Privacy Policy

1. Introduction and scope

e-Busytree Ltd (“e-Busytree”, “we”, “us” or “our”) is a Uganda-based Climate-Fintech social enterprise transforming tree growing into a scalable, financeable, and technology-driven ecosystem. This Privacy Policy explains how we collect, use, store, protect and share personal information when you use our mobile application, website, digital platforms or related services (together, the “Services”).

The Services may connect farmers, landowners, tree growers, nurseries, farm forestry service providers, financial institutions, cooperatives, project partners, carbon-market participants and other organizations. This Policy applies across our Services, regardless of the device or channel used.

This Policy is intended to be clear and practical. It includes transparency about collected data, tree and plot records, account security, third-party processing, international transfers, retention, user rights, cookies, children’s privacy and complaint handling.

This Policy does not replace any separate contract, loan agreement, carbon project agreement, consent form or service-specific notice. If a service needs additional information or a different consent, we will provide that notice where appropriate.

2. Responsible entity for your information?

For the purposes of this Policy, e-Busytree Ltd is responsible for deciding why and how personal information is processed through Services that we operate, subject to the actual role of each partner in a particular project.

Contact us about privacy questions, access requests, corrections, objections or complaints:

• Organization: e-Busytree Ltd
• Address: Alikpot Village, Adyaka Parish, Agali Sub-county, Lira, Uganda
• Email: info@ebusytree.com
• Website: https://www.ebusytree.com

If a bank, cooperative, carbon project developer or other partner independently decides how it uses information it receives, that partner may also have its own privacy responsibilities and policy. We will identify the relevant partner or explain the arrangement where reasonably possible.

3. Priority privacy areas

3.1 Farmer registration, identity, location and service transactions

To register and support an account, we may collect your name, phone number, email address, preferred language, age or eligibility confirmation, organization or cooperative affiliation, and information needed to confirm identity where a service lawfully requires it. Depending on the service, we may also process mobile-money or bank details, transaction references, payment status, service bookings, loan application information or repayment records.

The app may request device location or GPS coordinates when you map a farm, record a tree, verify a visit, locate a service provider or document project activity. Location permissions should be requested when needed and, where technically feasible, you should be able to enter a location manually or deny device-level location access. Some mapping or verification functions may not work fully without location data.

We aim to collect only information reasonably needed for the feature or service. We do not ask for national identity documents, financial account details or precise location merely because they might be useful; we request them only where a defined purpose justifies them.

3.2 Tree, plot, farm and carbon records

The Services may record farm or plot boundaries, GPS points, tree species, number of trees, planting dates, seedling sources, growth measurements, survival status, maintenance activities, photographs, timestamps, field-worker observations and related project records. We may use this information to help users manage trees, monitor survival and growth, connect with providers, estimate carbon sequestration, support project reporting and, where separately agreed, help prepare evidence for a financing or carbon-market process.

Carbon estimates, tree values, growth projections and AI-generated assessments are estimates or decision-support outputs unless independently checked and formally validated under the relevant programme or standard. A digital tree record by itself does not prove land ownership, create a legal security interest, guarantee a loan, or constitute a certified or issued carbon credit. Separate legal agreements, verification and approvals may be required.

Farm and tree data can reveal the location of a person’s land or livelihood. We therefore treat precise coordinates, plot boundaries, geotagged and time-stamped photos and linked farmer profiles as potentially sensitive information and restrict access according to role and purpose.

3.3 How we use information and the basis for processing

We may use information to:

• Create and administer accounts, verify eligibility and provide customer support;
• Map farms and trees, track planting and maintenance, monitor survival and record project progress;
• Match farmers with nurseries, farm forestry providers, lenders, cooperatives, project partners or other relevant services;
• Process payments, service transactions, loan referrals, repayment administration or other activities requested by you;
• Calculate or estimate tree growth, carbon sequestration and environmental indicators, and prepare reports;
• Develop and test digital tools, improve reliability, prevent fraud, protect account security and understand aggregate use of the Services;
• Meet legal, regulatory, accounting, audit, contractual and legitimate project-reporting requirements; and
• Respond to requests, resolve disputes, enforce our terms and protect the rights and safety of other users.

Depending on the applicable law and context, we may rely on your consent, steps taken at your request before entering a contract, performance of a contract, compliance with a legal obligation, or a legitimate and proportionate interest. Where we rely on consent, you may withdraw it for future processing, although this will not make earlier lawful processing unlawful and may affect features that depend on the information.

We will not silently repurpose personal information for a materially different use that is incompatible with the original purpose. Where required, we will provide a new notice or seek additional consent.

3.4 Sharing, third parties and international transfers

We may share information only as reasonably necessary for the purposes explained in this Policy, under an applicable legal basis and with appropriate safeguards. Recipients may include:

• Service providers that host data, maintain software, send messages, provide mapping or analytics, support customer service or secure the platform;
• Financial institutions, lenders or authorised finance partners, where you request a referral or application, or where a clearly explained programme permits sharing;
• Nurseries, farm forestry providers, field agents, cooperatives or project administrators, to arrange or verify services and manage agreed activities;
• Carbon project developers, independent verifiers, auditors, buyers or programme administrators, where needed for a project you join or a service you request;
• Professional advisers, insurers or auditors where reasonably necessary;
• Government, regulators, law enforcement or courts when required by law or to protect legal rights; and
• A successor or transaction partner if our business or relevant service is reorganised, sold or transferred, subject to appropriate protections.

We do not sell personal information as a general data-broker business. We do not give partners unrestricted access to all user records simply because they work with e-Busytree. Access shall be limited to the information needed for the recipient’s defined role. Where appropriate, we use contracts, confidentiality requirements, security controls and instructions that limit how service providers may process information.

Some technology or project partners may process information outside Uganda. Where information is transferred across borders, we will take steps appropriate to the applicable law and the risk, which may include contractual safeguards, access controls, security measures or user notice. We will not state that data is stored in a particular country unless that location has been confirmed for the relevant system.

Where reporting can be done with aggregated or de-identified data, we aim to use that form rather than identify individual farmers. De-identified information may still be treated as personal data if someone can reasonably re-identify a person from it.

3.5 User rights, retention, security and complaints

Subject to applicable law and any lawful exceptions, you may ask us to:

• Confirm whether we process your personal information and request access to it;
• Correct inaccurate or incomplete information;
• Request deletion, restriction or cessation of particular processing where the law allows;
• Object to processing in circumstances provided by law;
• Withdraw consent where processing depends on consent;
• Request a copy of information in a portable format where the applicable law provides that right; and
• Complain to e-Busytree or the relevant data protection authority.

To make a request, email info@ebusytree.com and describe the information or account involved. We may need to verify your identity before acting. We will respond within the period required by applicable law, or otherwise within a reasonable period, and explain if we cannot fully comply. We will not promise a fixed response time unless we have confirmed that it is operationally achievable and legally appropriate.

We retain personal information for as long as reasonably needed for the purposes described here, including service delivery, project monitoring, dispute resolution, legal obligations and legitimate records management. Retention periods differ by data type and project. When information is no longer needed, we will delete it, securely dispose of it or de-identify it, unless law or a legitimate documented need requires continued retention.

We use reasonable technical, organizational and physical safeguards designed to protect information from unauthorised access, loss, misuse, alteration or disclosure. Safeguards may include access controls, authentication, staff confidentiality obligations, backups, secure development practices and vendor review. No digital system can be guaranteed completely secure. If a personal-data incident occurs, we will assess it and notify affected people or authorities where required by law.

If you are dissatisfied, first contact us using the details in Section 2. You may also have the right to lodge a complaint with Uganda’s Personal Data Protection Office or another competent authority. The relevant authority’s current contact process should be checked at https://www.pdpo.go.ug/. Farmer accounts can also be deleted in the app or by following the public account deletion instructions.

4. AI, profiling and credit-related assessments

We may use rules, statistical models, AI tools or other analytics to organise farm records, estimate tree growth or carbon sequestration, identify missing information, support risk assessment or generate recommendations. Inputs may include tree and plot records, farm-management observations, historical project performance and other information relevant to the particular service.

Where an AI-generated or automated assessment may materially affect access to finance, services or an opportunity, we aim to provide meaningful information about the main factors used, recognise data limitations, enable correction of inaccurate records and provide a way to request human review where required or appropriate. We will not treat an AI score as infallible or as a substitute for a lender’s independent obligations and decision-making.

We aim not to use sensitive personal attributes as credit-scoring factors unless specifically permitted by law and demonstrably necessary. We will assess models for unfair outcomes where feasible, consider data quality and representation, and document significant limitations. A financial institution may make its own lending decision under its own policies and legal responsibilities.

5. Photos, communications and content you provide

You may submit photos, documents, field notes, messages, feedback or other content through the Services. Please provide only material you are authorised to share and avoid including unnecessary personal details about other people. Photos may contain location metadata or images of individuals; obtain appropriate permission before uploading images of other people.

We may use your contact details to send service notices, verification codes, security alerts, tree-management reminders, transaction updates or information about a project you joined. Marketing messages will be handled in accordance with applicable law and any consent requirements. You may opt out of non-essential marketing communications, but operational or legally required notices may still be sent.

6. Device data, cookies and offline use

When you access our website or app, we may process technical information such as device type, operating system, app version, IP address, log events, crash reports, language settings and security signals. We use this information to operate, maintain, troubleshoot and protect the Services.

Our website may use cookies or similar technologies for essential functionality, preferences, security, analytics or reach measurement. Where required, we will provide a cookie notice or consent control. You can also manage cookies through your browser settings, although disabling certain cookies may affect functionality.

If an app feature permits offline data capture and later synchronization, information stored on the device may remain there until it is synchronized or removed. Users should protect their devices, use available screen locks and avoid sharing account access. The exact offline-storage behaviour depends on the version and configuration of the app.

7. Children and account eligibility

Our Services are intended for people who are legally eligible to use them and, as a general rule, account holders must be at least 18 years old unless a specific service lawfully provides otherwise with appropriate safeguards. We do not knowingly invite children to create ordinary user accounts or knowingly collect children’s personal information without a lawful basis and any required authorization.

If you believe a child has provided personal information to us improperly, contact info@ebusytree.com. We will assess the request and take appropriate steps in accordance with applicable law. Project participation involving young people must be handled through an appropriate safeguarding process and should not rely on this general Policy alone.

8. Account security and your responsibilities

Keep your login credentials and verification codes confidential, notify us promptly if you suspect unauthorised access, and ensure that the information you submit is accurate and lawfully provided. Do not access another person’s account or upload another person’s data without authority. If you act for a cooperative, company, group or project, you must be authorised to do so and should only provide information relevant to that role.

We may suspend or limit access where reasonably necessary to protect users, investigate suspected misuse, comply with law or maintain platform security. We will handle such steps proportionately and, where appropriate, explain the reason.

9. Third-party websites and services

Our Services may contain links to third-party websites or integrate services operated by other organizations. Their privacy practices are governed by their own notices and terms. We encourage you to review those notices before providing information directly to a third party. We are not responsible for a third party’s independent privacy practices, except to the extent applicable law makes us responsible for our own actions or arrangements.

10. Changes to this Policy

We may update this Policy to reflect changes in our Services, data practices, partnerships or legal requirements. We will revise the effective date and, where material or required by law, provide notice through the website, app, email or another appropriate channel. The updated Policy applies from its stated effective date. Where a change requires renewed consent, we will seek it before relying on that consent.

The current version shall be published at a stable, accessible URL on our official website. The address is https://www.ebusytree.com/privacy-policy.

11. Legal framework and interpretation

We aim to handle personal information in accordance with Uganda’s Data Protection and Privacy Act, 2019 and applicable regulations. Depending on where a user is located, the Services are offered, or a partner operates, additional laws may apply, including the EU or UK GDPR and applicable United States state privacy laws. This Policy does not guarantee that every law applies to every user or processing activity.

If a provision of this Policy conflicts with a mandatory legal requirement, the mandatory requirement will prevail to the extent of the conflict. Nothing in this Policy limits a right that cannot lawfully be limited.