Data Processing Agreement

I. INTRODUCTORY PROVISIONS

1. Purpose

The purpose of this Agreement is to establish the obligations and responsibilities of the Controller and Processor regarding the processing of personal data through the Platforms. In the event of any conflict between this Agreement and the Terms of Use regarding personal data processing, this Agreement shall prevail.

2. Definitions

• "Controller" means the individual, farm, cooperative, company, institution, organization, or entity that determines the purposes and means of processing personal data through the Platforms.
• "Processor" means Umufasha SmartFarms Ltd.
• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Processing" means any operation performed on personal data including collection, recording, storage, organization, retrieval, use, transmission, disclosure, deletion, or destruction.
• "Data Subject" means the individual to whom personal data relates.
• "Sub-Processor" means any third party engaged by the Processor to assist in providing services involving personal data processing.
• "Personal Data Breach" means a security incident resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data.

II. SUBJECT MATTER OF THE AGREEMENT

This Agreement authorizes the Processor to process personal data on behalf of the Controller solely for the purpose of providing the Platforms and associated services. The Agreement specifies the nature and purpose of processing, categories of personal data processed, categories of data subjects, rights and obligations of both parties, security measures, procedures for data breach management, and requirements relating to sub-processors.

III. NATURE, PURPOSE, AND SCOPE OF PROCESSING

1. Categories of Data Subjects

Personal data processed through the Platforms may relate to:

• Farm owners;
• Farm managers and employees;
• Veterinary personnel;
• Cooperative staff;
• Agribusiness personnel;
• Suppliers, contractors, and customers;
• Other individuals whose information is entered into the Platforms by the Controller.

2. Categories of Personal Data

Depending on Platform usage, personal data may include:

3. Purpose of Processing

The Processor shall process personal data solely for the purpose of:

• Providing Platform functionality;
• Hosting and storing data;
• Generating reports and analytics;
• Delivering AI-powered recommendations;
• Providing technical support;
• Maintaining Platform security;
• Monitoring system performance;
• Improving Platform services;
• Complying with legal obligations.

4. Duration of Processing

Personal data shall be processed for the duration of the Controller's use of the Platforms and any legally required retention period. Following termination of services, personal data shall be deleted or returned in accordance with Section XII of this Agreement.

IV. OBLIGATIONS OF THE PROCESSOR

The Processor shall:

• Process personal data only on documented instructions from the Controller unless otherwise required by law;
• Ensure all personnel authorized to process personal data are subject to confidentiality obligations and receive appropriate training;
• Implement appropriate technical and organizational measures to protect personal data;
• Provide reasonable assistance to the Controller in fulfilling obligations relating to access, correction, deletion, and restriction requests;
• Notify the Controller without undue delay after becoming aware of a Personal Data Breach;
• Maintain records of processing activities where required by applicable law.

V. OBLIGATIONS OF THE CONTROLLER

The Controller shall:

• Ensure lawful collection of personal data;
• Obtain all required consents where necessary;
• Provide lawful instructions to the Processor;
• Ensure the accuracy of personal data submitted;
• Comply with applicable data protection laws;
• Respond to data subject requests where legally required.

VI. SECURITY OF PROCESSING

The Processor shall implement appropriate technical and organizational measures, including:

• Access controls and user authentication;
• Password protection and encryption of data in transit;
• Secure hosting environments and backup procedures;
• Monitoring, logging, and vulnerability management systems;
• Employee confidentiality obligations.

VII. SUB-PROCESSORS

VIII. INTERNATIONAL DATA TRANSFERS

Where personal data is transferred outside Rwanda, the Processor shall implement appropriate safeguards to ensure adequate protection of personal data, including contractual protections, security certifications, regulatory compliance mechanisms, and other legally recognized transfer mechanisms.

IX. DATA SUBJECT RIGHTS

The Processor shall provide reasonable assistance to enable the Controller to respond to requests relating to access, rectification, erasure, restriction of processing, data portability, and objection to processing. The Controller remains responsible for determining whether requests should be fulfilled.

X. PERSONAL DATA BREACHES

In the event of a Personal Data Breach, the Processor shall investigate the incident, take reasonable measures to mitigate harm, notify the Controller without undue delay, provide relevant information regarding the incident, and cooperate with the Controller regarding remediation efforts.

XI. AUDITS AND INSPECTIONS

Upon reasonable written notice, the Controller may request information demonstrating compliance with this Agreement. Where necessary and reasonable, audits may be conducted in a manner that does not compromise other customers' data, does not disrupt business operations, and maintains confidentiality obligations. The parties shall cooperate in good faith regarding audit requests.

XII. RETURN AND DELETION OF DATA

Upon termination of services or upon written request from the Controller, the Processor shall return personal data where technically feasible or delete personal data from active systems. Unless otherwise required by law, deletion shall occur within thirty (30) days following termination. Backup copies may remain temporarily stored until routine deletion cycles are completed.

XIII. CONFIDENTIALITY

All confidential information exchanged under this Agreement shall remain confidential unless disclosure is required by law, information becomes publicly available through no fault of the receiving party, or the disclosing party provides prior written consent. Confidentiality obligations shall survive termination of this Agreement.

XIV. TERM AND TERMINATION

This Agreement becomes effective upon acceptance of the Terms of Use, creation of an account, or use of the Platforms. Termination of the Terms of Use shall automatically terminate this Agreement. Certain provisions, including confidentiality and liability provisions, shall survive termination.

XV. LIMITATION OF LIABILITY

Liability under this Agreement shall be subject to the limitations contained in the Terms of Use unless prohibited by applicable law. Nothing in this Agreement limits liability for intentional misconduct, fraud, or violations that cannot legally be excluded.

XVI. GOVERNING LAW AND DISPUTE RESOLUTION

This Agreement shall be governed by the laws of the Republic of Rwanda. The parties shall attempt to resolve disputes through good-faith negotiations. Where resolution cannot be achieved, disputes shall be submitted to the competent courts of Rwanda.

XVII. CONTACT INFORMATION

For privacy-related inquiries, data subject requests, or questions regarding this Agreement, contact us at privacy@umufashasmartfarms.com or +250 787 921 092.