Privacy Policy & Terms

HortiLogistica Africa 2026 is jointly organised by Tanzanian Horticulture Association (TAHA) and Kostiv Investment Ltd (together, "Organisers"). The event takes place on 08-10 November 2026 at Ngurdoto Mountain Lodge, Arusha, Tanzania.

For purposes of data protection law, Organisers act as joint data controllers. "We", "us" and "our" refer to Organisers.

Data Protection Contact (acting as Data Protection Point of Contact): Email: privacy@hortilogisticaafrica.com General enquiries: info@hortilogisticaafrica.com Phone: +255 754 881 336 Address: P.O. Box 16520, Arusha, Tanzania

This Privacy Policy applies to all personal data collected through:

• The website hortilogisticaafrica.com and any associated subdomains. • Registration forms for visitors, exhibitors, speakers, and media. • Contact, advertising, and sponsorship enquiry forms. • Newsletter subscriptions. • On-site data collection at the event (badge scanning, photography, etc.).

This policy is designed to comply with applicable international data protection laws, including:

• The EU General Data Protection Regulation (GDPR) Regulation (EU) 2016/679. • The UK Data Protection Act 2018 and UK GDPR. • The Tanzania Electronic and Postal Communications Act (EPOCA) and the Cybercrimes Act 2015. • The South African Protection of Personal Information Act (POPIA). • The Brazilian Lei Geral de Proteção de Dados (LGPD). • The Kenya Data Protection Act 2019. • The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

Where local law provides greater protection than this policy, the higher standard prevails.

A. Information You Provide Directly

• Registration (visitor/exhibitor): full name, company name, job title, email address, phone number, country of residence, business activities, and stand preferences. • Advertising & sponsorship enquiries: company name, contact name, email, phone, and interest type. • Media accreditation: first name, last name, media outlet, email address, type of media, and coverage description. • General contact form: name, email, phone, and message content. • Newsletter: email address and name. • Speaker/panellist submissions: biography, headshot, presentation materials.

B. Information Collected Automatically

• Technical data: IP address (anonymised after 90 days), browser type and version, operating system, device type, screen resolution. • Usage data: pages viewed, time spent on pages, referring URL, session duration. • Cookie data: consent preferences, session identifiers, language preference (see Section 12 Cookies & Tracking).

C. Information From Third Parties

We may receive your data from event partners or co-exhibitors if you have consented to data sharing with them.

D. Sensitive Data

We do not intentionally collect special category data (e.g. health, religion, political opinions). If you voluntarily provide dietary or accessibility requirements during registration, this information is processed solely for event logistics and deleted within 30 days after the event.

E. Automatic Newsletter Subscription

When you submit any form on our website — including exhibitor registration, visitor registration, sponsor inquiries, contact messages, or advertising inquiries — your name and email address are automatically added to our mailing list. This enables us to send you relevant updates and information about HortiLogistica Africa 2026. You can unsubscribe at any time by clicking the link in any email we send or by emailing privacy@hortilogisticaafrica.com.

We process personal data for the following purposes:

• Event operations processing registrations, issuing badges, managing exhibitor stand assignments, coordinating on-site logistics, and facilitating networking. • Communications sending confirmation emails, event updates, programme information, speaker schedules, and post-event surveys. • Advertising & sponsorship responding to enquiries, preparing proposals, and managing partner relationships. • Media accreditation reviewing and approving press pass applications and coordinating media access. • Website improvement analysing anonymised usage patterns to improve site performance, content relevance, and user experience. • Security & fraud prevention rate limiting, IP-based abuse prevention, detecting fraudulent registrations, and protecting the integrity of the website and event. • Legal compliance meeting obligations under Tanzanian law and applicable international data protection standards.

We will never sell, rent, or trade your personal information to any third party for their own marketing purposes. We do not use your data for automated advertising profiling.

We process personal data only where we have a lawful basis:

• Contractual necessity (Art. 6(1)(b)) processing registration data, issuing badges, coordinating stand assignments, and managing exhibitor bookings is necessary to perform the contract you enter into with us. • Consent (Art. 6(1)(a)) where you provide explicit opt-in consent, such as subscribing to our newsletter, accepting non-essential cookies, or opting into event photography. You may withdraw consent at any time by emailing privacy@hortilogisticaafrica.com; withdrawal does not affect the lawfulness of prior processing. • Legitimate interests (Art. 6(1)(f)) we process certain data based on our legitimate interests as event organisers, including website security, fraud prevention, post-event follow-up with registered participants, and business development. We conduct a balancing test to ensure these interests do not override your fundamental rights. You may object to processing based on legitimate interests at any time. • Legal obligation (Art. 6(1)(c)) in some cases, we must process or retain data to comply with applicable law, including Tanzanian statutory requirements, tax obligations, and international data protection mandates.

We share your data only in these limited circumstances:

• Service providers trusted third parties who assist in operating our website, email systems, payment processing, and event management platforms. All providers are vetted and contractually bound by Data Processing Agreements (DPAs) to handle data securely and only for purposes we specify. • Event co-organisers TAHA and Kostiv Investment Ltd staff involved in event management may access registration and accreditation data as needed. Both parties operate under a Joint Controller Agreement. • Sponsors and exhibitors only if you explicitly consent (e.g. by scanning your badge at a sponsor booth or opting in during registration). We never share attendee lists without consent. • Legal requirements we may disclose information if required by law, court order, regulatory authority, or to protect the rights, property, or safety of the Organisers or third parties. • Business transfers in the unlikely event of a merger, acquisition, or asset sale, personal data may transfer as part of that transaction, subject to equivalent privacy protections. You will be notified of any such change.

We do not share data with advertising networks. Any analytics data shared with third parties is aggregated and anonymised.

We retain personal data only as long as necessary for the purposes described in this policy:

• Registration data up to 24 months after the event, for post-event follow-up, invoicing, and planning future editions. • Contact and enquiry data up to 12 months after your last interaction. • Media accreditation data up to 12 months after the event. • Cookie consent records up to 36 months (to demonstrate compliance with GDPR Article 7). • Technical/server logs up to 90 days (IP addresses anonymised). • Newsletter subscription data until you unsubscribe. • Financial/invoice records up to 7 years as required by Tanzanian tax law.

After the applicable retention period, data is securely deleted or irreversibly anonymised. You may request earlier deletion at any time (see Section 8).

Depending on your location and applicable law, you may have the following rights:

Under GDPR / UK GDPR (EEA & UK residents): • Right of access (Art. 15) obtain a copy of personal data we hold about you. • Right to rectification (Art. 16) correct inaccurate or incomplete data. • Right to erasure (Art. 17) request deletion of your data ("right to be forgotten"), subject to legal retention obligations. • Right to restriction (Art. 18) restrict processing in certain circumstances. • Right to data portability (Art. 20) receive your data in a structured, commonly used, machine-readable format. • Right to object (Art. 21) object to processing based on legitimate interests or direct marketing. • Right to withdraw consent (Art. 7(3)) withdraw at any time without affecting prior lawful processing. • Right to lodge a complaint with your national Data Protection Authority (e.g. ICO in the UK, CNIL in France, BfDI in Germany).

Under CCPA / CPRA (California residents): • Right to know what personal information is collected, used, and shared. • Right to delete personal information. • Right to opt out of the sale or sharing of personal information. We do not sell your personal information. • Right to non-discrimination for exercising your privacy rights.

Under POPIA (South African residents): • Right to access, correction, and deletion of personal information. • Right to object to processing for direct marketing. • Right to lodge a complaint with the Information Regulator.

Under LGPD (Brazilian residents): • Right to confirmation, access, correction, anonymisation, blocking, deletion, portability, and information about shared data.

To exercise any of these rights, email privacy@hortilogisticaafrica.com. We will verify your identity and respond within 30 days (or sooner where required by law). If we need more time, we will inform you of the reason and extension (up to an additional 60 days under GDPR).

HortiLogistica Africa 2026 is an international event. Your personal data may be stored or processed in countries outside your country of residence, including Tanzania and the countries where our service providers operate.

Where data is transferred internationally, we ensure an adequate level of protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission (implementing decision 2021/914), used for transfers from the EEA to third countries. • UK International Data Transfer Agreement (IDTA) for transfers from the UK. • Data Processing Agreements (DPAs) with all third-party providers, requiring technical and organisational safeguards. • Data minimisation only transferring data strictly necessary for the purpose. • Transfer Impact Assessments evaluating the legal framework of recipient countries.

Tanzania does not currently hold an EU adequacy decision. For EEA, UK, and Swiss participants, transfers are safeguarded through the mechanisms above.

For South African participants under POPIA: we ensure cross-border transfers comply with Section 72, using binding agreements that impose equivalent protections.

For more information about our transfer safeguards, contact privacy@hortilogisticaafrica.com.

Photographs, video footage, and audio recordings may be taken during HortiLogistica Africa 2026 for:

• Promotional and marketing purposes, including on our website, social media channels, brochures, and press releases. • Post-event reporting and documentation. • Future event promotion.

Legal basis: We process event photography under legitimate interest (Art. 6(1)(f) GDPR) for events held in public/semi-public venues where attendees have a reasonable expectation of being photographed. This is balanced against individual rights through opt-out mechanisms.

Opt-out: If you do not wish to be identifiable in promotional materials, notify our team at the registration desk. You will receive a colour-coded lanyard indicating your preference, and our photographers will make reasonable efforts to exclude you.

Speakers & panellists: Your sessions may be recorded and published. You will be informed and asked for explicit consent prior to your session.

Accredited press and media must comply with the press access guidelines issued at registration. Unauthorised commercial photography or recording is prohibited.

In accordance with GDPR Article 22, we do not use automated decision-making processes or profiling that produce legal or similarly significant effects on you.

Your registration and accreditation are reviewed by our team manually. We do not use your personal data to build advertising profiles or to make automated decisions about your eligibility, access, or participation.

If we introduce any form of automated processing in the future, we will update this policy, notify affected individuals, and provide a right to human review.

Our website uses cookies small text files stored on your device to provide and improve our services. For full details on how we use cookies, including a complete list of cookie categories, third-party cookies, and your rights, please see our dedicated Cookie Policy at hortilogisticaafrica.com/cookie-policy.

A. Cookie Categories

• Strictly Necessary required for the website to function (session management, language preference, security tokens, cookie consent record). These cannot be disabled. Legal basis: legitimate interest. • Analytics help us understand how visitors use the website (pages viewed, time on site, bounce rate). Data is aggregated and anonymised. Deployed only with your explicit consent. • Marketing used to measure the effectiveness of event promotion campaigns. Deployed only with your explicit consent. • Preferences remember your settings such as language and region. Deployed only with your explicit consent.

B. Consent Management

When you first visit our website, a cookie consent banner will ask for your permission before deploying non-essential cookies. You can change your preferences at any time by clicking the cookie icon in the bottom-left corner of any page.

C. Third-Party Cookies

We may use cookies from trusted third-party services (e.g. Google Analytics, if enabled). These services have their own privacy policies governing their use of data.

D. How to Control Cookies

You can disable or delete cookies through your browser settings. Note that disabling strictly necessary cookies may impair website functionality. For more information, visit www.allaboutcookies.org.

E. Do Not Track

We honour "Do Not Track" (DNT) browser signals. When DNT is enabled, no analytics or marketing cookies will be deployed.

For the complete Cookie Policy, please visit hortilogisticaafrica.com/cookie-policy.

We implement appropriate technical and organisational measures to protect your personal data, in line with GDPR Article 32:

• Encryption all data in transit is protected via HTTPS/TLS 1.2+. Sensitive data at rest is encrypted using AES-256. • Access controls role based access ensuring only authorised personnel can access personal data, with multi-factor authentication for administrative accounts. • Rate limiting and abuse prevention IP-based rate limiting on all form submissions and API endpoints. • Input validation server-side input sanitisation and parameterised database queries to prevent injection attacks. • Regular security reviews periodic vulnerability assessments and security audits of our backend systems. • Incident response we maintain a data breach response plan. In the event of a breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (GDPR Art. 33) and affected individuals without undue delay (Art. 34).

While we take all reasonable precautions, no internet transmission is completely secure. If you believe your data has been compromised, contact us immediately at privacy@hortilogisticaafrica.com.

HortiLogistica Africa 2026 is a professional trade event. Our website and services are not directed at children under the age of 16 (or the applicable age of digital consent in your jurisdiction).

We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at privacy@hortilogisticaafrica.com.

Our website may contain links to external websites, including media partners, sponsors, exhibitors, and industry associations. These links are provided for convenience only.

We are not responsible for the privacy practices, content, or security of third-party sites. We encourage you to review their privacy policies before providing any personal information. The inclusion of a link does not imply endorsement by the Organisers.

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or regulatory guidance. When material changes are made:

• We will update the "Last Updated" date at the top of this page. • For significant changes affecting your rights, we will provide prominent notice on our website and, where possible, notify registered users by email. • Continued use of our website after changes constitutes acceptance of the revised policy.

We encourage you to review this policy periodically. Previous versions are available upon request.

If you have questions, concerns, or requests relating to this Privacy Policy or how we handle your data:

Data Protection Contact: Email: privacy@hortilogisticaafrica.com

General Enquiries: Email: info@hortilogisticaafrica.com Phone: +255 754 881 336

Postal Address: HortiLogistica Africa 2026 c/o Kostiv Investment Ltd P.O. Box 16520, Arusha, Tanzania

Event Venue: Ngurdoto Mountain Lodge, Arusha, Tanzania Event Dates: 08-10 November 2026

For EU/EEA residents: If you are not satisfied with our response, you have the right to lodge a complaint with your national Data Protection Authority. For UK residents: Contact the Information Commissioner's Office (ICO). For South African residents: Contact the Information Regulator.