Privacy Policy.

UrbanKisaan Farms Private Limited (“UrbanKisaan”, “we”, “us”) is a company incorporated in India, with its registered office at 10A, AVK SRI Harsha Icon, Service Road, Financial District, Nanakramguda, Hyderabad 500032, Telangana, and a wholly owned subsidiary of UrbanKisaan Inc., Delaware, USA. This Privacy Policy explains how we collect, use, disclose, and process your personal data when you use our website, FarmOS, GenoFlow, our models (Aadi, Jeeva and Akash), or other UrbanKisaan products and services (the “Services”), and when you enquire about or buy our seed, crop nutrition, GrowRush farms and GeneRush rooms. This Privacy Policy does not apply to content that we process on behalf of customers of our business offerings. Our use of that data is governed by our customer agreements covering access to and use of those offerings, including our Commercial Terms of Service.

This Privacy Policy also describes your privacy rights. More information about your rights, and how to exercise them, is set out in Section 4 (“Rights and Choices”).

1. Collection of Personal Data

We collect the following categories of personal data:

Personal data you provide to us directly

• Identity and Contact Data: UrbanKisaan collects identifiers, including your name, email address, and phone number when you sign up for an UrbanKisaan account, or to receive information on our Services. We may also collect or generate indirect identifiers (e.g., “USER12345”).
• Payment Information: We shall collect your payment information if you choose to purchase access to UrbanKisaan’s Services.
• Inputs and Outputs: You are able to interact with our Services in a variety of formats, including uploading genomic, phenotypic, image and sensor data, running analyses, and asking questions of your farm or trial data. The content you submit to the Services through these interactions, including via third-party applications, services, and content you choose to upload, integrate or interact with using our Services, are your “Inputs”. Inputs generate responses and actions (“Outputs”). If you include personal data or reference external content in your Inputs, we will collect that information and it may be reproduced in your Outputs.
• Feedback on your use of our Services: We appreciate feedback, including ideas and suggestions for improvement or rating an Output in response to an Input (“Feedback”). If you rate an Output in response to an Input, we may store the related Input and Output as part of your Feedback.
• Study Participation Data: If you participate in UrbanKisaan research studies, trials, pilots, surveys, or interviews, we collect the responses you provide, associated account data, and related Technical Information. We may combine this data with other data from your account for aggregated analysis.
• Communication Information: If you communicate with us, including through the forms on our website, by email, by phone or in meetings, we collect your name, contact information, and the contents of any messages you send. Enquiries and pre-orders also include what you grow and where, the products you are interested in, and the organisation you represent.

When you provide Inputs—including by uploading files, granting the Services access to third-party services, or instructing the Services to retrieve or act on information—you are responsible for ensuring you have the necessary rights, permissions, or authority to do so.

Personal data we receive automatically from your use of the Services

When you use the Services, we also receive certain technical data automatically (described below, collectively “Technical Information”). This includes:

• Device and Connection Information: Consistent with your device or browser permissions, your device or browser automatically sends us information about when and how you install, access, or use our Services. This includes information such as your device type, operating system information, browser information and web page referers, mobile network, connection information, mobile operator or internet service provider (ISP), time zone setting, IP address (including information about the location of the device derived from your IP address), identifiers (including device or advertising identifiers, probabilistic identifiers, and other unique personal or online identifiers), and device location.
• Usage Information: We collect information about your use of the Services, such as the dates and times of access, browsing history, search, information about the links you click and about third-party applications, services, and content you integrate or interact with, pages you view, and other information about how you use the Services, and technology on the devices you use to access the Services.
• Log and Troubleshooting Information: We collect information about how our Services are performing when you use them. This information includes log files. If you or your device experiences an error, we may collect information about the error, the time the error occurred, the feature being used, the state of the application when the error occurred, and any communications or content provided at the time the error occurred.
• Cookies & Similar Technologies: We and our service providers use cookies, scripts, or similar technologies (“Cookies”) to manage the Services and to collect information about you and your use of the Services. These technologies help us to recognize you, customize or personalize your experience, market additional products or services to you, and analyze the use of our Services to make them safer and more useful to you. On our website, analytics and marketing cookies are set only after you accept them. For more details about how we use these technologies, and your opt-out controls and other options, please visit our Cookie Policy.

Personal data we collect or receive to train our models

Our models are trained on plant genomic, phenotypic and environmental data. Specifically, we train our models using data from the following sources:

• Publicly available datasets and information via the Internet
• Datasets that we obtain through agreements with research partners and third party businesses
• Data from our own growing rooms, farms and trials
• Inputs and Outputs that a customer has agreed in writing that we may use
• Feedback that users explicitly provide about our Services
• Data that we generate internally

2. Uses of Personal Data Permitted Under Applicable Data Protection Laws

We use your personal data for the following purposes:

• To provide, maintain and facilitate any products and services offered to you with respect to your UrbanKisaan account, which are governed by our Commercial Terms of Service;
• To provide, maintain and facilitate optional services and features that enhance platform functionality and user experience;
• To provide you with service updates, communications, and to provide tailored recommendations about our Services that may be of interest to you;
• To create and administer your UrbanKisaan account;
• To facilitate payments for products and services provided by UrbanKisaan;
• To prevent and investigate fraud, abuse, and violations of our Commercial Terms of Service, unlawful or criminal activity, unauthorized access to or use of personal data or UrbanKisaan systems and networks, to protect our rights and the rights of others, to protect your safety or that of any other person, and to meet legal, governmental and institutional policy obligations;
• To investigate and resolve disputes;
• To investigate and resolve security issues;
• To debug and to identify and repair errors that impair existing functionality;
• To improve the Services and conduct research, including research in plant science and on how growing rooms and farms perform; and
• To enforce our Commercial Terms of Service and similar terms and agreements, including our Commercial Terms of Service.

We do not use your Inputs and Outputs to train our models unless you or your organisation agree to that in writing, for example under a research collaboration or a data partnership, and then only on the terms of that agreement. Where a dataset we train on includes details of growers, field staff or researchers, we remove or pseudonymise them before use.

Please see Section 10 below for details of our legal bases for processing your personal data.

3. Recipients and Third-Party Data Sources

UrbanKisaan will disclose personal data to, or receive personal data from, the following categories of third parties for the purposes explained in this Policy:

• Affiliates & corporate partners: UrbanKisaan discloses the categories of personal data described above between and among its affiliates and related entities.
• Service providers & business partners: UrbanKisaan may receive and disclose the categories of personal data described above with service providers and business partners for a variety of business purposes, including website and data hosting (Render, Cloudflare), customer relationship management and email (HubSpot), cloud computing for our software and models, payment and banking, logistics and installation, ensuring compliance with industry standards, research, auditing, data processing, investigating and resolving safety and security issues, preventing and investigating fraud, abuse, and violations of our Commercial Terms of Service, and providing you with the Services.
• Your Organization and Administrator: If you use an email address owned by your employer or another organization, your account may be linked to the organization’s account with us, as described in our Commercial Terms of Service, and its administrators may see your account and activity data.

UrbanKisaan may also receive or disclose personal data in the following circumstances:

• As part of a significant corporate event: If UrbanKisaan is involved in a merger, corporate transaction, bankruptcy, or other situation involving the transfer of business assets, UrbanKisaan will receive or disclose your personal data as part of these corporate transactions.
• Third-Party Websites, Integrations, and Services: Our Services may allow you to connect to and interact with third-party applications, services, and content (“Third-Party Services”) through integrations you enable. When you do, the Services may send your Inputs and Outputs to the Third-Party Service, and may retrieve content from it, which becomes part of your Inputs. The Third-Party Service receives this data directly and processes it according to its own privacy policy. UrbanKisaan does not control, and is not responsible for, the data practices of Third-Party Services. Before enabling an integration, you should ensure you have the authority to grant such access and review the third party’s privacy policy. Our Services may also link to third-party websites (such as social media); by following these links, you provide information directly to those third parties. Our linking to, or supporting an integration with, a Third-Party Service does not mean we endorse it or speak for that third party.
• the Services may send your Inputs, Outputs, and instructions to Third-Party Services to perform actions on your behalf (such as reading files, sending messages, or retrieving information). The Third-Party Service receives this data directly and processes it according to its own privacy policy.
• the Services may retrieve content and data from Third-Party Services you interact with. This data becomes part of your Inputs.
• Some integrations or features may allow the Services to access Third-Party Services on an ongoing basis until you disable the feature or disconnect the integration in your settings.
• UrbanKisaan does not control, and is not responsible for, the data practices of Third- Party Services. Before enabling an integration, granting the Services access to, or instructing the Services to take actions on a Third-Party Service, you should ensure you have the authority to grant such access and that doing so complies with any applicable terms, policies, or confidentiality obligations. Before enabling an integration, you should review the third party’s privacy policy. Our Services may also link to third-party websites (such as social media); by following these links, you provide information directly to those third parties. Our linking to, or supporting an integration with, a Third-Party Service does not mean we endorse it or speak for that third party.
• Pursuant to regulatory or legal requirements, safety, rights of others, and to enforce our rights or our terms. We may share personal data with government authorities, law enforcement, or other third parties where, based on the information available to us, we have a good-faith belief that disclosure is reasonably necessary to (i) comply with applicable law, regulation or legal process, including for legal, tax or accounting purposes, or in response to an enforceable governmental request; (ii) prevent serious harm to any person or to property; (iii) detect, prevent, or otherwise address fraud or other illegal activity; or (iv) enforce our terms, or protect the rights, property, security, or safety of UrbanKisaan, our users, or others.
• Research publications: We may publish aggregated, de-identified, or anonymized findings from our research, including research into how our Services are used and research in plant science.
• With an individual’s consent: UrbanKisaan will otherwise disclose personal data when an individual gives us permission or directs us to disclose this information, including as a part of our Services.

4. Rights and Choices

Depending on where you live and the laws that apply in your country of residence, you may enjoy certain rights regarding your personal data, as described further below. However, please be aware that these rights are limited, and that the processes by which we may need to action your requests regarding our training dataset are complex. We may also decline a request if we have a lawful reason for doing so. That said, we strive to prioritize the protection of personal data, and comply with all applicable privacy laws.

To exercise your rights, you or an authorized agent may submit a request by contacting us. After we receive your request, we may verify it by requesting information sufficient to confirm your identity (e.g. email address, billing details). Where a third party representative submits a request on behalf of a data subject, we require evidence of authorization to act on behalf of the data subject.

We will respond to your request within the period required by the data protection law that applies to you. For example, where the EU GDPR or UK GDPR applies, we will respond within one calendar month of receiving a verifiable request, and where your request is complex or you have made a number of requests within a short timeframe, we may extend that period by up to a further two months. Where another law applies to you and sets a different period, we will respond within that period. You may also have the right to appeal requests that we deny by emailing hello@urbankisaan.com. UrbanKisaan will not discriminate based on the exercising of privacy rights you may have. Set out below is a summary of the rights which you may enjoy, depending on the laws that apply in your country of residence.

• Right to know: the right to know what personal data UrbanKisaan processes about you, including the categories of personal data, the categories of sources from which it is collected, the business or commercial purposes for collection, and the categories of third parties to whom we disclose it.
• Access & data portability: the right to request a copy of the personal data UrbanKisaan processes about you, subject to certain exceptions and conditions. In certain cases and subject to applicable law, you have the right to port your information.
• Deletion: the right to request that we delete personal data collected from you when you use our Services, subject to certain exceptions.
• Correction: the right to request that we correct inaccurate personal data UrbanKisaan retains about you, subject to certain exceptions. Please note that we cannot guarantee the factual accuracy of Outputs. If Outputs contain factually inaccurate personal data relating to you, you can submit a correction request and we will make a reasonable effort to correct this information.
• Objection: the right to object to processing of your personal data, including profiling conducted on grounds of public or legitimate interest. In places where such a right applies, we will no longer process the personal data in case of such objection unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise or defense of legal claims. If we use your information for direct marketing, you can object and opt out of future direct marketing messages using the unsubscribe link in such communications.
• Restriction: the right to restrict our processing of your personal data in certain circumstances.
• Withdrawal of consent: Where UrbanKisaan’s processing of your personal data is based on consent, you have the right to withdraw your consent, for example by changing your choice on our cookie notice. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
• Automated decision-making: UrbanKisaan does not engage in decision making based solely on automated processing or profiling in a manner which produces a legal effect (i.e., impacts your legal rights) or significantly affects you in a similar way (e.g., significantly affects your financial circumstances or ability to access essential goods or services).
• Sale & targeted UrbanKisaan marketing of its products and services: UrbanKisaan does not “sell” your personal data as that term is defined by applicable laws and regulations, and does not use advertising networks on its website. You can opt out of marketing at any time using the unsubscribe link in our emails or by contacting us.

Where you hold an account with us, you can manage much of your data in your account settings. For anything else, contact us as described in Section 9.

5. Data Transfers

UrbanKisaan is based in India, and when you access our Services, your personal data is transferred to our servers and service providers in India, the United States, or other countries outside the European Economic Area (“EEA”) and the UK for the purposes outlined in Section 2 of this Privacy Policy, for example to provide you with the Service or to conduct research. For example, our customer relationship records are held by HubSpot in its North American data centres. This may be a direct provision of your personal data to us, or a transfer that we or a third party make. Where India’s data protection law restricts transfers to particular countries, we comply with those restrictions.

Where UrbanKisaan transfers information outside the EEA or the UK, we ensure it benefits from an adequate level of data protection by relying on:

• Adequacy decisions: These are decisions from the European Commission under Article 45 GDPR (or equivalent decisions under other laws) where they recognize that a country outside of the EEA offers an adequate level of data protection; or
• Standard contractual clauses: The European Commission has approved contractual clauses under Article 46 GDPR that allows companies in the EEA to transfer data outside the EEA. These (and their approved equivalent for the UK and Switzerland) are called standard contractual clauses. We rely on standard contractual clauses to transfer information as described in “Collection of Personal Data” to certain affiliates and third parties in countries without an adequacy decision.

In certain situations, we rely on derogations provided for under applicable data protection law to transfer information to a third country. If you have questions about international transfers, or the safeguards we apply, you can contact us.

6. Data Retention, Data Lifecycle, and Security Controls

UrbanKisaan retains your personal data for as long as reasonably necessary for the purposes and criteria outlined in this Privacy Policy. As a guide: enquiries and pre-orders that do not lead to a purchase are kept for up to 3 years after our last contact with you; customer, contract, invoice and payment records for the life of the relationship and 8 years after, as company and tax law requires; account data while the account is active and for 90 days after it closes; Inputs and Outputs as our Commercial Terms of Service provide; and server and security logs for up to 12 months.

When the personal data collected is no longer required by us, we and our service providers will perform the necessary procedures for destroying, deleting, erasing, or converting it into an anonymous form as permitted or required under applicable laws.

Aggregated or De-Identified Information

We apply aggregation and de-identification techniques where appropriate as part of our data minimization practices. For example, we may process personal data in an aggregated or de- identified form to analyze and improve the effectiveness of our Services including to conduct analytics, conduct research, study user behavior, and train our models as permitted under applicable laws. For instance:

• When you submit Feedback, we disassociate Inputs and Outputs from your user ID before using them to improve our Services.
• If our systems flag Inputs or Outputs for potentially violating our Commercial Terms of Service, we disassociate the content from your user ID to improve our internal safety and abuse controls. However, we may re-identify the Inputs or Outputs to enforce our Commercial Terms of Service with the responsible user if necessary.
• To improve user experience, we may analyze and aggregate general user behavior and usage data. This information does not identify individual users.

Where data is de-identified, UrbanKisaan will maintain and use this information in its de- identified form, and will not attempt to re-identify such information, except as permitted by law.

Security Controls Relating to our Processing of Personal Data

We implement appropriate technical and organizational security measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction.

7. Children

Our Services are not directed towards, and we do not knowingly collect, use, disclose, sell, or share any information from children under the age of 18. We have measures in place to detect and remove children from our Services. If you become aware that a child under the age of 18 has provided any personal data to us while using our Services, please email us at hello@urbankisaan.com and we will investigate the matter and, if appropriate, delete the personal data.

8. Changes to Our Privacy Policy

UrbanKisaan may update this Privacy Policy from time to time. We will notify you of any material changes to this Privacy Policy, as appropriate, and update the date at the top of this page.

9. Contact Information

The data controller responsible for your personal data is UrbanKisaan Farms Private Limited.

If you have any questions about this Privacy Policy, or have any questions, complaints or requests regarding your personal data, you can contact our Grievance Officer, Dr Sairam Reddy Palicherla, as described below:

• Grievance Officer: Dr Sairam Reddy Palicherla, UrbanKisaan Farms Private Limited, 10A, AVK SRI Harsha Icon, Service Road, Financial District, Nanakramguda, Hyderabad 500032, Telangana, India.

You can email us at hello@urbankisaan.com with “Privacy” in the subject line.

Please note that under many countries’ laws, you have the right to lodge a complaint with the supervisory authority in the place in which you live or work. If you live in India, you have the right to complain to the Data Protection Board of India once you have raised the matter with us. If you live in the EEA, you may complain to your national data protection authority; a list is published by the European Data Protection Board. If you live or work in the UK, you have the right to lodge a complaint with the UK Information Commissioner’s Office.

10. Legal Bases for Processing

Where the GDPR or UK GDPR applies to our processing, we rely on the following legal bases: