Data Processing Agreement
The terms that apply when you use Poultrist to hold records about your customers, suppliers and staff.
Last updated: August 23, 2026
This agreement applies when you use Poultrist to hold personal information about other people: your customers, your suppliers and your staff. It forms part of the Terms of Service and takes effect automatically. There is nothing to sign.
It exists because UK and EU data protection law requires a written arrangement between a controller and its processor. If you are not in the UK or the European Economic Area it still describes accurately what we do, and you are welcome to rely on it.
1. What is being processed
| Subject matter | Providing the Poultrist farm management service |
| Duration | For as long as your account exists, plus the deletion and backup periods in section 8 |
| Nature and purpose | Storing, organising, retrieving, syncing between your devices, backing up, and deleting the records you enter |
| Types of personal data | Names, phone numbers, email addresses, delivery addresses, usernames, job roles, and any notes you write into a record |
| Categories of people | Your customers, your suppliers, and your staff |
| Special category data | None. Poultrist has no field for health, biometric or similarly sensitive information, and you should not enter any |
2. Your side
You confirm that:
- you have a lawful basis for holding each record you enter
- you have told those people how their information is used, as your own privacy notice requires
- your instructions to us do not require us to break the law
You control what goes in and what comes out. We do not check your records or decide what they should contain.
3. Our side
We will:
- Act only on your instructions. Using Poultrist as documented is your instruction. We do not use your records for our own purposes, and we never sell them or use them to train models. If the law forces us to do something else, we will tell you first unless we are forbidden to.
- Keep it confidential. Everyone at our company who can reach your data is bound by confidentiality obligations and only gets access where their job needs it.
- Keep it secure. We apply the measures listed in section 8 of the Privacy Policy, and we review them as the service changes.
- Control who else is involved. We use the sub-processors listed in section 4. You give general authorisation for them. If we add or replace one we will give you at least 30 days notice by email or in the app, and you may object. If we cannot resolve your objection you may stop using the affected feature or close your account.
- Help you answer people. If one of your customers, suppliers or staff asks to see, correct, export or delete their record, you can do all of that yourself in the app. If you need more than the app offers, write to [email protected] and we will help within a reasonable time.
- Help you with your own duties. We will give you what you reasonably need for a data protection impact assessment, for a security review, or for talking to a regulator.
- Tell you about breaches. If we discover a breach affecting your data we will tell you without undue delay, with what we know about what happened, who is affected and what we are doing about it, so you can meet your own 72 hour deadline.
- Give it back or delete it. When your account is deleted we delete the records as described in section 8, unless the law requires us to keep something.
- Let you check. We will make available the information you reasonably need to show we are meeting these obligations, and we will cooperate with an audit you conduct or commission, no more than once a year unless a regulator or a breach requires otherwise, with reasonable notice and at your cost.
4. Sub-processors
| Sub-processor | What it does | Where |
|---|---|---|
| Google (Firebase Cloud Messaging) | Delivers push notifications | Global |
| Google (Sign-In) | Confirms user identity | Global |
| Sentry | Receives crash and error reports | Its own regional infrastructure |
| RevenueCat | Manages subscriptions | United States |
| Our hosting provider | Stores the database | Outside the UK and EEA |
| Our email provider | Sends account and verification email | Outside the UK and EEA |
Each is bound by terms giving at least the protection this agreement requires. We stay responsible to you for what they do.
5. International transfers
Our servers sit outside the UK and the European Economic Area. Where your instructions cause personal data to move out of those regions, we rely on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum. Those clauses are incorporated into this agreement by reference, with us as data importer and you as data exporter.
Ask [email protected] for a copy of the safeguards in place.
6. Security
Section 8 of the Privacy Policy lists the technical and organisational measures we apply, and it is honest about two current limits: records cached on a device for offline use are not encrypted at rest by the app, and Android system backup is enabled by default. Take those into account when you assess whether Poultrist is appropriate for the records you intend to hold.
7. Rights of the people in your records
The app gives you the tools directly. You can view, edit and delete any customer, supplier or staff record, and a full data export gives you a portable copy of all of them at once. Where a request needs something the app cannot do, we will help.
8. Deletion
When an account owner deletes their account, the account is disabled immediately and the Business data, including every record covered by this agreement, is deleted 30 days later. Backups are kept for up to 30 days after that and then age out.
Export your data before deleting if you need a copy.
9. Liability and conflicts
The limits of liability in the Terms of Service apply to this agreement too.
If this agreement conflicts with the Terms of Service on how personal data is handled, this agreement wins. If it conflicts with the Standard Contractual Clauses, the clauses win.
10. Contact
Poultrist
Nairobi, Kenya
[email protected]