Privacy notice

Rain Protocol Limited (“we”) is the data controller for personal data processed through UptownFarm. We process your data in line with the Nigeria Data Protection Act 2023(the “NDPA”) and the regulations of the Nigeria Data Protection Commission (“NDPC”).

Questions and requests about your data go to our Data Protection Officer at privacy@uptownfarm.app.

We collect only what the service needs:

• Account: your phone number, the one-time codes we send to it, and a display name if you give one.
• Orders: what you bought, quantity, price, payment reference from our payment processor, order status, collection codes and when they were used. We never see or store your full card number or bank login.
• Partner programme (optional): who introduced you and whom you introduced, points, level, commissions, and — only if you register to be paid — your bank code, account number and the account name returned by the bank.
• Distribution (optional): the phone numbers of customers a distributor hands produce to, and their confirmations.
• Technical: device and browser type, IP address, approximate region inferred from it, and logs of requests to our servers, kept for security and to keep the service working.

We do not collect your precise location, contacts, photos or biometric data, and we do not ask for a national identity number.

• To perform our contract with you (NDPA s.25(1)(b)): taking orders, holding and refunding payments, grading and allocating produce, sending collection codes, running the partner programme and paying commissions.
• To meet legal obligations (s.25(1)(c)): tax and accounting records, consumer-protection duties, responding to lawful requests from authorities, and anti-fraud checks required by our payment processor.
• Our legitimate interests (s.25(1)(f)), balanced against your rights: keeping the service secure, preventing abuse of order limits and the partner programme, and understanding how the service is used so we can improve it. We do not use your data for profiling that produces legal or similarly significant effects.
• Your consent (s.25(1)(a)): joining the partner programme, registering a bank account, and any marketing messages beyond transactional notices. You can withdraw consent at any time; this does not affect processing that happened before.

We share personal data only with:

• Our payment processor (currently Nomba, a CBN-licensed payment service provider) to take payments, issue refunds, verify bank account names and pay commissions.
• SMS and messaging providers to deliver sign-in codes, order updates and collection codes.
• Collection points: the agent sees your collection code and order contents, not your phone number, unless you choose to give it.
• Your introducer and team (partner programme only): people in your partner line see that you joined, your level and the points you generate — never your orders, phone number or bank details.
• Hosting and infrastructure providers that store and process data on our instructions under written contracts.
• Authorities and advisers where the law requires it or to establish or defend legal claims.

We never sell personal data and we do not share it with advertisers. Suppliers and farmers receive aggregate quantities only.

Our payment and messaging partners operate in Nigeria. Our servers may be hosted outside Nigeria with providers that offer adequate protection; where data leaves Nigeria we rely on the NDPA’s cross-border transfer provisions (s.41–43), including contractual safeguards, and we will tell you here if that changes.

• Order, payment, refund and commission records: seven years after the transaction, as required for tax and accounting and to resolve disputes. These records are kept in an append-only ledger and cannot be silently edited.
• Account details: for as long as your account is open, then deleted or anonymised within 90 days of closure, except records we must keep under the point above.
• Bank account details: until you remove them or leave the partner programme, then deleted within 30 days of the last payment due.
• One-time codes: deleted on use or expiry. Technical logs: 12 months.

You have the right to:

• be told what data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data erased where we no longer need it (records we must keep by law are excepted);
• restrict or object to processing based on legitimate interests;
• receive the data you gave us in a portable format;
• withdraw consent at any time;
• not be subject to a decision based solely on automated processing that significantly affects you; and
• lodge a complaint with the Nigeria Data Protection Commission if you believe we have handled your data unlawfully.

To exercise a right, email privacy@uptownfarm.app from the phone number on your account or write from your account page. We respond within 30 days and do not charge for a first request.

Data is encrypted in transit and at rest. Access inside Rain Protocol is limited to staff who need it for their role and is logged. Payment card details are handled entirely by our payment processor. Every change to an order, price or refund is written to an append-only audit log. If a breach is likely to harm you we will notify the NDPC within 72 hours of becoming aware and tell you without undue delay.

We use no advertising or third-party tracking cookies. Your browser stores a sign-in token, the referral code from a link you followed (so your introducer is credited if you join), and your preferences, all on your device. Clearing site data signs you out.

The service is for adults. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.

The version and effective date are at the top of this page. If we make a material change to how we use your data we will tell you by SMS or on your account page before it takes effect. See also our Terms and conditions.