1. Introduction and Scope

Africa Poultry Development Group Ltd ("APD", "we", "us", or "our") operates the APD eLearning Academy (the "Academy"), an online learning platform accessible at apd.africa and related subdomains. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you access or use the Academy.

APD operates across four countries through the following subsidiaries:

We are committed to protecting your privacy in accordance with applicable data protection laws, including the Kenya Data Protection Act 2019, Uganda Data Protection and Privacy Act 2019, Tanzania Personal Data Protection Act 2022, and the Zambia Data Protection Act 2021.

By registering for or using the APD eLearning Academy, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Academy.

1.1 Controller and Processor

APD acts as the data Controller for personal information you provide when accessing the Academy. Individual APD subsidiaries may act as joint Controllers for data processed within their dedicated subsidiary learning environments. Where APD engages third-party service providers, those parties act as data Processors and are bound by appropriate data processing agreements.

1.2 Links to Other Websites

The Academy may contain links to external websites we do not own or control. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any external sites you visit.

2. Information We Collect

2.1 Information Provided at Registration and First Login

Access to the Academy is granted exclusively by your subsidiary's HR officer or system administrator, who provisions you with a Payroll Number and a temporary password. Self-registration is not permitted. On your first login, you will complete a one-time profile setup in which we collect:

• Your Payroll Number (assigned by your employer — this serves as your Academy username).

• Your country of employment, selected from: Kenya (Kenchic), Uganda, Tanzania, or Zambia.

• Your gender (for participation reporting and programme analytics).

• A new password of your choice, created by you to replace the temporary password.

Upon completing profile setup, your account is automatically associated with the subsidiary corresponding to your selected country, and you are redirected to that subsidiary's dedicated learning environment.

2.2 Information Collected Automatically (Usage Data)

When you access the Academy, we may automatically collect the following technical and behavioural data to ensure the platform functions correctly and to improve your experience:

• IP address and approximate geographic location.

• Browser type, version, and language settings.

• Device type and operating system.

• Pages and course modules visited.

• Time and duration of your sessions.

• Course progress, quiz scores, and completion status.

• Clickstream data and interaction logs.

2.3 Information from Third Parties

We may receive account setup information from your employing subsidiary for the purposes of provisioning your Academy account, including your Payroll Number and basic employment details. In such cases, your employer is responsible for ensuring the transfer of your data to APD is lawful under applicable data protection law.

3. Personal Data We Collect and Why

The table below summarises the categories of personal data we collect, the purpose of collection, and the legal basis we rely on:

4. How We Use Your Information

We use your personal information for the following purposes:

Identity verification and authentication: To verify your identity using your Payroll Number and authenticate your access to the Academy.

Profile setup and subsidiary routing: To complete your first-time profile setup and automatically route you to the correct subsidiary learning environment upon each login.

Course access and delivery: To provide access to course materials, modules, and assessments relevant to your subsidiary and role.

Progress tracking and certification: To track and report your learning progress and issue certificates of completion.

Personalisation: To personalise your learning experience and recommend relevant content based on your profile and subsidiary.

Communication: To contact you about your courses, platform updates, and APD news and events.

Marketing (with consent): To send you promotional materials about APD products and services where you have given explicit consent.

Security and fraud prevention: To detect and prevent fraudulent activity, abuse, or unauthorised access to the Academy.

Legal compliance: To comply with applicable data protection laws, regulations, and contractual obligations across all four countries of operation.

Platform improvement: To analyse how users interact with the Academy and improve features, content, and usability over time.

5. Legal Basis for Processing

We process your personal information on the following legal grounds, in accordance with applicable data protection law across our countries of operation:

Contract performance: Processing is necessary to provide the Academy services you have been enrolled for by your employer, including authentication, subsidiary routing, and course delivery.

Legitimate interests: Processing is necessary for our legitimate business interests, including platform security, analytics, routing users to the correct subsidiary environment, and improving our services, where those interests are not overridden by your rights and freedoms.

Consent: Where you have provided explicit consent, including for marketing communications, gender reporting, and optional profile information. You may withdraw consent at any time.

Legal obligation: Where processing is required to comply with applicable law in Kenya, Uganda, Tanzania, or Zambia.

6. Subsidiary Routing and Data Sharing

6.1 Subsidiary-Based Routing

Upon completing your first-login profile setup, the Academy uses your selected country to direct you to the dedicated learning portal of the corresponding APD subsidiary. Your account, learning progress, course enrolments, and completion records are maintained within your subsidiary's learning environment. You will be automatically redirected to your subsidiary portal each time you log in.

6.2 Sharing Within the APD Group

Your personal information may be shared with the APD subsidiary to which you belong and with APD Group's central systems for reporting, administration, and compliance purposes. All APD entities are bound by this Privacy Policy and the applicable data protection laws of each country.

6.3 Service Providers

We may engage trusted third-party service providers to assist in operating the Academy, including cloud hosting providers, payment processors, email delivery services, and analytics providers. These parties are contractually obligated to handle your data securely, to process it only as directed by APD, and not to use it for their own purposes.

6.4 Legal Requirements

We may disclose your personal information when required by law, regulation, court order, or government authority in any of our countries of operation, or where necessary to protect the rights, property, or safety of APD, our users, or the public.

6.5 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of APD assets, personal information may be transferred as part of that transaction. We will notify you of any such material change in advance where reasonably practicable.

7. Data Retention

We retain your personal information only for as long as necessary to provide Academy services and fulfil the purposes described in this Policy, or as required by applicable law:

• Account credentials (Payroll Number and password) are retained for the duration of your active employment and Academy enrolment.

• Course completion records and certificates are retained for a minimum of five (5) years for professional development and audit purposes.

• Usage and analytics data is typically retained for up to twenty-four (24) months before aggregation or deletion.

• Marketing preference data is retained until you withdraw consent or opt out.

• Upon cessation of employment or account deactivation by your subsidiary administrator, your active profile data will be archived or deleted in accordance with APD's data retention schedule and applicable legal obligations.

8. Cross-Border Data Transfers

As APD operates across Kenya, Uganda, Tanzania, and Zambia, and may use international cloud service providers, your personal information may be transferred to and processed in countries outside your country of residence. We take appropriate measures to ensure such transfers comply with applicable data protection laws in each jurisdiction, including the use of standard contractual clauses or equivalent safeguards as required.

9. Data Security

9.1 Security Measures

We implement appropriate technical and organisational measures to protect your personal information, including:

• Payroll Number-based authentication with administrator-provisioned temporary credentials.

• Mandatory password change at first login, ensuring only the user knows their active password.

• Encryption of data in transit (SSL/TLS) and at rest.

• Access controls and role-based permissions restricting data access to authorised personnel only.

• Regular security assessments and audits.

• Staff training on data protection obligations across all subsidiaries.

9.2 Your Responsibilities

You are responsible for maintaining the confidentiality of your Payroll Number and password. Do not share your credentials with any other person. If you believe your account has been compromised, contact your subsidiary's HR administrator or APD immediately at privacy@apd.africa.

9.3 Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, APD will notify affected individuals and the relevant data protection authority in the applicable country, within the timeframes required by the applicable national data protection law (Kenya, Uganda, Tanzania, or Zambia).

10. Cookies and Tracking Technologies

The Academy uses cookies and similar technologies to enhance your experience, analyse usage, and personalise content. The types of cookies used include:

Essential cookies: Necessary for the Academy to function, including maintaining your login session and subsidiary routing. These cannot be disabled.

Performance cookies: Used to collect anonymised data on how users interact with the Academy, helping us identify issues and improve the platform.

Functionality cookies: Allow the Academy to remember your preferences and settings for a more personalised experience.

Marketing cookies: Used to deliver relevant communications where you have given consent. These can be managed through your browser settings.

You may manage cookie preferences through your browser settings. Please note that disabling essential cookies may affect your ability to log in or use certain Academy features, including subsidiary routing.

11. Your Privacy Rights

Subject to the applicable data protection law in your country of employment (Kenya, Uganda, Tanzania, or Zambia), you have the following rights regarding your personal information:

To exercise any of the above rights, please contact us using the details in Section 13, or contact your subsidiary's designated privacy officer. We will respond within the timeframe required by applicable law (typically thirty (30) days). We may ask you to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the applicable national data protection authority:

• Kenya — Office of the Data Protection Commissioner (ODPC): www.odpc.go.ke

• Uganda — Personal Data Protection Office (PDPO): www.pdpo.go.ug

• Tanzania — Personal Data Protection Commission (PDPC): www.pdpc.go.tz

• Zambia — Data Protection Commission (DPC Zambia): www.dpc.org.zm

12. Children's Privacy

The APD eLearning Academy is intended for employees and registered stakeholders aged 18 and above. We do not knowingly collect personal information from minors. If you believe a minor has been granted access to the Academy, please notify your subsidiary HR administrator or APD immediately at privacy@apd.africa.

13. Third-Party Links

The Academy may contain links to external websites or resources. This Privacy Policy does not apply to those third-party sites. We encourage you to review their respective privacy policies before providing any personal information.

14. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact your subsidiary's academy administrator or reach APD Group at:

15. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law across our countries of operation. We will notify you of material changes by posting the revised Policy on the Academy with an updated effective date. Your continued use of the Academy after any changes constitutes your acceptance of the updated Policy.

By using the APD eLearning Academy, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein.