Privacy Policy

The data controller responsible for your personal data is:

We collect the following categories of personal data:

Account & Identity Data

• Full name, email address, phone number
• Farm or business name and location
• Country and state of residence
• Profile photo (if provided)

Transaction Data

• Order history, purchased products, and download records
• Payment method type (we never store full card numbers)
• Coupon codes used and currency preferences
• Billing name and email address

Usage & Technical Data

• IP address, browser type, device information
• Pages visited, time spent, click behaviour
• Referring URLs and search terms used on our site
• Error logs and performance metrics

Communication Data

• Messages sent via our contact form
• Email correspondence with our support team
• Survey and feedback responses
• Consultation booking information

We use your personal data for the following purposes:

• Processing and fulfilling your orders and delivering digital products
• Managing your account and providing access to purchased content
• Sending order confirmations, download links, and receipts
• Responding to your enquiries, support tickets, and consultations
• Sending relevant farming tips, product updates, and newsletters (with your consent)
• Improving our platform, courses, and tools through analytics
• Preventing fraud, abuse, and unauthorised access
• Complying with legal obligations under Nigerian law
• Running promotions and informing you of relevant offers

Under the Nigerian Data Protection Act 2023 and equivalent international frameworks, we process your data on the following legal bases:

• Contract performance — to deliver products and services you purchased
• Legitimate interests — improving our platform, preventing fraud, internal analytics
• Legal obligation — complying with tax, financial, and regulatory requirements
• Consent — marketing emails and optional newsletters (withdrawable at any time)

We do not sell, rent, or trade your personal data. We share it only in these limited circumstances:

• Payment processors (Paystack, Flutterwave) — for secure transaction processing
• Email service providers — for transactional and marketing emails
• Cloud storage and hosting services — to deliver our digital products
• Analytics providers — anonymised or aggregated usage data only
• Legal authorities — when required by law, court order, or regulatory request
• Business successors — in the event of a merger or acquisition, with equivalent privacy protections

All third-party partners are contractually bound to process your data only for the specified purpose and to maintain appropriate security standards.

We use cookies and similar tracking technologies to improve your experience on our platform. These include:

• Essential cookies — required for basic platform functionality (login sessions, cart state)
• Analytics cookies — anonymised data to understand how our pages are used
• Preference cookies — remembering your currency, language, and settings
• Marketing cookies — only with your explicit consent, for relevant product ads

You may control cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality. We do not use cookies to track you across third-party websites without consent.

We retain your personal data only as long as necessary for the purposes described in this policy:

• Account data — retained for the lifetime of your account, plus 2 years after closure
• Transaction records — retained for 7 years for tax and regulatory compliance
• Marketing consent records — retained until you withdraw consent
• Support communications — retained for 3 years from the date of the last interaction
• Analytics data — anonymised after 26 months

After the applicable retention period, your data is securely deleted or anonymised.

Under the Nigerian Data Protection Act 2023, you have the following rights:

• Right to access — request a copy of all personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure ('right to be forgotten') — request deletion of your data where lawful
• Right to restriction — request that we limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — at any time, without affecting prior processing
• Right to lodge a complaint — with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, email us at privacy@riverrootfarm.com. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure, including:

• HTTPS encryption for all data transmitted to and from our platform
• PCI-DSS compliant payment processing (card data never stored on our servers)
• Regular security audits and vulnerability assessments
• Role-based access controls for staff handling customer data
• Incident response procedures for data breach notification

While we take every precaution, no internet transmission is 100% secure. If you suspect a security breach involving your account, contact us immediately.

Some of our third-party service providers are located outside Nigeria. When we transfer your data internationally, we ensure adequate safeguards are in place, including:

• Adequacy decisions by the NDPC or equivalent bodies
• Standard contractual clauses or binding corporate rules
• Your explicit consent where required

Our platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal information without parental consent, please contact us immediately and we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated via email and a prominent notice on our platform. The "Last Updated" date at the top will always reflect the most recent revision. Continued use of our services after changes constitutes acceptance.

For all privacy-related enquiries, requests, or complaints, please contact our designated Data Protection Officer: