PRIVACY POLICY AND DATA PROTECTION REGULATION

Last Updated: June 19, 2026

Edenic Technologies Company (T) Ltd. ("we," "us," "our," or "Company") is committed to protecting the privacy, confidentiality, integrity, and security of the personal data and agricultural information collected from users of the EdenVuna SaaS platform. This Privacy Policy ("Policy") explains how we collect, use, process, store, share, and protect your information when you access our application, website, and conversational AI services.

1. COMPLIANCE WITH THE TANZANIA PERSONAL DATA PROTECTION ACT, 2022

This Privacy Policy has been drafted and is enforced in strict compliance with the Tanzania Personal Data Protection Act, 2022 (Act No. 11 of 2022) (hereinafter referred to as the "PDPA 2022") and the Personal Data Protection Regulations, 2023. For the purposes of the PDPA 2022:

• The Data Controller is Edenic Technologies Company (T) Ltd., registered under the laws of the United Republic of Tanzania.
• All processing of personal data is carried out in accordance with the data protection principles defined in Section 22 of the PDPA 2022, ensuring that data is processed lawfully, fairly, transparently, and only for specified, explicit, and legitimate agricultural purposes.

2. CLASSIFICATION OF INFORMATION WE COLLECT

We collect several categories of information to provide and optimize our precision agricultural services:

A. Personal Data (Account & Financial Information)

• Identifiable Information: Name, telephone number, email address, physical location, and mailing address.
• Billing and Payment Records: When you purchase subscriptions or tokens, transaction details are captured (amount, payment method, date). Payment gateway credentials (such as card numbers or mobile money PINs) are processed directly by our secure third-party payment partner (Pesapal) and are never stored on our servers.

B. Agricultural and GIS Data

• Farm Boundaries: GPS coordinates, GIS shapefiles, plot sizes, farm boundaries, and elevations of your agricultural plots.
• Agronomic Logs: Active crop plans, crop varieties, planting schedules, harvest estimates, fertilizer/pesticide logs, and irrigation calendars.
• Soil Diagnostics: Soil pH levels, texture, moisture levels, NPK (Nitrogen, Phosphorus, Potassium) indicators, and organic matter measurements.

C. AI Assistant Interactions & Images

• Chat Transcripts: All text interactions and queries submitted to the conversational AI assistant ("Adam").
• Uploaded Imagery: Photos of crops, leaves, pests, or soil uploaded for diagnostic analysis.

D. Device and Usage Data

• Technical Information: IP address, device type, browser specifications, operating system, and push notification tokens.

3. OPERATIONAL PURPOSES OF DATA PROCESSING

We process your data for the following specific, legitimate agricultural purposes:

1. Personalized Recommendations: Generating specialized crop advice, optimal planting dates, and fertilization ratios based on your soil profiles.
2. Hyper-Local Weather Notifications: Sending rain alerts, wind warnings, or heat stress alerts tailored to your farm's coordinates.
3. Customer Support & AI Optimization: Resolving user inquiries, managing chat histories with Adam, and enhancing the accuracy of agricultural recommendations.
4. Transaction Processing: Managing subscription billings and Pesapal transactions.
5. Anonymized Agronomic Research: Aggregating anonymized regional crop performance metrics and soil profiles to train our AI models and publish localized agricultural insights.

4. LEGAL BASES FOR PROCESSING UNDER TANZANIAN LAW

In accordance with Section 22 of the PDPA 2022, we process your personal data under the following legal bases:

• Performance of a Contract: Processing is necessary to provide the services you subscribed to.
• User Consent: You explicitly grant consent when registering, adding farm locations, and uploading crop photos. You have the right to withdraw your consent at any time.
• Legitimate Interests: To secure our application, prevent fraud, and optimize our proprietary agricultural models.
• Compliance with Legal Obligations: To fulfill accounting, tax, or regulatory requirements in Tanzania.

5. THIRD-PARTY DISCLOSURES AND SUB-PROCESSORS

We do not sell, rent, or trade your personal data or identifiable farm coordinates to marketing agencies or third parties. We share data only with trusted partners necessary for providing the Service:

• Supabase (Data Storage): Our database infrastructure partner. All user data is securely stored on databases managed by Supabase, protected by strict Row-Level Security (RLS) policies.
• OpenRouter (AI LLM Engine): Text queries submitted to Adam are processed through OpenRouter's APIs. Chat transcripts are sent without your personal account identifiers (names or phone numbers).
• Pesapal (Payment Gateway): Financial transaction data is shared to facilitate payment processing and verify token purchases.

We may disclose your data if required by Tanzanian law enforcement, regulatory authorities, or by order of the court.

6. DATA SECURITY AND PROTECTION SYSTEM

We implement advanced administrative, technical, and physical security safeguards to protect your personal and farm data from unauthorized access, loss, alteration, or disclosure:

• Row-Level Security (RLS): Our database architecture enforces RLS at the PostgreSQL level. This ensures that a user can only read and write data that belongs to their verified user ID.
• Data Encryption: All data transmitted between the application and our servers is encrypted using Secure Socket Layer (SSL/TLS) protocols.
• Access Control: Access to backend systems is strictly restricted to authorized developers and administrators on a need-to-know basis.

7. DATA RETENTION AND DELETION

We retain your personal and agricultural data only for as long as your account remains active or as needed to provide you with the Service.

• Account Deletion: You can request the deletion of your account and all associated personal data at any time by contacting our support team.
• Data Erasure: Upon receiving a deletion request, we will permanently delete or anonymize your personal details, farm coordinates, and chat history within thirty (30) days, except where retention is required for compliance with tax or regulatory audits.

8. YOUR RIGHTS UNDER THE PDPA 2022

As a data subject in the United Republic of Tanzania, you have the following statutory rights under the PDPA 2022:

• Right to Access (Section 31): You have the right to request a copy of the personal data we hold about you.
• Right to Rectification (Section 32): You have the right to correct any inaccurate or incomplete personal data.
• Right to Erasure (Section 32): You have the right to request the complete deletion of your data under certain conditions.
• Right to Object (Section 33): You have the right to object to the processing of your personal data for direct marketing or research purposes.
• Right to Restrict Processing: You have the right to temporarily suspend the processing of your data while its accuracy is being verified.

To exercise any of these rights, please contact our Data Protection Officer at privacy@edenictech.com.

9. CROSS-BORDER DATA TRANSFERS

Our storage infrastructure is hosted on secure cloud servers (Supabase) located globally. By accessing the Service, you acknowledge and agree that your data may be transferred to and processed on servers located outside the United Republic of Tanzania. We ensure that all cross-border data transfers are carried out with adequate safeguards in place, in accordance with Section 30 of the PDPA 2022.

10. PROTECTING CHILDREN'S PRIVACY

The Service is not intended for or directed to individuals under the age of eighteen (18). We do not knowingly collect personal data from children under 18. If we discover that a minor under 18 has registered an account and provided personal data without parental consent, we will delete the account and associated files immediately.

11. REVISIONS TO THIS PRIVACY POLICY

We reserve the right to audit and update this Privacy Policy periodically to reflect changes in our services, technologies, or legal obligations. We will notify you of any material changes by posting the updated Policy inside the Vuna application. The "Last Updated" date at the top of the document will reflect the date of the latest revisions.

12. CONTACT INFORMATION

If you have any questions, concerns, or complaints regarding this Privacy Policy or our data protection practices, please reach out to our team:

Data Protection Officer
Edenic Technologies Company (T) Ltd.
Mlimani Tower, Bagamoyo Road
P.O. Box 35091, Dar es Salaam, Tanzania
Email: privacy@edenictech.com
Phone: +255 673 367 899