Privacy Policy.

01 Who we are

Farmer-Switch ("we", "us", "our") operates a digital platform that connects farmers, market agents, loan providers, insurance providers, input providers, cooperatives and off-takers across Africa. We provide our services through three channels: a USSD short code (*789#) for feature phones, mobile apps for iOS and Android, and a web dashboard.

This policy applies to all three channels, our marketing site, and any related Farmer-Switch service. The data controller is Oxylane Digital Solutions., registered in Lusaka, Zambia.

02 Data we collect

We collect only the data we need to deliver the platform. The categories below are illustrative; specific fields vary by your role and the channels you use.

We do not collect special-category data (race, religion, political opinions, biometric data) unless you explicitly provide it for a specific feature — for example, a fingerprint as a login option on supported devices.

03 How we use it

• Run the platform — match buyers and sellers, route orders, process payments, surface prices and forecasts.
• Verify identity — KYC checks for loans, insurance and high-value trades.
• Score creditworthiness — generate credit and reputation scores using farm history, repayment records and platform behaviour. You can request a human review of any score (see Your rights).
• Personalise advisory — tailor weather alerts, agronomic tips and product recommendations to your crop, location and season.
• Detect fraud — flag duplicate accounts, mismatched GPS data, counterfeit inputs and suspicious claims.
• Communicate — send transactional SMS, push notifications, in-app messages and (with your consent) marketing.
• Improve the platform — analyse aggregated, de-identified usage to fix bugs and ship new features.
• Comply with law — meet KYC/AML, tax and regulatory obligations in each country we operate in.

04 Legal basis for processing

Where applicable data-protection law requires us to identify a legal basis, we rely on:

• Contract — to provide the services you signed up for.
• Consent — for marketing, optional analytics, and any sharing not strictly required to run the platform. You can withdraw consent at any time.
• Legal obligation — for KYC, AML, tax and regulatory reporting.
• Legitimate interests — to detect fraud, secure the platform and run aggregated analytics, balanced against your rights.

05 Sharing & partners

Farmer-Switch is a marketplace — the whole point is to connect you with other actors. We share data only as needed to fulfill the transaction you initiated, or as listed below.

• Counterparties to your transaction — when you list produce, the buyer sees what they need to bid; when you apply for a loan, the lender sees what they need to underwrite.
• Service providers — payment processors, mobile-network operators, cloud hosting (in-region where possible), SMS gateways, identity-verification vendors. Bound by data-processing agreements.
• Regulators & authorities — when required by law, court order or to investigate fraud.
• Aggregated insights — we publish anonymised, aggregated market and impact data. These cannot be used to identify you.

We do not sell personal data. We do not share your data with advertisers.

06 USSD & SMS specifics

USSD sessions on *789# are routed through your mobile network operator. The operator sees that you dialed our short code and the duration of the session; we receive the digits you enter, your MSISDN (phone number) and your session ID. USSD messages are not encrypted end-to-end at the network layer — this is a limitation of the protocol, not our platform — so we never request sensitive secrets like full PINs or passwords over USSD. Authentication PINs are entered into a dedicated secure prompt and hashed on receipt.

SMS notifications we send (price alerts, OTPs, payment confirmations) are similarly routed via your operator. Standard carrier rates may apply.

07 How long we keep data

08 Security

We protect your data with administrative, technical and physical safeguards:

• Transport-layer encryption (TLS 1.2+) for app and web traffic.
• Encryption at rest for databases and backups (AES-256).
• Role-based access control with least-privilege defaults; staff access is logged.
• Independent annual penetration tests; SOC 2 Type II programme in progress.
• 24/7 monitoring, anomaly detection and an incident-response runbook.

No system is perfect. If we ever detect a breach affecting your data, we will notify you and the relevant supervisory authorities within the timeframes required by law (typically 72 hours).

09 Your rights

Depending on where you live, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Correct — fix data that is wrong or incomplete.
• Delete — ask us to erase data that we no longer have a legal basis to keep.
• Port — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests, including fraud screening.
• Withdraw consent — at any time, for any consent-based processing.
• Human review — request a person to review any automated decision (e.g. a credit score) that significantly affects you.
• Complain — lodge a complaint with your data-protection authority.

To exercise any right, contact oxylanedigital@gmail.com or dial *789*0# and choose "Privacy". We respond within 30 days.

10 Cross-border transfers

We host primary databases in-region (Africa) where feasible. Some service providers (e.g. cloud, analytics) operate from other regions. Where data is transferred internationally, we rely on Standard Contractual Clauses and equivalent safeguards approved by the relevant authorities.

11 Children

Farmer-Switch is intended for users 18 and over, or the age of legal majority in your country, whichever is higher. We do not knowingly collect data from children. If you believe a minor has registered, contact us and we will delete the account.

12 Changes to this policy

We update this policy when our practices change or laws require it. Material changes are announced via in-app notice, SMS to your registered number, and email at least 30 days before they take effect. The "Last updated" date at the top tells you when we last revised this page. Past versions are kept on file and available on request.

13 Contact & Data Protection Officer

Our Data Protection Officer is responsible for overseeing how we handle your data. For privacy questions, requests or complaints: