Ashwick Industries EPZ Limited, trading as Imara Avocados ("Imara", "we"), is a company registered in Kenya. We are the data controller for the personal data described in this policy, which covers our website, staff portal and mobile app. This policy is issued under the Kenya Data Protection Act, 2019 ("DPA 2019"). You can contact us about privacy at support@imaraavocados.com.

• Staff and job applicant names, phone numbers, national ID numbers and KRA PINs.
• CVs and other application documents.
• Photos and selfies, including check-in photos and visitor photos.
• Signatures.
• Supplier and buyer contact and business details.
• Attendance and check-in records.
• Basic technical and usage data: device information, log data, and cookies and analytics on our website.

• Recruitment.
• Employment administration.
• Payroll and statutory compliance.
• Attendance and site security.
• Supplier and buyer management and procurement.
• Product traceability.
• Communications.
• Website analytics.

Under Section 30 of the DPA 2019 we process personal data on these grounds:

• Performance of a contract, such as an employment, supply or sales contract.
• Compliance with legal obligations, including employment law, tax (KRA), NSSF and SHIF.
• Our legitimate interests, such as site security and running our operations.
• Your consent where required, for example for marketing and website analytics.

• Recruitment data for unsuccessful applicants is deleted within 12 months, unless you consent to us keeping it longer.
• Employment, payroll and attendance records are kept for as long as Kenyan employment and tax law requires, generally up to 7 years after employment ends.
• Supplier and buyer records are kept for the duration of the relationship plus the applicable statutory period.
• After these periods, data is deleted or anonymised.

• Cloud hosting and database providers (Supabase).
• Messaging and email providers, including WhatsApp (Meta) and email delivery providers.
• Meta Platforms (Facebook and Instagram), to measure our job adverts only on the job application page (/apply), and only if you allow it in the consent notice on that page. Meta receives details of your application-page visit (whether you started or submitted an application, your IP address, browser and Meta cookies) and a scrambled (hashed) copy of your phone number and email. We do not share any other personal details, including your name, ID number, CV or answers. You can withdraw at any time using "Cookie settings" on the application page, or by emailing support@imaraavocados.com.
• Professional advisers, such as auditors and lawyers.
• Government authorities where the law requires it.

We do not sell personal data.

Some of these providers process data outside Kenya. Where data is transferred across borders, we rely on appropriate safeguards as required by the DPA 2019.

We protect personal data with measures that include role-based access controls, so that people only see what their job requires, and encryption of data in transit.

Under the DPA 2019 you have the right to:

• be informed about how your data is used;
• access your personal data;
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• object to processing;
• restrict processing;
• data portability;
• withdraw consent at any time where we rely on consent; and
• complain to the Office of the Data Protection Commissioner (ODPC).

Requesting deletion. You can request deletion in the app using "Delete my account" (in your staff profile or settings, or on your application status page if you are an applicant), or by emailing support@imaraavocados.com. We respond within the statutory period. Records we are legally obliged to keep are retained for the required period, with access to them restricted.

Our website, portal and app are not directed at anyone under 18.

We may update this policy from time to time. The date at the top shows when it was last changed.

For any privacy question or request, email support@imaraavocados.com.