Privacy Policy

1. Controller

2. Scope of this Privacy Policy

This policy applies to personal data processed through FarmVizion websites, applications, customer accounts, digital services, SaaS/PaaS products, support channels, orders, IoT integrations and related services. Operational, agronomic, machine or field data that cannot be linked to an identified or identifiable natural person is not personal data under the GDPR. Where such information can be linked to a person, it is treated as personal data.

3. Categories of Personal Data

Depending on how you use our services, we may process:

• Identity and contact data, including name, company, postal address, email address and telephone number.
• Account data, including login identifiers, account settings, roles and authentication information.
• Contract and transaction data, including orders, subscriptions, invoices, payment status and delivery information.
• Communication data, including enquiries, support requests, feedback and correspondence.
• Technical data, including IP address, browser, operating system, timestamps, device information and security logs.
• Usage data relating to how users interact with our website, applications and platform.
• Farm, equipment and IoT data where such information can be linked to an identifiable person.
• Images, video or sensor information where connected systems or customer deployments capture identifiable individuals.
• Consent and preference information, including cookie and marketing preferences.

4. Purposes, Legal Bases and Retention

5. FarmVizion as Processor for Customer Data

For certain business and IoT services, the FarmVizion customer may determine why and how personal data is processed. In those cases, the customer is the controller and FarmVizion acts as a processor under Article 28 GDPR. Such processing is subject to the applicable Data Processing Agreement (DPA), customer instructions and contractual security requirements.

6. Cookies and Similar Technologies

FarmVizion may use cookies, local storage, SDKs or comparable technologies. They are treated according to their purpose:

• Strictly necessary technologies may be used without consent where they are required to provide a digital service expressly requested by the user or to transmit communications.
• Optional analytics, advertising, tracking and comparable technologies are activated only after the required consent has been obtained.
• Where optional technologies process personal data, processing is based on Article 6(1)(a) GDPR unless another lawful basis clearly applies.
• The consent interface should identify the relevant providers, purposes, storage technologies and durations.

Consent may be refused or withdrawn at any time through the cookie or privacy settings made available on the website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. Recipients of Personal Data

• Hosting, cloud infrastructure and IT service providers.
• Payment and billing service providers where payments are processed.
• Logistics, delivery and fulfilment partners where physical products are supplied.
• Communication, email and customer-support service providers.
• Analytics or similar service providers only where their use is lawful and, where required, consent has been obtained.
• Professional advisers such as lawyers, auditors or tax advisers where necessary.
• Public authorities, regulators or courts where disclosure is legally required.
• Business customers for whom FarmVizion processes information in accordance with the applicable contractual roles.

8. International Data Transfers

Where personal data is transferred outside the European Economic Area, FarmVizion uses a legally permitted transfer mechanism. This may include an adequacy decision of the European Commission, the EU-U.S. Data Privacy Framework for appropriately certified recipients, or Standard Contractual Clauses together with supplementary safeguards where required. Information about applicable safeguards may be requested from FarmVizion.

9. Data Retention

• Personal data is not retained indefinitely and is deleted or anonymised when the relevant processing purpose and legal retention obligations cease to apply.
• Contract and account information may be retained after termination where necessary for legal claims or statutory documentation.
• Invoices and relevant accounting records are retained in accordance with German tax and commercial-law requirements.
• Data subject requests and consent records may be retained where necessary to demonstrate compliance with GDPR obligations.
• Backups may retain deleted data for a limited additional period until the relevant backup cycle expires.

10. Your GDPR Rights

Subject to the applicable legal requirements, you may have the following rights:

• Right of access under Article 15 GDPR.
• Right to rectification under Article 16 GDPR.
• Right to erasure under Article 17 GDPR.
• Right to restriction of processing under Article 18 GDPR.
• Right to data portability under Article 20 GDPR.
• Right to object to processing based on Article 6(1)(e) or (f) GDPR under Article 21 GDPR.
• Right to withdraw consent at any time, without affecting processing carried out before withdrawal.
• Right to lodge a complaint with a competent data protection supervisory authority.

11. AI and Automated Decision-Making

FarmVizion uses AI and automated systems to generate agricultural insights, recommendations and operational analytics. Unless expressly disclosed for a particular service, FarmVizion does not use solely automated processing to make decisions about individuals that produce legal effects or similarly significantly affect them within the meaning of Article 22 GDPR. If such processing is introduced, the required additional information and safeguards will be provided.

12. Children's Data

FarmVizion services are intended for businesses, professionals and adult users and are not directed to children. We do not knowingly seek to collect personal data from children through our commercial services.

13. Data Security

FarmVizion implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Security measures are reviewed and adapted according to the nature, scope, context and risk of the processing.

14. Right to Lodge a Complaint

You may lodge a complaint with a competent supervisory authority. For private-sector controllers established in Bavaria, the competent supervisory authority is generally the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).