmers.
• Sending service notifications — account security alerts, harvest reminders, marketplace activity, payment receipts, and important updates about the platform. You may manage notification preferences in your account settings.
• Customer support — responding to your questions, resolving disputes, and troubleshooting technical issues you report to us.
• Safety and fraud prevention — detecting and preventing fraudulent listings, account takeovers, spam, or other harmful activity on the platform.
• Complying with legal obligations — retaining records as required by German commercial law and tax regulations, responding to lawful requests from public authorities, and fulfilling obligations under the GDPR (Art. 6).
• Research and impact reporting — producing anonymised, aggregated reports on agricultural outcomes for funders, donors, and development partners. No individual farmer is identified in these reports.

For users located in the European Economic Area (EEA) and the United Kingdom, we rely on the following legal bases under the GDPR:

African Data Protection Laws

For users located in Africa, we also comply with applicable national and regional data protection frameworks, including the Nigeria Data Protection Regulation (NDPR), the Kenya Data Protection Act (PDPA 2019), the South Africa Protection of Personal Information Act (POPIA), the Ghana Data Protection Act, and the Rwanda Law on Personal Data Protection. Where local law provides stronger protections than the GDPR, those stronger protections apply to you.

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• Hosting and infrastructure providers — we use cloud infrastructure hosted within the European Union (Germany) to store and process data. These providers act as data processors under GDPR-compliant data processing agreements.
• Payment processors — when you make a payment, transaction data is shared with our PCI-DSS-certified payment partners solely to complete the transaction. Payment processors are contractually prohibited from using your data for any other purpose.
• Agricultural authorities and NGO partners — we may share anonymised, aggregated statistics with government agricultural agencies, development organisations (e.g., FAO, AGRA, GIZ), or research institutions to support food security initiatives. No individual farmer is identifiable in these reports.
• Legal compliance — we may disclose data to law enforcement or regulatory authorities when required by a valid legal obligation, court order, or to protect the rights and safety of our users and third parties.
• Business transfers — if expAIrience GmbH undergoes a merger, acquisition, or asset sale, user data may be transferred to the acquiring entity. We will notify you in advance and you will retain your data rights.

We retain your data only as long as necessary for the purposes described in this policy or as required by law:

After the applicable retention period, data is securely deleted or irreversibly anonymised.

Under the GDPR and applicable local law, you have the following rights regarding your personal data:

To exercise any of these rights, email change@expairience.de with the subject line "Data Rights Request". We will respond within 30 calendar days.

FarmOpt uses a minimal cookie approach:

We do not use advertising trackers, behavioural profiling cookies, or third-party analytics services (such as Google Analytics or Meta Pixel). We do not share cookie data with any advertising network. Because we use only technically necessary cookies, no cookie consent banner is required under ePrivacy Directive guidelines; however, you may block or delete cookies in your browser settings at any time, noting that this will affect platform functionality.

FarmOpt's primary servers are located in Germany, within the European Union. The EU is recognised as providing an adequate level of data protection under GDPR Chapter V.

When you access FarmOpt from a country outside the EU — for example, from Nigeria, Kenya, Rwanda, or South Africa — your data is transmitted securely over HTTPS to our EU servers. This international transfer is covered by:

• Contract performance (Art. 6(1)(b) GDPR) — the transfer is necessary to provide you with the service you requested.
• Appropriate safeguards (Art. 46 GDPR) — all third-party sub-processors operating outside the EU are required to sign Standard Contractual Clauses (SCCs) approved by the European Commission.

We do not transfer data to countries with no adequate data protection framework without your explicit consent or without ensuring equivalent contractual protections are in place.

For all data protection enquiries — including access requests, deletion requests, portability requests, and complaints — please contact us at:

We aim to acknowledge all data requests within 5 business days and to fulfil them within 30 calendar days of receipt. Where a request is complex or involves a large volume of data, we may extend this period by a further 60 days — in which case we will notify you of the extension and the reason for it.

We may update this Privacy Policy from time to time to reflect changes in the law, our services, or our data practices. All changes are posted on this page with a revised "Last updated" date at the top.

For material changes — those that significantly affect how we collect or use your data, or that reduce your rights — we will provide at least 30 days' advance notice via:

• A prominent notice displayed when you next log in to FarmOpt, and
• An email notification to the address associated with your account.

Your continued use of the platform after the effective date of any updated policy constitutes your acceptance of the changes. If you do not agree with a material change, you may delete your account before the change takes effect and request deletion of your data under Section 7.