Last updated: 1 October 2026 · Effective date: 1 October 2026

This Privacy Policy describes how Vingon PLC ("TelelBirds", "we", "us", "our") collects, uses, discloses and protects the personal information of visitors to our website at telelbirds.com and users of our products and services (collectively, the "Services"). We take privacy seriously; farmers trust us with the operational heartbeat of their businesses, and nothing in this document is more important than that trust.

1. Who we are

Vingon PLC is a company registered in the Republic of Kenya under number PVT-9XUQ9MV, with registered offices at P.O. Box 986 — 20200, Kericho, Kenya. We operate the TelelBirds Poultry Records Management System, Hatchery Pro, the IoT Sensor Kit, Classifieds Ads, Veterinary Consulting and the Training Academy. For the purposes of applicable data protection law, Vingon PLC is the data controller for most data processed through the Services, and the data processor for the specific records our customers enter about their flocks and farms.

2. The data we collect

We collect only data that is necessary to deliver, improve and secure our Services, split into the following categories:

a) Identity & contact data

Name, email, phone number, farm or company name, country of residence, preferred language.

b) Account & authentication data

Username, hashed and salted password (we never store plaintext passwords), two-factor authentication tokens, device identifiers used for session management.

c) Billing data

Billing address, tax identifier (if applicable), payment method identifiers. Payment card numbers are tokenised and handled by our PCI-DSS-compliant payment partners (Stripe, Pesapal, M-Pesa). We do not store card primary account numbers.

d) Operational flock data (customer content)

Records about your flocks, feed, eggs, mortality, finances, hatchery operations and so forth. Legally, this data is yours. We process it only as your service provider.

e) Technical & usage data

IP address, device model, operating system, browser type, pages visited, timestamps, approximate geolocation (derived from IP), referral source, error logs.

f) Support data

Content of emails, chat messages and support tickets you send us, including any attachments you provide.

g) Marketing data

Preferences for communications (newsletter subscriptions, product updates), demographic categories you choose to share.

3. How we collect it

• Directly from you — when you register, buy a subscription, use the Services, contact support, respond to a survey or sign up for the newsletter.
• Automatically — through cookies, log files, analytics scripts and the TelelBirds mobile app, as described in Section 10.
• From partners — payment processors confirm transactions; our hatchery hardware partners confirm successful shipping; your network connection provides your IP address.

4. Why we collect it (lawful bases)

We rely on the following lawful bases, drawn from Kenya's Data Protection Act 2019, the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA):

• Contract — to provide the Services you have signed up for.
• Legitimate interest — to secure our systems, prevent fraud, improve the product, provide customer support, and run analytics on aggregated usage.
• Legal obligation — to retain certain records for tax, accounting and regulatory compliance.
• Consent — for marketing communications, non-essential cookies, participation in optional research programmes and the optional AI-training opt-in.

5. Who we share data with

We share data only where strictly necessary, and only with parties bound by appropriate confidentiality and data-processing obligations.

• Service providers — hosting (AWS Africa, Nairobi region), payment processors (Stripe, Pesapal, M-Pesa), transactional email (Postmark), SMS gateways, customer support tooling.
• Professional advisers — accountants, auditors, lawyers under strict confidentiality.
• Regulators — when required by law or formal legal process.
• Successors — in the event of a merger, acquisition or restructuring, with notice to affected users.

We do not sell personal information to any third party. Full stop. This includes advertisers, data brokers, feed companies, insurance companies and AI vendors. We would rather close the company than violate this commitment.

6. International transfers

Our primary data processing happens in the AWS af-south-1 region in Nairobi, Kenya. Backups and limited administrative access from team members may involve data transfer to the United Kingdom and Germany. Where data moves outside the European Economic Area or Kenya, we rely on Standard Contractual Clauses or equivalent legal safeguards. You can request a copy of these clauses at any time.

7. How long we keep data

Our general retention schedule:

• Account and identity data: for the life of the account plus 6 years.
• Operational flock records: for the life of the account; 90 days after account closure the data is scheduled for permanent deletion, during which window you may request export or restoration.
• Billing records: 7 years, as required by Kenyan tax law.
• Server access logs: 90 days.
• Support tickets: 3 years after resolution.
• Marketing lists: until you unsubscribe or we have had no engagement from you for 24 months.

8. Your rights

Depending on your jurisdiction, you have some or all of the following rights:

1. Access — a copy of the personal data we hold about you.
2. Rectification — correction of inaccurate data.
3. Erasure — deletion of your data where there is no overriding legal reason to retain it.
4. Restriction — temporary suspension of processing while a dispute is resolved.
5. Portability — export of your data in a structured, commonly used, machine-readable format (we offer this one-click, no questions asked, for all users).
6. Objection — to processing based on legitimate interest, including profiling.
7. Withdraw consent — at any time, where processing is based on consent.
8. Not be subject to automated decisions — including profiling that produces legal or similarly significant effects.
9. Non-discrimination (CCPA) — for exercising your rights.
10. Complain to the regulator — the Kenya Office of the Data Protection Commissioner (ODPC), your national data-protection authority, or the California Attorney General, depending on jurisdiction.

To exercise any right, email [email protected]. We respond within 30 days (sometimes faster — we track this metric publicly in our transparency report).

9. How we keep data secure

• End-to-end TLS 1.3 for data in transit.
• AES-256 encryption at rest for all databases and backups.
• Access to production data limited to a small on-call engineering team, logged and audited.
• Mandatory two-factor authentication for staff.
• Quarterly third-party penetration tests. Latest report summary available on request.
• Independent SOC 2 Type II audit renewed annually.
• Formal incident-response plan with 72-hour breach-notification commitment.

No system is perfectly secure, but every reasonable commercial measure is in place and in continuous review.

10. Cookies & tracking

Our full cookie behaviour is explained in the Cookie Policy. In short: we use a small number of strictly necessary cookies to run the Services, and we ask explicitly before enabling any non-essential analytics. We honour browser "Do Not Track" and the Global Privacy Control (GPC) signal.

11. Children's data

The Services are not intended for use by children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data to us, email [email protected] and we will delete it promptly.

12. AI, training & profiling

We do not train AI models — ours, or any third party's — on your private flock data. Period. The TelelBirds mobile app and web dashboard do apply pre-trained models to help you (anomaly detection on egg counts, feed-consumption forecasting, benchmarking). Those models are trained on anonymised and aggregated statistics from an opt-in research cohort, never on individual-customer records without explicit consent. If you join the opt-in research cohort you can opt out at any time with one click, and no previously trained model will contain personally identifying information about you or your farm.

We do not permit third-party AI crawlers to ingest your private account data. Our robots.txt and specific signals (noai headers, Google-Extended, GPTBot, ClaudeBot controls) are configured to allow public blog content for responsible training, while denying private endpoints. You can request a technical breakdown of our bot policy in writing.

13. Changes to this policy

When this policy changes materially, we notify active users by email at least 30 days in advance. Non-material changes (typo fixes, link updates) are made with a note in the changelog on this page.

14. Contact us

Data Protection Officer
Vingon PLC (TelelBirds)
P.O. Box 986 — 20200, Kericho, Kenya
Email: [email protected]
Phone: +254 719 471 625
Hours: Mon–Fri 08:00–18:00 EAT

For Kenyan residents: you may also complain directly to the Office of the Data Protection Commissioner at odpc.go.ke.