Privacy Notice 

01Who we are and how to reach us

For the personal data described in this notice, Poultrack is a product of Bahman Limited (RC 8691357), and Bahman Limited is the data controller: we decide why and how it is used.

We have a person responsible for data protection (our Data Protection Officer). You can reach them through the contact page, choosing "Privacy or data request", or by email at privacy@poultrack.com. We register with the Nigeria Data Protection Commission (the "Commission") as the law requires.

02The laws we follow

• The Nigeria Data Protection Act 2023 (NDPA). It sets the lawful bases, your rights, the rules for sending data abroad, and our duty to tell the Commission about a breach.
• The Nigeria Data Protection Regulation 2019 (NDPR) and its implementation framework, to the extent they still apply alongside the NDPA.
• The General Application and Implementation Directive 2025 (GAID) issued by the Nigeria Data Protection Commission, which sets out how organisations must register, appoint a Data Protection Officer, assess risk, keep records and report each year.
• The GDPR and UK GDPR, for people in the European Economic Area or the United Kingdom.
• Other Nigerian law that touches personal data, including the Cybercrimes Act 2015, the Federal Competition and Consumer Protection Act 2018, and the rules of the Nigerian Communications Commission on text messages.

Because Poultrack handles identity numbers, bank details and farm locations for many people, we treat ourselves as a data controller and processor of major importance. That means we register with the Commission, keep a Data Protection Officer, carry out a data protection impact assessment for high-risk processing, keep a written record of what we process and why, and file the audit and returns the Commission requires each year.

03When we are the controller and when we are the processor

There are two situations, and the difference matters to you.

• Your own account. For your name, contact details, sign-in details, verification documents, payments and how you use Poultrack, we are the controller.
• The records you keep about other people. A farm owner who records customers, workers or suppliers in Poultrack is the controller of that information, and Poultrack is the processor: we store and handle it only on the owner's instructions and to provide the Services. If you are one of those people and want to see or correct your information, we will help you reach the owner who holds it.

04The personal data we collect

The NDPA calls some data "sensitive": genetic and biometric data, race or ethnic origin, religious or political belief, health, sex life, trade union membership, and similar. We do not ask for any of it, and ask you not to put it in free-text fields. If you do, we treat it as sensitive and use it only to do what you asked. Government identity numbers are not sensitive in themselves but we treat them with extra care: they are encrypted, shown to you only in part, and seen in full only by the staff who check them, each time being recorded.

05Why we use personal data, and our lawful basis

The NDPA lets us use personal data only where we have a lawful basis. These are ours.

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object to that use (see "Your rights").

06Your choices: statistics, the map and marketing

When you sign up we ask separately, and with every box empty, whether you agree to three optional uses. Saying no does not change what you can do in Poultrack. You can change any of them at any time in Settings. We keep the date you agreed or withdrew.

• Data analytics. If you agree, we combine your records with those of other farms, remove names and contact details, and use the totals to produce statistics such as average egg output and mortality by state. We may share those combined statistics with partners such as researchers, feed and medicine companies, lenders, insurers or government bodies. We share only combined figures, never a record that can be traced to you, and we do not publish a figure for any group smaller than 5 farms.
• Poultry Map. If you own a farm and agree, your farm is counted on the public map by state and approximate area. We never show your name, address, exact location or figures. A state appears with real numbers only when at least 5 farms there have agreed; until then the map shows labelled sample data.
• Marketing. If you agree, we email you tips and news. Every marketing email has an unsubscribe link. Service messages such as confirmation codes and receipts are not marketing and are not affected.

If you withdraw, we stop using your records for statistics from that moment and remove your farm from the map straight away. Figures already combined into past statistics cannot be taken back out, because they no longer identify anyone.

07Delivery tracking, sensors and cameras

Some tools use location or live data. This is what happens with each.

• Following a delivery. A farm can send a customer a link to follow their delivery, and a rider a link to share their location. The rider's phone asks permission before it shares, shares only after the rider taps Start and while the page is open, and stops when the delivery is finished. The customer sees the rider's position only while the delivery is in progress. We keep the locations for 14 days, then delete them.
• The delivery code. The customer reads a 4-digit code to the rider to confirm they received the order. We store it encrypted and show it only to the person receiving the delivery: the customer, or the buyer of a marketplace order. For a farm's own deliveries the farm sees it too. A seller or delivery partner never sees it, so they cannot finish a delivery without the receiver. After 5 wrong tries it is locked and the people involved are told.
• Customers and riders without an account. They open a private link and need no account. A link works only for that one delivery. The page shows the farm, the order and the delivery address to the person who holds the link, so please send it only to the right person.
• Temperature sensors. A farm connects its own sensors with a private key. We store the readings for 90 days.
• Cameras. A farm gives us the address of its own camera stream and we show it to the farm's owner and managers. We do not record or store video, and we store the address encrypted.

A farm that adds a rider, a team member or a camera in a place where people work is responsible for telling them, as the Terms explain.

08Alerts and messages we send you

• In the app. Alerts appear in the bell. These are part of the service.
• By email. Alerts about orders, payments, deliveries, vet cases, document checks, your plan and your farm are also emailed to you. This is a service message, so it is on by default. Every email has a link to turn it off, and you can turn it off in Settings at any time.
• By WhatsApp or SMS. These are off until you switch them on. To protect the person who owns a number, we first send a code to it, and we use the number only once you enter the code. You can switch them off in Settings, or by replying STOP.
• We do not send marketing by WhatsApp or SMS. Marketing emails need your separate consent (see above).

Messages by WhatsApp go through Meta's WhatsApp Business Platform and text messages through a licensed Nigerian messaging provider, and they see the number and the message so they can deliver it. We use only those that are listed here, and we update the list when it changes. We send text messages in line with the rules of the Nigerian Communications Commission.

09Who we share personal data with

We do not sell personal data. We share it only in these ways, and only as far as needed.

• The other person in a transaction. When you order, sell, request a vet or post or take a delivery, the other person sees what they need to complete it: names, business names, the item, the price, delivery addresses and contact details.
• Your team. People you invite see what their role allows. The owner controls this.
• Staff who verify accounts. A small number of Poultrack staff see verification documents, and payout details only when sending a payment.
• Our service providers (processors), listed below. They may use personal data only on our instructions, under written agreements that require security and confidentiality.
• Professional advisers such as lawyers, auditors and insurers, who are bound by confidentiality.
• Courts, regulators and law-enforcement bodies, where the law requires or allows it. We tell you first where we lawfully can.
• A buyer of our business. If Poultrack is merged, sold or reorganised, personal data may pass to the new owner, who must honour this notice. We will tell you first.

Our processors

If we add or change a processor that handles your personal data, we update this list.

10Sending personal data outside Nigeria

Some of our providers store or process data outside Nigeria. When personal data leaves Nigeria we make sure it stays protected: we send it only to a country, or to an organisation, that the Commission accepts as giving an adequate level of protection, or we put in place appropriate safeguards such as standard contract clauses, binding corporate rules or an approved certification. Only where neither is possible do we rely on one of the limited exceptions the law allows, such as your informed consent, or what is needed to carry out a contract with you. You can ask us for a copy of the safeguards that apply to you.

If you are in the European Economic Area or the United Kingdom, the GDPR or UK GDPR may also apply to you. We do not target our Services at people there and have not appointed a representative in those places, but if the rules apply to you, you have the rights in this notice, and you may complain to your local supervisory authority.

11How long we keep personal data

We keep personal data only as long as we need it for the purpose it was collected for, or as the law requires. Then we delete it or make it anonymous. This is our schedule.

We run an automated clean-up every day that removes data when its time is up.

12How we protect personal data

• Encryption of data in transit between you and us, and encryption of the most sensitive fields (ID numbers, bank account numbers) in our database.
• Passwords are stored only as one-way hashes. We cannot read them.
• Role-based access: people see only what their role needs. Staff access to documents and payout details is limited and recorded.
• Limits on sign-in and code attempts, and sign-in tokens that expire.
• Files you upload are kept on private storage, not reachable from the web, and checked for type and size.
• Regular security updates, backups, and a written plan for responding to incidents.

No system is completely secure. Please choose a strong password, keep it private and log out of shared devices.

13If something goes wrong

If there is a personal data breach that is likely to put your rights and freedoms at risk, we will tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If the risk to you is high, we will also tell you without undue delay, saying what happened, what data is affected, what we are doing and what you can do. We keep a record of every incident, whether or not it has to be reported.

14Your rights

Under the NDPA, and the GDPR where it applies, you have the right to:

• Be informed about how your data is used. This notice does that.
• Access your data and get a copy. In the app, Settings has a "Download my data" button.
• Have wrong or incomplete data corrected. You can edit most details in the app.
• Have your data deleted when there is no lawful reason for us to keep it. See "Closing your account".
• Restrict how we use your data in some situations.
• Object to use based on our legitimate interests, and to direct marketing at any time.
• Receive your data in a common, machine-readable format and have it sent to another controller where this is technically possible.
• Withdraw consent whenever consent is our basis, without affecting what was done before.
• Not be subject to a decision made only by automated means that has legal or similarly significant effects on you. We make no such decisions.
• Complain to the Nigeria Data Protection Commission.

To use a right, use the in-app tools, or contact us at the address above and say what you want. We may ask you to prove who you are so that we do not give your data to the wrong person. We answer within 30 days and it costs nothing, unless a request is clearly baseless or excessive. If you are covered by the GDPR and a request is very complex, we may need up to two more months, and we will tell you why within the first 30 days. If we cannot do what you ask, we will explain why and tell you how to complain.

15Closing your account

You can close your account yourself in Settings. We ask for your password to make sure it is you. When you do:

• Your name, email address, username, phone number, ID numbers, uploaded documents and bank details are removed or replaced, and you are signed out everywhere.
• A farm you own is closed and leaves the Poultry Map.
• Records that other people or the law rely on stay without your identity attached: for example an order a buyer paid for, and payment and tax records we must keep for 6 years.
• We will not use your records for statistics from then on.

Before closing, download your data in Settings if you want a copy.

16Children

Poultrack is for adults. You must be 18 or over to create an account, and we ask you to confirm it. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, tell us and we will delete it. If a farm owner records information about a worker under 18, they are responsible for having lawful grounds, including parental consent, to do so.

17Automated tools and AI

Some features work out alerts and estimates from your records, such as how many days of feed are left, or when a vaccine is due. These are informational and you stay in control. We do not use automated decisions that have legal or similarly significant effects on you. We do not use your identifiable records to train AI models for other customers.

18Cookies and similar technologies

Our website and app use only the browser storage they need to work. We use no advertising or tracking cookies. See the Cookie Notice.

19Complaints

Please tell us first so we can put it right: use the contact page, choosing "Privacy or data request". You also have the right to complain to the Nigeria Data Protection Commission, and, if you are in the EEA or UK, to your local data protection authority.

20Changes to this notice

We update this notice when what we do changes. The version and date at the top show the latest update. If a change matters to you, for example a new purpose or a new kind of sharing, we will tell you at least 30 days before it applies, by email or in the app. Where the law requires your consent for a new use, we will ask for it.

21Contact us

Questions, requests and complaints about personal data go to our Data Protection Officer through the contact page, choosing "Privacy or data request", or privacy@poultrack.com.