Tenant Terms of Service
Version 1.2 · effective 2026-11-15. Notice given 2026-09-13 under §14. Superseded by v1.3 on 2026-12-01. Published here because it is the version in force between those dates, and because an acceptance row recorded against [email protected] must stay readable for as long as the row does.
These are the terms a farm accepts inside the Koklo Nya application, recorded against this version number. They are not the website terms, which govern use of www.koklonya.com.
Version: 1.2 Effective date: 2026-11-15 (notice given 2026-09-13 — see §14)
⛔ THE EFFECTIVE DATE MOVED FROM 2026-10-15 TO 2026-11-15 ON 14 SEPTEMBER 2026, AND THE REASON IS THE NOTICE, NOT THE TERMS. §14 requires written notice to each tenant owner's contact email. The version was PUBLISHED on 2026-09-13 and no email was sent — on the footing that §14.1 states there are no third-party tenants, so publication reached everyone it had to. If that footing is wrong, the notice was defective and no date in this document would have cured it. Moving the date is the remedy that costs nothing and presumes nothing: a notice served any time up to 2026-10-16 still carries the full 30 days. ⚠ Nothing in the terms themselves changed with this move. Supersedes: v1.1, effective 2026-07-31, which remains the version in force until 2026-11-15 Acceptance: required on first sign-in by every user; recorded in
public.tenant_ts_acceptance(id, tenant_id, user_id, version, accepted_at, ip_address, user_agent)
Note on this version. v1.1 adds §1.1 (statutory positions, not advice) and a related responsibility in §6. That is a material change, so §14 would normally require 30 days' notice and explicit re-acceptance. There was no incumbent acceptance to supersede when v1.1 was written:
public.tenant_ts_acceptancedid not exist in any migration and no tenant had ever accepted v1.0, so no notice window was running and none was owed. That is no longer true — migration20260722000142_tenant_terms_acceptancecreated the table, and the acceptance step is live. The §14 process governs every change from here.
⛔ Correction of 7 September 2026 — READ THIS BEFORE RELYING ON THE VERSION NUMBER. The "Cross-border transfer rationale" in §2 previously stated that the Ghana Data Protection Commission had recognised the UK and EU as "adequate", and that transfer was therefore lawful "without requiring additional Standard Contractual Clauses or your individual consent". That was wrong. The Data Protection Act 2012 (Act 843) contains no cross-border transfer provision, no mechanism for declaring a country adequate, and no such function among the Commission's functions under s.3 — so there was no recognition to rely on and none could have been made. A statement of that kind, in a document about a tenant's own compliance, must not stand for a day longer than it takes to correct, so the passage has been rewritten in place to set out what Act 843 in fact requires and where the assessment actually lies.
✅ This is v1.2, and it takes effect on 2026-11-15. The correction is material, so §14 governs. ⚠ The effective date is LATER than §14's minimum, and deliberately so — it is not the end of a 30-day count from the publication date of 2026-09-13, which would have been 2026-10-13. §14 requires at least 30 days' written notice, and the extra room exists so that a notice served as late as 2026-10-16 still carries its full 30 days. Until 2026-11-15 v1.1 remains the version in force — you are not asked to re-accept before the notice period you are owed has elapsed.
The version is declared in two places and they move together: this header, and
LEGAL_VERSION_SCHEDULEinpackages/shared/src/schemas/legal-consent.ts. That schedule carries v1.2 with aneffectiveFromof 2026-11-15, so the consent gate keeps accepting v1.1 until the date arrives and then asks for v1.2 on the next sign-in — without a second deployment, and without locking anyone out during the notice period. Determined and recorded atdocs/audit-reviews/CA_DETERMINATION_data_residency_act915_s27_2026-09-07.md, Addendum 1 §A1.6 and Addendum 2.
This Terms of Service governs your tenant's use of Koklonya. By signing into Koklonya you confirm that you have read, understood, and agree to these terms on behalf of your farm or organization (the "tenant"). If you do not agree, do not sign in.
Plain-English version first. A more formal contract section follows for legal review. Where the two conflict, the formal section governs.
1. What Koklonya is
Koklonya is a multi-tenant ERP for poultry farms, operated from Ghana by Edem Segbefia trading as Koklonya (the "operator"). It records your farm's daily production, mortality, sales, procurement, payroll, and accounting data, and produces IFRS-acceptable financial reports for your auditor.
You retain ownership of all data you put into Koklonya. The operator processes that data on your behalf to deliver the service you signed up for, and for no other purpose.
1.1 Statutory positions, not advice
Koklonya applies published rules — tax rates, thresholds, accounting standards — to the figures you enter, and shows you the position those rules produce. That is a computation of general application, not advice about your particular circumstances.
In plain terms:
- What the software does. It surfaces the statutory position that the rules produce on your own data, and shows the provision it relied on so you can check it.
- What it does not do. It does not advise you on your tax affairs, does not tell you what you ought to do about your position, and does not act for you before the Ghana Revenue Authority or any other authority.
- What remains yours. Every return, declaration and filing is made and signed by your own authorised officer. You are the taxpayer of record.
- Please confirm. Statutory positions the software surfaces should be confirmed with your own tax adviser, or with the GRA, before you rely on them — particularly where the amounts are material or your circumstances are unusual.
Where the software shows a figure or an obligation, it is telling you what the rules produce on the facts entered. It is not telling you what to do.
The operator is not your tax adviser, accountant or auditor, and nothing in the service creates that relationship. Where the operator has obtained professional opinions to configure the software correctly, those opinions were obtained for the operator's own purposes — they are quality assurance on the configuration, not advice given to you, and you may not rely on them as such.
2. Where your data lives
| Layer | Location | Provider |
|---|---|---|
| Application database (Postgres + Auth + Storage) | eu-west-2 (London, United Kingdom) | Supabase Pro |
| Application server | Oracle Cloud or Hetzner Cloud, EU region | self-managed |
| Edge / DNS / WAF | Cloudflare global edge | Cloudflare |
| Off-site backup mirror | Backblaze B2 cold tier, EU region | Backblaze |
| Optional Ghana read replica | operator hardware in Accra (Phase 1+ only) | self-managed |
Cross-border transfer rationale. Your data is collected in Ghana and stored in the United Kingdom. The Data Protection Act 2012 (Act 843) does not gate that transfer, and no Ghanaian regulator has approved it. ⚠ That statement is about Act 843, which is the statute governing personal data. It is not a claim that no other Ghanaian law bears on where your records sit — Act 915 s.27 requires tax records to be maintained within the country, and sector regulators may impose their own requirements on your farm. §10 sets out the retention duties the operator implements; anything specific to your circumstances is yours to check. The Data Protection Act 2012 (Act 843) contains no provision permitting or restricting the transfer of personal data out of Ghana, no mechanism for declaring a foreign country "adequate", and no such function among the Data Protection Commission's functions under s.3 (implement and monitor compliance; make administrative arrangements; investigate complaints; keep the Data Protection Register). There is therefore no adequacy decision for anyone to rely on, no Ghanaian equivalent of Standard Contractual Clauses to sign, and no transfer-specific consent for you to collect. Where the Act does mention foreign law, it points the other way: s.18(2) governs personal data sent into Ghana from a foreign jurisdiction, not Ghanaian data sent out.
What Act 843 does instead is follow the data. Under s.45(1)(c) the Act applies to processing "in respect of information which originates partly or wholly from this country" — so your data does not leave Ghanaian law by leaving Ghana. Under s.30(2) and (3) the processing must be governed by a written contract obliging the processor to maintain the confidentiality and security measures necessary to ensure the integrity of the data. Under s.30(4), "where a data processor is not domiciled in this country, the data controller shall ensure that the data processor complies with the relevant laws of this country". Under s.28 the controller must take appropriate, reasonable, technical and organisational measures against loss, damage, unauthorised destruction and unlawful access. Those duties apply to your data on eu-west-2 exactly as they would to a filing cabinet in Accra.
What that means for you. Your tenant is the data controller and the operator is your processor (§12), so the s.30(4) duty is yours. The operator's job is to make it dischargeable: these terms and the Privacy Policy are the written contract s.30(2) requires between you and the operator; each sub-processor listed in §13 is engaged on terms requiring confidentiality and security; and §3 sets out the measures actually in place, which you may cite in your own records. Whether hosting your farm's personal data in the United Kingdom is appropriate for your circumstances is an assessment Act 843 leaves to you as controller — it is not one any Ghanaian authority has made for you, and if the answer is not obvious for your farm you should take your own advice. The destination is relevant to that assessment: the United Kingdom maintains its own data protection regime (UK GDPR and the Data Protection Act 2018). That is a fact about where your data sits, not a ruling by any Ghanaian regulator, and these terms do not present it as one.
A Ghana-resident read-only mirror of your data is maintained on operator hardware once your tenant reaches Phase 1 of the operator's infrastructure plan (typically when you sign as a paying customer). The mirror improves analytics performance and offers a disaster-recovery target; it does not change the writeable system of record, which remains in eu-west-2.
If your farm has a regulatory or contractual requirement that data must be hosted inside Ghana, contact the operator before signing in. Koklonya cannot satisfy that requirement today.
3. Security & access
- Encryption in transit: TLS 1.3 enforced on every connection to and from the system.
- Encryption at rest: Supabase Pro encrypts the database with KMS-managed keys. Storage buckets (mortality photos, branding assets, user avatars) are private by default and accessed via signed URLs with finite TTLs.
- Authentication: email + password via Supabase Auth, with optional TOTP-based two-factor. Two-factor is required for any user assigned a role that holds
tenant.billing.manageorfinancials.period.closepermissions, after that user's first 30 days. - Authorization: role-based access control with system, default, and tenant-custom roles. Every mutation is gated by an explicit permission key.
- Audit log: every change to your data attempts an append-only audit row recording who did what, when, from which IP, and with what before/after state. The write is synchronous and best-effort (non-blocking on audit failure): if it fails, the change still completes and the failure is logged to our error tracker, so gaps are possible. What a gap costs: the underlying change is still visible in your data, but the audit details of the missed row — who acted, from which IP and user agent, and the before/after values — are not recoverable. Audit rows are retained for at least as long as the record the row describes, plus any extension or legal hold that applies to that record — see §10; that is 6 years for tax and accounting records, 12 years for payroll records, statutory identifiers and employment contracts, and up to 12 years for some farm records. Audit rows are not included in the self-service export, which covers the
publicandaccountingdata only; ask us and we will extract the audit slice for your tenant manually. - Idempotency: safe retries are supported via a 24-hour idempotency-key replay window so a flaky network connection cannot cause double charges, double mortality entries, or duplicate batch placements.
The operator does not access your tenant's data except for support work you have requested. When operator staff act on a tenant's behalf, the action runs through an explicit time-limited "impersonation" mechanism that records both a tenant-side audit row and an operator-side audit row, both linked to a support ticket reference.
4. Backups & disaster recovery
- Supabase Pro takes daily logical backups with 7-day point-in-time recovery (PITR) on the application database.
- The operator runs a nightly off-site backup pipeline that exports an encrypted logical dump to Backblaze B2 cold-tier storage. ⚠ These copies persist for up to about 7 years and 3 months. The bucket's lifecycle hides a backup from ordinary listing after 90 days, and permanently deletes it 7 years after that hiding — so a copy can persist about 2,645 days from the night it was taken. The 90-day figure is visibility, not deletion, and an earlier version of these terms wrongly stated it as the retention period.
- A restore-drill exercise is performed quarterly on a staging environment to verify the recovery procedure. Results are documented in
docs/RUNBOOK_restore_drill.mdand available on request.
Recovery objectives:
- RPO (recovery point objective): ≤ 24 hours
- RTO (recovery time objective): ≤ 12 hours for the application; ≤ 24 hours for the database
These objectives are best effort, not contractually guaranteed in this version of the terms. A future enterprise tier may carry contractual SLAs.
5. Service level (Phase 0)
For the first phase of the service (pre-30 tenants), the operator targets:
| Metric | Target |
|---|---|
| Application uptime | 95.0% measured monthly (Phase 0) → 99.0% from first paying tenant → 99.5% from 30 tenants |
| Notification delivery (email / SMS / WhatsApp) | best effort; non-critical alerts may queue during quiet hours |
Service credits, refunds, and contractual SLAs are not available in this version. The operator publishes a public status page at https://status.koklonya.com for incident communication.
6. Your responsibilities
You agree to:
- keep your sign-in credentials secret;
- enable two-factor authentication for any user with elevated permissions;
- review and approve the role assignments for every user you invite;
- pay for the service plan you have selected;
- comply with applicable Ghanaian tax law, the Companies Act 2019, and the Ghana Veterinary Council's notifiable-disease reporting requirements when using the corresponding modules;
- satisfy yourself that any statutory position the software surfaces is correct for your circumstances before relying on it, and confirm it with your own tax adviser or the GRA where the amounts are material (see §1.1) — you remain the taxpayer of record and your own authorised officer signs every return;
- use the service for lawful purposes only.
You agree NOT to:
- attempt to reverse-engineer, decompile, or scrape the application except for legitimate data-export purposes via the published export tools;
- circumvent rate limits or RLS policies;
- use the service to store data unrelated to the operation of a poultry farm;
- introduce malicious code or attempt to compromise the operator's infrastructure.
7. Pricing & billing
The pricing model in effect at sign-up is documented separately and forms part of these terms by reference. You may upgrade or downgrade your plan via Settings → Billing. The operator may change pricing for future billing cycles with at least 30 days' notice; your existing billing cycle is unaffected.
Phase 0 (pre-public launch). During the operator's Phase 0 trial period, Koklonya is provided to invited tenants at no charge. Phase 0 may be ended with 60 days' notice, after which a paid plan must be selected to continue using the service. Your data is preserved across this transition.
8. Suspension & termination
The operator may suspend or terminate your tenant for:
- non-payment of fees overdue more than 30 days;
- material breach of these terms after 14 days' written notice and an opportunity to cure;
- legal compulsion (court order, regulatory action) in which case the operator will notify you to the extent legally permitted.
You may terminate your tenant at any time via Settings → Data & privacy → Request termination. On termination:
- The operator immediately stops accepting new writes to your tenant.
- A data export (a single JSON file, as described in §9) is generated and made available to you for 30 days. ⚠ It covers your
publicandaccountingtables only — it does not include attached files or audit-log rows, which you should retrieve separately before deletion (see §9); two files are produced: the tenant export described in §9, and a separate export of your own personal/account record. - After 30 days, all tenant data is deleted from the application database. ⚠ Backups are on a different clock: encrypted, access-restricted backup copies are not selectively edited and remain until B2's lifecycle permanently deletes them at 7 years (§4) — the 90-day figure there is when a copy stops being listed, not when it is destroyed. The application-database deletion excludes every retained record class listed in §10 — the records kept for tax purposes, the payroll, statutory-identifier and employment-contract records, the other accounting records kept as operator policy, the audit-log entries that describe those retained records (entries describing anything else follow the ordinary deletion above), the farm-record classes on their longer traceability periods, and notifiable-disease reports. Those are retained for the periods §10 states, on the basis §10 gives for each (legal obligation in some cases, operator policy in others). When a period expires the record becomes eligible for deletion and is deleted as §10 describes; we do not promise deletion at the moment a period ends, so it may persist under the same protections for some time after. ⚠ Backups are not edited in place. Off-site backup copies are not selectively rewritten to remove a deleted tenant; a copy persists until B2's lifecycle permanently deletes it — hidden after 90 days, deleted at 7 years (§4) — encrypted and access-restricted throughout, and is not restored into the live system except in a disaster-recovery event.
- Aggregated, fully de-identified usage metrics may be retained indefinitely for product analytics.
9. Data export & portability
If your role holds the tenant.data.export permission, you may export your tenant's data at any time without termination via Settings → Data & privacy → Export. Exports are produced as a single JSON file containing:
- a single JSON file (
koklonya-tenant-export-<tenant>.json), containing one entry per table you have permission to read across thepublicandaccountingdata; - your own personal record is separately available as
koklonya-account-export-<user>.json.
The export is gated on the tenant.data.export permission, and each export attempts an audit-trail entry on the best-effort basis described in §3.
⚠ What the JSON export does NOT include, stated plainly because an earlier version of these terms said otherwise: it is not a ZIP, there are no per-report CSV files, no attached files (mortality photos, branding assets, avatars), and no audit-log rows. Attachments remain available in the application, an audit slice can be extracted for you on request (§3), and the archive export below carries the attached files themselves.
There is also an archive export, and it DOES carry your document bytes. Alongside the JSON file, Settings → Data & privacy offers a gzipped tar (koklonya-tenant-export-<tenant>-<timestamp>.tar.gz) containing the same row bundle plus the stored documents themselves. It is gated on the same tenant.data.export permission and on the same sensitivity rules that apply in the application — a document you may not read there is not included here either, and the archive's manifest names every document it withholds and why. The paragraph above describes the JSON file only.
On rate limiting. A global cap of 300 requests per 5 minutes per IP address applies across the API and therefore to exports. Since 13 September 2026 a concurrency limit applies as well: one tenant export runs at a time per server process, and a request that arrives while another is still running is refused with 429 and a Retry-After header rather than being queued. It bounds memory on the server rather than your entitlement — it does not reduce what you may export, or how often, only how many may run at once. ⚠ This section previously said that no per-user, per-tenant, concurrency or queue limit existed, and reserved the right to introduce one "and will say so here if we do". This paragraph is that notice, given in place as the reservation provided.
10. Legal retention obligations
The operator may retain certain records beyond your termination date. Some of these retentions are required by Ghanaian law; others are periods we set ourselves or have not yet verified against a statute, and the source column below says which is which — the farm-record periods, for instance, are set on our Chartered Accountant's advice against Veterinary Services Directorate and EPA Ghana traceability requirements. As of the effective date of these terms, retained records are:
| Record type | Retention | Source |
|---|---|---|
| Records kept for tax purposes (invoices, ledgers and the documents substantiating them) | 6 years from the relevant date. Where a matter is open the records are kept until it ends, and the end differs by matter: an objection or appeal until it is decided and that decision is carried out; an application to the Commissioner-General until it is determined; a refund claim until the refund is made; an investigation until written notice that it is complete. Whichever of these and the six years runs longest governs | Revenue Administration Act 2016 (Act 915), s. 27(1) and (3); s. 27(2) brings the documents substantiating a transaction within the records to be kept; "relevant date" defined in s. 27(5) |
| Payroll records (pay runs, payslips, statutory schedules, disbursements) | 12 years (144 months) from the contribution due date. Where the record is also a tax record and a tax matter is open, whichever period runs longer governs | Operator policy. Purpose: answering a pension-contribution (SSNIT) claim, which can be brought long after the payment itself. We understand the period to derive from the National Pensions Act, 2008 (Act 766); we have not verified the specific provision against the text of the Act, so we state it as the period we keep rather than as a cited statutory minimum |
| Statutory identifiers (Ghana Card number, SSNIT number, TIN) | 12 years (144 months) from the end of employment | Operator policy. Purpose: identifying the member a contribution record belongs to for as long as that record can be questioned. Same Act 766 basis, and the same caveat, as the row above. The Ghana Card PIN is not kept on this clock — it is erased once its purpose ends |
| Employment contracts | 12 years (144 months) from the end of employment | Operator policy. Purpose: evidencing the terms against which a contribution or entitlement claim is measured. Same Act 766 basis and caveat. A contract that is also a tax document is independently reachable under Act 915 s. 27(1)-(3) at six years, which is shorter and so not the governing clock |
| Other accounting records not kept for tax purposes | 6 years from the end of the financial year the record belongs to, extended on the same terms as the row above whenever the record is also relevant to an open tax matter | Operator policy. Companies Act 2019 (Act 992), s. 127 requires proper accounting records to be kept but states no period, and we did not identify another statute supplying one for these in the sources we reviewed — so we align them with the tax records they sit alongside |
| Audit-log entries (the record of who did what, which evidences the records above) | At least as long as each record the entry describes, including any extension or legal hold that applies to that record. 12 years is the current longest, set by the payroll row above and the hatchery-lineage class below | Operator policy. We keep the log evidencing a record at least as long as the record itself. This is our own commitment, not a statutory period: Act 915 s. 27 sets periods for the tax records, and we did not find a provision fixing one for the log — a statement about the sources we reviewed, not an exhaustive survey |
| Notifiable-disease reports | 5 years | Operator policy, applied on Veterinary Services Directorate guidance. We have not verified a specific VSD instrument fixing five years, so this is stated as our own practice rather than as a statutory minimum |
Some farm records are kept longer than six years. These periods are operator policy, set on the advice of our Chartered Accountant and based on Veterinary Services Directorate (MoFA) and EPA Ghana traceability requirements. We have not identified a Ghanaian statute that fixes a number for them; that reflects the sources we reviewed rather than an exhaustive survey of every statute, regulation and sector rule, so we describe them as policy rather than as a legal minimum. The classes are listed separately but may overlap — a treatment entry can also be a movement record — and where a record falls into more than one, the longest applicable period governs:
| Farm record class | Retention |
|---|---|
| Hatchery lineage (parent stock, breeding cycles, genetics) | 12 years |
| Veterinary treatment, biosecurity, flock movement & traceability, mortality, movement permits — other than the notifiable-disease reports above | 10 years |
| Feed & nutrition traceability, environmental monitoring, waste management, chemical usage | 8 years |
Notifiable-disease reports are the 5-year row in the table above and are not included in the 10-year veterinary class. Audit-log entries describing any of these records are kept for at least as long as the record itself.
The six-year period does not always start on the transaction date. Under Act 915 it runs from the "relevant date" for the record, and where a matter touching those records is open, retention continues until the longer applicable period ends — noting that an investigation runs to written notice of completion, an objection or appeal to a decision that has been carried out, an application to its determination, and a refund claim to payment. In practice this means we may hold these records longer than six years where a tax matter concerning them is still live.
Retained records are encrypted, access-restricted, and used only for the purpose that triggered retention — a legal obligation where one applies, and otherwise the purpose stated above for each class. They are not used to identify you, except where the legal obligation or operator-policy purpose that triggered retention itself requires identification — for example producing a named payroll or tax record to an authority that demands it — and are not used for any other purpose.
On deletion, so the commitment matches what the system does. When a record's retention period ends it becomes eligible for deletion; we do not promise that deletion happens at that moment, and a record may remain in encrypted, access-restricted storage for some time after its period ends. It stays subject to every protection above throughout and is never used for another purpose. You may ask us to confirm the status of a retained record, or request deletion of one whose period has expired, through the data-subject request route described in the Privacy Policy (§12).
11. Limitation of liability
To the fullest extent permitted by Ghanaian law:
- the operator's total aggregate liability to your tenant under these terms in any 12-month period is limited to the fees you paid the operator during that period;
- the operator is not liable for indirect, consequential, special, exemplary, or punitive damages;
- the operator is not liable for losses arising from third-party services (Supabase, Cloudflare, telecommunications providers, payment gateways) where the loss is caused by the third-party's fault and not the operator's;
- nothing in these terms limits liability for fraud or for any liability that cannot be excluded under Ghanaian law.
The service is provided "as is." Specific warranties of merchantability or fitness for a particular purpose are disclaimed except as expressly stated in these terms.
12. Privacy
A standalone Privacy Policy is published at https://koklonya.com/privacy and forms part of these terms by reference. The Privacy Policy describes what personal data Koklonya processes, why, with whom it is shared (no third party for advertising; Supabase / Cloudflare / Backblaze as named sub-processors), how it is secured, and the rights of data subjects under the Ghana Data Protection Act 2012.
You are responsible for the lawful basis on which your tenant collects personal data about its own employees, customers, and suppliers, and for providing them with the privacy notices required under Ghanaian law. Koklonya is the processor of that data on your behalf; your tenant is the controller.
13. Sub-processors
The operator engages the following sub-processors as of the effective date:
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase | Postgres database, Auth, Storage | eu-west-2 (London) |
| Cloudflare | DNS, CDN, WAF, DDoS, Tunnel | global edge |
| Backblaze | Off-site backup storage (B2 cold tier) | EU |
| Resend | Transactional email | US (with EU forwarding) |
| mNotify | SMS to Ghanaian phone numbers (when enabled) | Ghana |
| Meta WhatsApp Business Cloud API | WhatsApp messaging (when enabled) | global |
| Sentry | Application error tracking | EU |
The operator gives at least 30 days' notice via email and via the in-app notifications channel before adding or replacing a sub-processor that processes personal data.
14. Changes to these terms
The operator may update these terms from time to time. Material changes (anything affecting your data, your liability, your costs, or your termination rights) require:
- at least 30 days' written notice to the tenant owner's contact email;
- presentation of the new terms in the application on next sign-in;
- explicit re-acceptance by a user with
tenant.settings.managepermission, recorded intenant_ts_acceptance.
If you do not accept the new terms within the notice window, the operator will prepare and offer your full data export, and your tenant will be terminated under §8.
14.1 Notices given under this section
| Version | Notice given | Effective from | What changed |
|---|---|---|---|
| 1.2 | 2026-09-13 | 2026-11-15 | §2 "Cross-border transfer rationale" — corrected. See 14.2. |
| 1.2 (amended) | 2026-09-13 | 2026-11-15 | §9 export description brought into line with what ships. See 14.3. |
⚠ How the v1.2 notice was given, stated exactly rather than left to be assumed. §14 requires written notice to the tenant owner's contact email. At the date of this notice the platform has no third-party tenants: the estate is pre-revenue and every tenant in it — including the operator's own pilot farm — holds disposable test data. There was therefore no tenant owner outside the operator to write to, and no email was sent. The notice is given by publication: this section, and version 1.2 of these terms published at www.koklonya.com/tenant-terms-v1.2.html, both dated 2026-09-13. The 30-day window runs from that date regardless, and the version in force does not change until it elapses. ⚠ The window is 63 days, not 30, and the reason CHANGED on 14 September 2026. It was originally 32 — a couple of days past the minimum, so that a publication slipping by a day could not shorten what you are owed. It is now 63, because the effective date moved from 2026-10-15 to 2026-11-15: no email was sent, and if the footing above is wrong the notice was defective, so the date was pushed out to leave room for a notice that is actually served. §14 owes you at least 30 days; a remedial notice sent as late as 2026-10-16 still carries its full 30. For any future material change this is not the procedure — once a tenant of record exists, the email §14 requires is owed, and it is an operational step no code performs.
14.2 Notice of change — v1.2, given 2026-09-13
What was wrong. v1.1 told you that the Ghana Data Protection Commission had recognised the United Kingdom and the European Union as providing "adequate" protection, and that transfer of your data to London was therefore lawful without Standard Contractual Clauses or your consent. That was incorrect. The Data Protection Act, 2012 (Act 843) contains no cross-border transfer provision, no mechanism for declaring a country adequate, and no such function among the Commission's functions under s.3 — so there was no recognition to rely on, and none could have been made. Section 18(2), the provision that statement was reaching for, governs data sent into Ghana, not out of it.
What is true instead. Act 843 does not gate the transfer on the destination. It applies to your data wherever it goes (s.45(1)(c)), and it places the duty on you as data controller: under s.30(4), where a data processor is not domiciled in Ghana, the controller "shall ensure that the data processor complies with the relevant laws of this country", under a written contract meeting ss.30(2)–(3) and with the security measures required by s.28.
What this changes for you. Nothing about where your data is held, who can reach it, or what the operator does with it — §2's hosting table and §3's measures are unchanged. What changes is the basis: the lawfulness of the transfer rests on your own assessment as controller and on the operator's contractual undertakings, not on a regulatory finding that does not exist. If your farm relies on that assessment for its own compliance, this is the paragraph to re-read.
Your options under §14. You may accept the corrected terms when they are presented on sign-in from 2026-11-15. If you do not wish to continue on this basis, tell the operator before that date and your full data export will be prepared and offered, with termination under §8. You are not asked to re-accept, and nothing is withheld from you, before 2026-11-15.
14.3 Amendment to v1.2 before it took effect — §9, 2026-09-13
What was wrong. §9 described the export as it stood on 12 September 2026 and was overtaken by the software within a day, in two directions at once:
- it said there was no per-user, per-tenant, concurrency or queue limit on export generation. A concurrency limit shipped on 13 September: one tenant export at a time per server process, refused with
429andRetry-Afterrather than queued; - it said the export is not a ZIP and carries no attached files. That remains true of the JSON file, but an archive export (
.tar.gz) that does carry the stored document bytes is available in the application and was not mentioned at all.
Why this is a correction and not a fresh material change. Three reasons, stated so the reasoning can be checked rather than taken on trust:
- §9 reserved this exact right. It said a limit may be introduced "and will say so here if we do". Saying so here is the promise being kept, not a term being altered.
- v1.2 had not taken effect. The version in force remains v1.1 until 2026-11-15; this amendment lands inside the notice window and changes no term anyone is currently bound by. The effective date is unchanged and the 30-day window is not restarted or shortened.
- The archive half only widens what you receive. Being told about an export that carries more of your data takes nothing away.
⚠ The one part that is adverse is the concurrency limit, and it is named rather than buried. It restricts how many exports may run at once — not what you may export, or how often. A refused request returns 429 with Retry-After and succeeds on retry.
The published page is regenerated from this document, and a control refuses to let the two drift. The v1.2 notice was given by publication at www.koklonya.com/tenant-terms-v1.2.html. That page is built from this file by npm run legal:build, and npm run check:legal-pages fails while it is stale — it reported STALE … tenant-terms-v1.2.html the moment this amendment was written, which is how the drift was caught rather than remembered. The regenerated page ships in the same commit as this text.
⚠ Publishing that page to the web remains an operational step, in the same class as the email §14 will owe once a tenant of record exists: building the file is automated, deploying it is a deliberate act.
15. Governing law & dispute resolution
These terms are governed by the laws of Ghana. Any dispute arising under these terms will first be addressed by good-faith negotiation between you and the operator. If unresolved within 60 days, the dispute will be referred to mediation in Accra under the Ghana ADR Act 2010. Litigation is a last resort and lies with the courts of the Greater Accra Region.
16. Contact
| Reason | Channel |
|---|---|
| Operational support | [email protected] |
| Security incidents | [email protected] |
| Data privacy / DPA | [email protected] |
| Legal & contractual | [email protected] |
| Postal | (operator's registered address — to be filled in before public launch) |
Acceptance
By signing into Koklonya, you confirm that:
- you are at least 18 years old;
- you have authority to bind your farm or organization to these terms;
- you have read this document end-to-end (or have had it explained to you in a language you understand);
- you accept these terms as written.
Acceptance is recorded with your user id, the version of the terms, the timestamp, the IP address you signed in from, and the user agent. The recorded acceptance is exportable on request.
End of Tenant Terms of Service v1.2.