Privacy Policy

1. Who We Are

CassavaTrack is a digital seed certification and traceability platform built and operated by Spectlance Digital LTD, in collaboration with the Kenya Plant Health Inspectorate Service (KEPHIS).

For the purposes of data protection law, Spectlance Digital LTD is the data controller for personal data processed through this platform.

2. Data We Collect

We collect the following categories of personal and operational data:

Registration & Identity

• Full name, national ID / passport number
• Organisation name, role (Farmer, Breeder, Inspector, Processor, Miller, etc.)
• Phone number and email address
• County and agroecological zone of operation
• KEPHIS registration number (where applicable)

Agricultural & Operational Data

• Farm records — name, location, GPS coordinates, size (acres)
• Seed lot records — lot codes, variety, quantity, certification class, QR codes
• Inspection records — dates, outcomes, inspector notes, photographs
• Certificates of seed quality issued by KEPHIS
• Lot transfer records — sender, recipient, quantities, dates
• Marketplace listings — produce type, quantities, prices posted
• Order records — buyer details, quantities ordered, payment references
• Tuber listings — harvest time, perishability data, pricing
• Price board postings — buying prices offered by processors

Usage & Technical Data

• Login timestamps and session duration
• USSD session data — phone number, menu path, session duration
• Device type, browser type, IP address (web access logs)
• Offline sync records (mobile app)
• Notification read/unread status

3. How We Use Your Data

We use the data collected for the following purposes:

• Seed chain management — tracking seed lots from breeder to farmer across Kenya
• Certification & inspection — scheduling KEPHIS inspections and issuing digital certificates
• Marketplace facilitation — connecting certified seed sellers with verified buyers
• Price intelligence — sharing market prices to support fair trade for smallholder farmers
• Traceability — enabling public QR-code verification of seed lot provenance
• USSD access — allowing feature phone users to access lot status, prices, and orders without internet
• Reporting & analytics — generating programme reports for Spectlance Digital LTD and development partners
• Communications — sending SMS/email alerts for inspections, certifications, and expiry reminders
• Account security — verifying identity, managing access control, and preventing fraud

Legal basis (Kenya Data Protection Act 2019): Processing is necessary for the performance of a programme to which you have registered; for compliance with a legal obligation (KEPHIS regulations); and in the legitimate interests of supporting Kenya's seed value chain.

4. Data Sharing

We do not sell your personal data. We share it only as described below:

• KEPHIS — inspection outcomes, certification records, and lot registration data are shared as required by the Seeds and Plant Varieties Act.
• Other platform actors — your organisation name, county, and phone number are visible to actors you transact with (e.g. a buyer can see a seller's contact details on an order).
• Development partners / donors — anonymised and aggregated programme statistics only (e.g. number of certified lots, hectares covered).
• Law enforcement — if required by Kenyan law or a valid court order.

5. Data Retention

We retain your data for as long as your account is active and for a period thereafter as required by programme obligations and Kenyan law:

• Account & registration data — retained for the duration of your registration plus 5 years after closure.
• Seed lot & certificate records — retained for 10 years to support traceability and regulatory requirements.
• Inspection records — retained for 7 years.
• Marketplace orders — retained for 5 years.
• USSD session logs — retained for 90 days then automatically purged.
• System audit logs — retained for 2 years.

6. Your Rights

Under the Kenya Data Protection Act 2019, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data where there is no overriding legitimate reason to retain it.
• Right to object — object to processing based on legitimate interests.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@spectlance.com. We will respond within 21 days. If you are unsatisfied with our response, you may lodge a complaint with the Office of the Data Protection Commissioner of Kenya.

7. Cookies & Session Storage

CassavaTrack uses the following browser storage mechanisms:

• Session cookies — strictly necessary for login and authentication. Deleted when you close your browser.
• Persistent cookies — used to remember your preferences (e.g. dark mode, sidebar state). Expire after 30 days.
• localStorage — used client-side only to store UI preferences such as dark mode and sidebar collapsed state. Not transmitted to our servers.

We do not use third-party advertising or tracking cookies. Analytics, if implemented, will use anonymised data only.

8. Security

We implement appropriate technical and organisational measures to protect your data:

• Passwords are hashed using industry-standard algorithms — never stored in plain text.
• All data transmission is encrypted in transit using TLS/HTTPS.
• Role-based access control (RBAC) restricts access to data on a need-to-know basis.
• Administrative actions are logged in an audit trail.
• Database backups are encrypted and stored securely.
• Regular security reviews are conducted by Spectlance Digital LTD.

No method of data transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. Please notify us immediately at privacy@spectlance.com if you suspect a security breach.

9. Children's Privacy

CassavaTrack is intended for use by adults engaged in agricultural activities. We do not knowingly collect personal data from persons under the age of 18. If you believe a minor has registered on the platform, please contact us so we can remove their data.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. The effective date at the top of this page will be updated whenever changes are made.

For material changes, we will notify registered users via email or in-app notification at least 14 days before the changes take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact: