Privacy Policy

1. Introduction

Savanna HerdIQ ("Savanna HerdIQ", "we", "us") is a communications platform that lets organisations working in Kenya's livestock and agriculture sector — veterinary practices, agrovets, banks, insurers, government agencies, and similar bodies (each, a "Client Organisation") — manage contacts and send SMS and WhatsApp messages, share files, and view reporting on their own messaging activity.

This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with the platform, and your rights under the Kenya Data Protection Act, 2019 (the "DPA") and its regulations. It applies to everyone whose data we process: staff of Client Organisations who hold an account on the platform ("Users"), the farmers, veterinarians, field officers and other individuals a Client Organisation communicates with through the platform ("Contacts"), and visitors to our public pages.

2. Who We Are

Savanna HerdIQ is the operator of this platform and, in respect of Contact data, a data processor acting on the instructions of the Client Organisation that uploaded or created that data. For account and billing data belonging to Users, Savanna HerdIQ is the data controller.

Data Protection queries, and requests to exercise the rights described in Section 9, can be sent to our Data Protection contact at privacy@savanna-herdiq.com.

3. Two Kinds of Personal Data We Handle

It matters, under the DPA, whether Savanna HerdIQ is acting as a controller (deciding why and how data is processed) or a processor (processing data only on someone else's instructions):

• User account data (name, work email, password, role, and the Client Organisation you belong to) is processed by Savanna HerdIQ as controller, so that you can sign in and use the platform.
• Contact data — the names, phone numbers, county/location, contact type (e.g. Farmer, Vet, AgroVet), and any livestock information a Client Organisation uploads or enters into the platform, together with the content and delivery status of messages sent to those individuals — is processed by Savanna HerdIQ as a processor on behalf of that Client Organisation. The Client Organisation is the controller of its own Contacts and is responsible for having a lawful basis (ordinarily consent, or another basis under DPA Section 30) to hold that data and to message those individuals. If you are a Contact and have a question about why you were messaged, please contact the organisation that messaged you directly; we will assist that organisation in responding to you.

4. Information We Collect

• Account information: name, email address, hashed password (we never store passwords in plain text), role, and Client Organisation. If you sign in with Google, we receive your name, email address, and profile photo from Google.
• Contact data (processed on behalf of Client Organisations, as described in Section 3): contact name, phone number, county/location, contact type, group memberships, and livestock records where a Client Organisation records them.
• Messaging and file-sharing data: the content of SMS/ WhatsApp campaigns, the files shared through the platform, and delivery status (dispatched, failed, pending) for each message sent.
• Usage and device data: IP address, browser type, and pages visited, including anonymous view/listen counts recorded against publicly shared articles and files.
• Billing data: message and campaign volumes used to calculate amounts owed by a Client Organisation. We do not collect card or bank details directly on this platform.

5. Our Legal Basis for Processing

Under DPA Section 30, we (or the relevant Client Organisation, for Contact data) rely on one or more of the following bases:

• Consent — for example, a Contact agreeing to receive messages from a Client Organisation.
• Performance of a contract — to provide the platform to a Client Organisation and its Users.
• Legal obligation — for example, responding to a lawful request from the ODPC or another authority.
• Legitimate interests — such as securing the platform against fraud and misuse, which we balance against your rights and freedoms.

6. How We Use Information

• To operate the platform: authenticate Users, send messages Client Organisations compose, and deliver shared files.
• To generate the reporting and dashboards Client Organisations and their Users request, including client-facing campaign reports.
• To calculate and invoice usage-based fees.
• To maintain security, detect abuse, and enforce our Terms and Conditions.
• To comply with legal obligations, including requests from the ODPC or other lawful authorities.

We do not sell personal data, and we do not use Contact data for our own marketing purposes.

7. How We Share Information

We share personal data only where necessary to provide the platform:

• Telecommunications and messaging gateways (SMS aggregators, WhatsApp Business API providers) to deliver the messages a Client Organisation sends — these providers process phone numbers and message content solely to route delivery.
• Cloud infrastructure and storage providers that host the platform and store files on our behalf, under contractual confidentiality and security obligations.
• Other Users within the same Client Organisation, according to the access their organisation has granted their role (for example, a Client-role user only sees their own organisation's aggregate reporting, never other organisations' data).
• Regulators and authorities, where required by Kenyan law, including the ODPC, the Communications Authority of Kenya, or a court of competent jurisdiction.

8. Cross-Border Data Transfers

Some of the infrastructure providers referred to in Section 7 may process or store data outside Kenya. Where that occurs, we take steps required by DPA Sections 48–50 to ensure the data remains protected to a standard comparable to Kenyan law — for example, by using providers in countries recognised as having adequate data protection, or by entering into contractual safeguards with them.

9. Your Rights

Subject to the DPA, you have the right to:

• Be informed of how your personal data is used (this Policy is part of that).
• Access the personal data we hold about you.
• Request correction of inaccurate or outdated data.
• Request deletion of your data, subject to any legal retention requirement.
• Object to, or request restriction of, certain processing.
• Request a copy of your data in a portable format, where technically feasible.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke if you believe your rights have been infringed.

To exercise these rights over your own User account data, contact us at the address in Section 2. If your request concerns Contact data held by a Client Organisation, we will direct you to that organisation, or assist it in responding, since it is the controller of that data.

10. Data Retention

We retain User account data for as long as the account is active, and Contact and messaging data for as long as the relevant Client Organisation keeps it on the platform, plus any additional period needed to meet legal, accounting, or dispute-resolution obligations. A Client Organisation may request deletion of its own Contact data at any time, subject to those obligations.

11. Data Security

We use industry-standard safeguards — including encrypted connections, access controls tied to user roles, and hashed password storage — to protect personal data against unauthorised access, alteration, or loss. No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet. In the event of a data breach likely to result in a real risk of harm, we will notify the ODPC and affected individuals as required by DPA Section 43.

12. Children's Data

The platform is intended for use by adults acting on behalf of organisations, and is not directed at children. We do not knowingly collect personal data from children through this platform.

13. Cookies and Similar Technologies

We use essential cookies and local storage to keep you signed in and remember your preferences (such as light/dark theme). We do not use third-party advertising cookies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last Updated" date above, and — where you hold an account — we will ask you to reconfirm your agreement the next time you sign in.

15. Governing Law

This Privacy Policy is governed by the laws of Kenya, including the Data Protection Act, 2019 and its regulations.