Privacy Policy

AATI is an agribusiness training institute delivering practical, market-driven courses through the Platform to learners, instructors, and administrators across Kenya.

Account information: full name, email address and/or phone number, a securely hashed password, county/location, and the category that best describes you (e.g. Farmer, Youth, Woman Entrepreneur, Agripreneur, Extension Officer, Other).

Learning data: courses you enroll in or purchase, your progress, quiz results and scores, certificates issued to you, personal notes you write while watching lesson videos, and questions you submit about specific lessons.

Payment information: when you purchase a course, your payment is processed directly by our payment partner, Paystack. We do not directly collect or store your full card number, mobile money PIN, or banking credentials — we retain only a record of the transaction (amount, date, course, and a reference number) needed to confirm your purchase and provide customer support.

Communications: messages exchanged with instructors about a course, and any support tickets you raise with our Help Desk, including their content and any files you attach.

Instructor and administrator data: for those roles, we additionally collect professional information such as a bio or title, and records of the courses, students, and administrative actions associated with that role.

Technical data: we use a small number of strictly necessary cookies to keep you securely signed in and to remember your language preference (English or Swahili). We may log IP addresses and basic device/browser information for security purposes, such as detecting repeated failed login attempts.

We use your information to:

• Create and manage your account and provide access to the Platform
• Process course purchases and grant access to the courses you've bought
• Track your learning progress and issue certificates
• Enable communication between learners and instructors about course content
• Respond to support requests
• Send you necessary account-related emails, such as invitations, email verification, and password reset links
• Maintain the security of the Platform, including detecting and preventing fraud, unauthorized access, and abuse
• Keep an internal audit record of administrative actions for accountability and security purposes

Under the Data Protection Act, 2019, we process your personal data on the following bases: your consent (for example, when you create an account); because it is necessary to perform our contract with you (providing the courses and services you’ve signed up or paid for); to comply with a legal obligation (such as retaining financial records); and our legitimate interests in keeping the Platform secure and functioning properly.

We do not sell your personal data.

We share limited information as follows:

• Instructors can see the progress, notes, and messages of learners specifically enrolled in their own courses — never data belonging to another instructor’s students.
• Paystack, our payment processor, receives the information necessary to process your payment.
• Service providers who help us operate the Platform (such as our email delivery provider and our database/hosting providers) receive only the data necessary to perform their specific function, and are contractually required to protect it.
• We may disclose information if required by Kenyan law, a court order, or a lawful request from the Office of the Data Protection Commissioner or another competent authority.

We take the security of your data seriously. Passwords are never stored in plain text — they are hashed using industry-standard methods. We use secure, encrypted connections, role-based access controls so that staff and instructors can only see the data relevant to their role, rate limiting to prevent abuse, and an internal audit log of administrative actions. While we take reasonable technical and organizational measures to protect your data, no system can be guaranteed 100% secure.

Some of our infrastructure providers (such as our hosting and database providers) may store or process data on servers located outside Kenya. Where this occurs, we take steps to ensure such transfers are made only to providers with adequate data protection safeguards in place, consistent with the requirements of the Data Protection Act, 2019.

Under the Data Protection Act, 2019, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data, subject to any legal obligation we have to retain certain records (such as financial/transaction records for tax purposes)
• Object to or restrict certain processing of your data
• Request a copy of your data in a portable format
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC) if you believe your data protection rights have been violated

To exercise any of these rights, contact us using the details in Section 12 below.

We use only strictly necessary cookies: a secure session cookie to keep you signed in, and a preference cookie to remember your chosen language. We do not use third-party advertising or tracking cookies.

The Platform is intended for users aged 18 and above. If you are under 18, you may only use the Platform with the involvement and consent of a parent or guardian.

We retain your account data for as long as your account remains active. Certain records, such as payment and transaction data, may be retained for longer periods where required by Kenyan tax or financial regulations. Security audit logs are retained permanently and cannot be altered or deleted, as they exist specifically to protect the integrity of the Platform.

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at the email address listed on our Contact page. You may also contact the Office of the Data Protection Commissioner (ODPC) directly regarding any data protection concerns.

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect the most recent revision. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.