Privacy Policy

1. Who is responsible for your data

The data controller for personal data processed through the ACE Platform is Ecopia Plc, a company registered in the Federal Democratic Republic of Ethiopia under commercial registration number AAT/AA/2/0000816/2004, with registered office at House Number 229, Kirkos, Addis Ababa, Ethiopia.

Ecopia Plc is the entity that determines what personal data is collected, why, and how it is used. Where ACE works with partners or operators on specific market applications, those partners process data on Ecopia Plc's instructions as data processors.

This Privacy Policy applies to all personal data processed through the ACE Platform, including your account, your service requests, your product and IP records, and any communication you have with us.

2. Legal framework we follow

ACE is operated from Ethiopia and serves users across Africa and, in some cases, beyond. Our privacy framework is aligned with:

• The Personal Data Protection Proclamation No. 1321/2024 of the Federal Democratic Republic of Ethiopia, which is the primary law governing how we handle personal data in Ethiopia.
• The African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), which provides the continental legal foundation for data protection and requires principles of consent, lawfulness, purpose limitation and transparency.
• Applicable national data protection laws of the other countries in which we or our users operate, where those laws apply to the processing.
• The Nagoya Protocol and applicable access-and-benefit-sharing frameworks, where the processing involves traditional knowledge or genetic resources.

Where a national law provides a higher standard of protection than this policy, that law prevails.

3. What personal data we collect

We collect the following categories of personal data.

Data you give us directly

• Identity and contact data: your full name, business email address, telephone number, organisation name, country and city.
• Account data: your email, a securely hashed password, and the role you selected at registration (customer, provider, business, institution).
• Service request data: the details you provide when you request a service — your customer type, the service category, whether the request is bilateral or multilateral, a description of what you need, expected outcome, budget (if you provide one), preferred meeting, and any documents you attach.
• Business and record data: where you act on behalf of an organisation, the information you provide about that organisation; and if you register a product, an IP work, a facility or a certificate, the details of those records — including origin, materials, production method, certifications, ownership, rights and (where relevant) community consent.
• Payment reference data: the reference, status, amount and currency of payments you make. We do not store your full card details or bank credentials. These are held by the licensed payment provider that processes the payment.

Data we collect automatically

• Technical data: your IP address, browser type, device type and the pages you access.
• Session data: an authentication token stored in your browser to keep you signed in.
• Usage data: a record of actions taken on the Platform (submitting a request, accepting a proposal, issuing an invoice, and similar), so that the workflow is auditable and traceable.

Data we do not collect

We do not collect special-category personal data beyond what is necessary to run the Platform — for example, we do not collect health data unless a health-service request you make requires it, and we do not collect biometric data.

4. Why we collect it — lawful basis

Under the Personal Data Protection Proclamation No. 1321/2024, we must have a lawful basis for each purpose. The table below sets out the purposes and the corresponding basis.

Where we rely on your consent — for example, for optional communications, or for the publication of records that would otherwise be restricted — you can withdraw it at any time. Withdrawal does not affect processing that took place before the withdrawal. Withdrawal may mean that some features of the Platform can no longer be provided to you.

5. Who we share your data with

We share personal data only with the service providers that make the Platform work, and only for the purposes set out above. These providers act as data processors acting on our instructions. They are:

• Hosting and database providers. For running the Platform and storing the data securely.
• Email delivery providers. For sending transactional and service emails. These providers receive the recipient's email address and the content of the message.
• Payment processors. For handling the payments you make. You are redirected to the payment provider's own checkout, and your payment data is provided directly to them, not to ACE.
• File storage providers. For storing photos and documents you upload.

We do not sell your personal data. We do not share your personal data with advertisers.

Where required by law, by a court order, or by a valid request from a competent authority — including INSA, the Ethiopian Communications Authority, the Ethiopian Data Protection Authority or a similar authority — we may disclose personal data. Where we are legally permitted to do so, we will inform you of the disclosure.

Where ACE works with partners or operators on specific market applications — for example, an industry trail maker operating an application for a sector — that partner may have access to records relating to users in that sector. Where this is the case, the access is governed by a written data-processing agreement, and the partner is bound by the same protections set out in this policy.

6. Where your data is stored

During the prototype phase, data on the ACE Platform is stored in data centres operated by our hosting providers, which are located outside Ethiopia. We use only providers that put in place recognised contractual safeguards for the protection of personal data.

In production, the production data of the Platform will be stored on infrastructure located in the Federal Democratic Republic of Ethiopia, in accordance with Ethiopian requirements, including the data-location expectations of the relevant authorities. The migration from prototype infrastructure to Ethiopian production infrastructure is planned and will be carried out without any change to the protections described in this policy.

Where data is transferred outside Ethiopia for any reason, we ensure that the transfer is lawful, and that it is protected by the safeguards described in Section 14.

7. How long we keep your data

We keep personal data only as long as necessary for the purpose for which it was collected, or as required by applicable law.

• Account data: kept while your account is active, and for a limited period afterwards to allow you to reopen it.
• Service request, proposal, invoice and payment records: kept for the period required by applicable financial and record-keeping law, typically a minimum of five to seven years.
• Traceability and verification records: kept for as long as the record needs to remain verifiable. This is a core function of the Platform and may extend beyond the life of the original transaction.
• Traditional knowledge and community records: retained according to the terms set by the community that consented to their recording. The community may instruct us to delete or restrict a record at any time.
• Technical and session logs: kept for a short period, typically no more than twelve months.

Where a legal obligation requires a longer retention period, that period applies even if you close your account.

8. Your rights

Under the Personal Data Protection Proclamation No. 1321/2024 and applicable law, you have the following rights:

• Right to be informed. You have the right to know what personal data we process, why, and with whom we share it. This policy is part of how we meet that right.
• Right of access. You have the right to request a copy of the personal data we hold about you.
• Right to rectification. You have the right to have inaccurate or incomplete personal data corrected. You can correct most data directly from your account.
• Right to erasure. You have the right to ask us to delete personal data that we no longer have a lawful basis to keep. Certain records — for example, an invoice that has been issued, or a traceability record that a buyer is relying on — may need to be retained even after your request.
• Right to object. You have the right to object to processing based on our legitimate interests, in certain circumstances.
• Right to restrict processing. You have the right to ask us to restrict how we use your personal data in certain circumstances.
• Right to data portability. You have the right to receive your personal data in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
• Right to withdraw consent. Where we rely on consent, you can withdraw it at any time.
• Right not to be subject to automated decisions. See Section 15.

Where a record relates to community-held traditional knowledge, the rights of the community are exercised by the community's authorised representative, not by an individual user. Section 12 sets out how community records are handled.

9. How to exercise your rights

To exercise any of the rights above, email privacy@ecopiagroup.com. Please describe the right you wish to exercise and, where relevant, the personal data concerned.

We will respond within thirty (30) days of receiving your request. If the request is complex, or if you have made several requests, we may extend this period and will tell you if we do.

We may ask you to prove your identity before we act on a request, to make sure we do not disclose data to the wrong person. We will use the least intrusive means available to verify your identity.

If we refuse your request, we will tell you why, and inform you of your right to complain to the Ethiopian Data Protection Authority.

10. Security

We take the security of your personal data seriously. The measures we use include:

• Passwords stored using industry-standard cryptographic hashing. Plain passwords are never stored.
• Encrypted connections (HTTPS) between your browser and the Platform.
• Role-based access controls, so that only the people who need to see data can see it. Administrative access is logged.
• Logging of administrative actions, so that changes to records are auditable and any unauthorised change can be detected.
• Regular review of our service providers and their security practices.
• Application-level protections against common attacks, including rate limiting on authentication endpoints.

If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify you and any relevant authority without undue delay, in accordance with applicable law.

11. Cookies and browser storage

ACE uses a small number of cookies and browser storage technologies — almost all of which are strictly necessary to keep you signed in and to make the Platform work. We do not use advertising cookies, and we do not track you across other websites.

For the full list of what we use and why, please see our Cookie Policy.

12. Traditional knowledge and community records

ACE is designed to record traditional knowledge, medicinal plant knowledge, cultural expressions and community-held records in a way that respects the rights of the communities concerned. This section explains how we handle those records.

• Community consent comes first. A traditional knowledge record is uploaded to ACE only with the consent of the community that holds it, expressed by the community's authorised representative, in accordance with that community's protocols and applicable law.
• No automatic licence. Uploading a traditional knowledge record does not grant ACE a licence to publish, commercialise, license or distribute it.
• Access control. Records that are marked confidential or access-restricted are visible only to the users and authorities authorised by the record owner. They are not shown to other users, to the public, or to third parties, except as required by law.
• Access and benefit sharing. Where access-and-benefit-sharing rules apply — under the Nagoya Protocol, national ABS laws, or the African Union framework — those rules are recorded on the Platform and respected in any use of the record.
• Community rights. The community retains the right to instruct us to correct, restrict or delete a record. Requests are made by the community's authorised representative and are acted on promptly.
• No unauthorised disclosure. Any disclosure of community-held knowledge beyond the purpose for which it was uploaded requires the specific consent of the community, recorded on the Platform.

If you believe that a record involving community-held knowledge has been uploaded without the required consent, contact us at privacy@ecopiagroup.com. We will review and, where appropriate, remove or restrict the record.

13. Children

The Platform is intended for adults and for organisations acting through adult representatives. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us so we can delete it.

14. International transfers

Because the Platform serves users across multiple countries, personal data may be transferred to and processed in countries outside Ethiopia. Where this happens, we ensure that:

• The receiving country provides an adequate level of protection, or
• We have put contractual safeguards in place with the receiving party, or
• The transfer is necessary for the performance of our contract with you, or
• The transfer is otherwise lawful under the Personal Data Protection Proclamation No. 1321/2024 and applicable law.

We keep a record of our international transfers, and we will provide information about the safeguards in place if you ask us.

15. Automated decisions and profiling

ACE does not currently make decisions about you based solely on automated processing that would have a legal effect or similarly significant effect on you.

The Platform does use automation to support routine functions — for example, sending a transactional email when a proposal is prepared, or generating a reference number for a new service request. These are administrative actions and do not involve evaluation of your personal characteristics.

If we introduce automated decision-making in the future, we will update this policy, notify you, and provide a mechanism for you to request human review of any decision made in this way.

16. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Where the change is significant, we will notify you by email or by a notice on the Platform before the change takes effect.

Continuing to use the Platform after the changes take effect means you accept the updated policy.

17. Complaints and contact

If you believe we have not handled your personal data in accordance with this policy or with the Personal Data Protection Proclamation No. 1321/2024, you have the right to lodge a complaint with the Ethiopian Data Protection Authority, or with the supervisory authority of the country where you live.

We would appreciate the opportunity to address your concern first, so please contact us before lodging a complaint.