Privacy Policy

The Africgreen Maritime Carbon Intelligence Platform is operated by the Ministry of Finance and Economic Development of the Republic of Somaliland (hereinafter "the Ministry") on behalf of the Somaliland Maritime Carbon Authority (SMCA). This platform collects and processes personal and organizational data as part of its statutory mandate to administer maritime carbon taxes, enforce environmental compliance, and generate sovereign revenue from the Gulf of Aden Exclusive Economic Zone (EEZ).

All processing activities are subject to oversight by the Somaliland Data Protection Commissioner (SDPC) and are recorded in the official national data processing register. This policy applies to all users of Africgreen, including Port Authority officers, Finance Administrators, Shipping Agents, and Armateurs.

We collect data across three categories of data subjects:

Processing of personal data on Africgreen is grounded in the following legal bases under the Somaliland Data Protection Act 2023 and aligned international frameworks:

• Legal Obligation (Art. 6(1)(c) equivalent): Maritime Carbon Act 2024, IMO MARPOL Annex VI, Somaliland Finance Act 2024 — processing is mandatory for tax enforcement and cannot be refused by data subjects operating within the EEZ.
• Public Task (Art. 6(1)(e) equivalent): Sovereign mandate of the SMCA to monitor, regulate, and report on carbon emissions within Somaliland maritime jurisdiction.
• Legitimate Interests (Art. 6(1)(f) equivalent): Platform security, fraud prevention, and immutable audit logging — balanced against the rights of data subjects and documented in our Legitimate Interest Assessment (LIA/2024-03).
• Contractual Necessity (Art. 6(1)(b) equivalent): For Shipping Agents and Armateurs who register on the platform, processing is necessary to fulfil the digital services agreement and tax payment obligations.

Upon expiry of the applicable retention period, data is securely deleted using cryptographic erasure (overwrite + key destruction) or anonymized for statistical archival. Deletion records are themselves maintained for 2 years.

We do not sell, rent, or commercially transfer personal data. Data may be shared only in the following circumstances:

• International Maritime Organization (IMO): Aggregated, anonymized emission statistics transmitted annually under MARPOL Annex VI reporting obligations.
• African Union / ITPGRFA: Environmental data shared as part of Somaliland's continental climate commitments — never at individual vessel level without explicit legal basis.
• Neighboring Coast Guard Authorities (Djibouti, Eritrea): Position data of vessels under investigation for non-compliance, pursuant to bilateral maritime agreements.
• Ministry of Justice: Audit logs and financial records in the context of criminal investigations, subject to judicial warrant.
• Technical Subprocessors: Cloud infrastructure and database services operating within Somaliland territory (BER-DC1) or subject to adequate data protection frameworks. All subprocessors are bound by Data Processing Agreements (DPAs).

Subject to applicable Somaliland law and operational constraints, data subjects have the following rights. Certain rights may be limited where they would interfere with mandatory legal processing obligations (e.g., tax enforcement, audit immutability):

To exercise your rights, submit a written request to dpo@smca.gov.sl with proof of identity. We will respond within 30 calendar days. Complex or multiple requests may be extended by an additional 60 days with notification.

Within Africgreen, AIS data is used exclusively for: (i) identifying vessels within the EEZ for carbon tax assessment, (ii) calculating estimated CO₂ emissions based on vessel speed, position, and engine specifications, (iii) generating pro-forma invoices and compliance notices, and (iv) populating the Command Center map display for authorized officers.

AIS position data is never used for commercial tracking, sold to third parties, or shared beyond the purposes listed above. Raw AIS feeds are retained for 2 years and then purged from primary systems.

Africgreen implements a multi-layered security architecture in accordance with ISO/IEC 27001:2022, the IMO Maritime Cyber Risk Management guidelines, and the NIST Cybersecurity Framework (CSF 2.0):

• Encryption at rest: AES-256 for all stored data, with hardware security modules (HSMs) for key management at BER-DC1.
• Encryption in transit: TLS 1.3 for all API and web traffic. Older TLS versions (≤1.2) are rejected at the load balancer.
• Access control: Role-Based Access Control (RBAC) with least-privilege principles. All privileged actions require MFA. Superadmin actions require dual authorization.
• Immutable audit logging: All operator actions are SHA-256 hash-chained and stored in a tamper-evident append-only log.
• Penetration testing: Annual independent penetration tests by certified third parties. Results disclosed in the Security Audit report.
• Incident response: Data breach notification to the SDPC within 72 hours, affected data subjects within 5 business days, in accordance with Art. 33–34 GDPR equivalent.

Africgreen uses strictly necessary cookies and session tokens only. No advertising, analytics, or tracking cookies are used.

Sessions expire automatically after 15 minutes of inactivity as a security measure. This cannot be disabled by users. Session tokens are invalidated server-side on logout and cannot be reused.

If you believe your privacy rights have been violated, you have the right to lodge a complaint with the Somaliland Data Protection Commissioner (SDPC) at any time, without prejudice to any other administrative or judicial remedy. The SDPC contact is available at sdpc.gov.sl.