Data processing agreement

1. Parties and conclusion of the agreement

1. This data processing agreement (the “Agreement”) is an annex to the Agro Notes app terms of service (the “Terms”) and is concluded together with the contract for the Service, without a separate signature. The Agreement is concluded in electronic form, which meets the requirement of written form, including electronic form, under Article 28(9) GDPR.
2. The Controller is the natural person, legal person or other entity on whose behalf a Farm is run and who decides on the purposes and means of processing the personal data entered into the App within that Farm (the “Controller”).
3. A User who concludes the contract for the Service or enters third parties’ personal data into the App declares that they are authorized to conclude this Agreement on behalf of the Controller.
4. The Processor is Krzysztof Kołecki, ul. Oskara Kolberga 18C/31, 81-881 Sopot, Poland, Polish tax ID (NIP) 5862270852 (the “Processor”). Contact: contact@agronotes.app.
5. The Agreement does not cover data for which the Processor acts as an independent controller, namely the User’s account data and technical data. Their processing is described in the App privacy policy.
6. Capitalized terms not defined in the Agreement have the meaning given to them in the Terms or in the GDPR.

2. Subject matter, nature and purpose of processing

1. The Controller entrusts the Processor with processing personal data to the extent and for the purpose necessary to provide the Service, namely to make the App available, store the data entered in it and sync that data between devices and Farm members.
2. The processing consists of automated operations: collection, recording, storage, organization, consultation, disclosure to Farm members, sending notifications and erasure.
3. The detailed scope of processing (categories of data subjects and categories of data) is set out in Annex A.
4. The Processor does not use the entrusted data for its own purposes; in particular, it does not build marketing profiles from it, sell it or use it to train models.

3. Duration

The Agreement remains in force for the term of the contract for the Service and expires with it. The provisions on confidentiality and on erasure or return of data continue to apply after the Agreement expires.

4. The Controller’s instructions

1. The Processor processes data only on documented instructions from the Controller. Documented instructions include in particular: the Agreement and the Terms, the Controller’s use of the App’s functions and instructions sent to the Processor’s contact address.
2. Processing may also take place where required by Union or Member State law. In that case the Processor informs the Controller of that requirement before processing, unless that law prohibits such information on important grounds of public interest.
3. The Processor immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

5. Rights and obligations of the Controller

The Controller in particular: is responsible for having a legal basis for processing the entrusted data and for informing the data subjects; gives documented instructions; may request the information needed to demonstrate compliance with Article 28 GDPR and carry out audits; and may request the return or erasure of the entrusted data. The detailed rules are set out in the following provisions of the Agreement.

6. Obligations of the Processor

1. The Processor ensures that persons authorized to process the entrusted data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
2. The Processor limits access to the entrusted data to persons who need it to provide or maintain the Service or to handle the Controller’s requests.
3. The Processor keeps a record of the categories of processing activities carried out on behalf of the Controller, in accordance with Article 30(2) GDPR.

7. Security of processing

The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. They are described in Annex B. The Processor may change individual measures as long as this does not lower the level of security.

8. Sub-processors

1. The Controller gives the Processor general authorization to engage sub-processors. The current list is in Annex C.
2. The Processor imposes on each sub-processor data protection obligations equivalent to those in the Agreement and remains fully liable to the Controller for their performance.
3. The Processor informs the Controller of any intended addition or replacement of a sub-processor, by updating Annex C and notifying the Controller in the App or by email, at least 14 days before the change.
4. The Controller may raise a reasoned objection to the change within the period stated in point 3. If the objection cannot be accommodated without significantly limiting the Service, the Controller may terminate the contract for the Service with immediate effect, after first exporting the data.

9. Transfers outside the European Economic Area

Entrusted data is transferred to a third country only on the basis of one of the mechanisms provided for in Chapter V of the GDPR: an adequacy decision or standard contractual clauses together with a transfer impact assessment. The mechanisms used for each provider are listed in Annex C.

10. Assistance to the Controller

1. Taking into account the nature of the processing, the Processor assists the Controller in responding to requests from data subjects exercising their rights under Chapter III of the GDPR. This includes, in particular, providing App functions that allow data to be accessed, corrected, exported and deleted directly.
2. If a data subject sends a request directly to the Processor, the Processor does not handle it itself but forwards it to the Controller without delay.
3. The Processor assists the Controller in complying with its obligations under Articles 32 to 36 GDPR, taking into account the nature of processing and the information available to it.

11. Personal data breaches

1. After becoming aware of a breach involving entrusted personal data, the Processor notifies the Controller without undue delay and no later than 48 hours after becoming aware of it.
2. The notification includes at least: a description of the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed and contact details for further information. Information not available at the time of notification is provided in phases.
3. The Processor does not notify the supervisory authority or the data subjects on behalf of the Controller; that obligation rests with the Controller.

12. Information and audits

1. The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR, primarily by providing documentation, in particular the description of security measures and the list of sub-processors.
2. The Controller may carry out an audit, including an inspection, itself or through an authorized auditor. An audit requires at least 14 days’ notice, takes place during business hours, no more than once per calendar year, and may not disrupt the continuity of the Service or breach the confidentiality of other customers’ data. An additional audit is allowed if justified by a confirmed data breach, a reasonable suspicion of a breach of the Agreement, a material change in the processing or a request from a supervisory authority.
3. The auditor is bound by confidentiality. The Controller bears the cost of the audit unless it reveals a material breach of the Agreement by the Processor.

13. Erasure or return of data

1. After the end of the Service, the Processor, at the Controller’s choice, returns or deletes the entrusted data. Return takes place through the export functions of the App. The Processor then deletes the remaining copies unless Union or Member State law requires them to be kept.
2. Deletion from the live database takes place without delay. An encrypted backup of the database and note photos is kept for 30 days and then deleted. Deleting an account does not immediately erase data that has already been copied into this backup.
3. Content entered by the Controller or Collaborators in a farm the Controller does not run is not deleted together with the Controller’s account; its controller remains the person on whose behalf that farm is run. Only the link between that content and the deleted account is removed.
4. The Processor may retain data only to the extent and for the period required by Union or Member State law and informs the Controller of this on request.
5. If the Service is discontinued permanently, the Processor gives the Controller at least 90 days to export the data.

14. Liability

1. Each party is liable for damage caused by processing in accordance with Article 82 GDPR.
2. The Controller is responsible for having a legal basis for processing the entrusted data, for the lawfulness of its instructions and for informing the persons whose data it enters into the App.
3. The Agreement does not limit either party’s liability towards data subjects or the supervisory authority.

15. Changes to the Agreement and final provisions

1. The Agreement is changed in the same way as the Terms. Annex C (the list of sub-processors) is changed under section 8.
2. Matters not covered are governed by the GDPR and Polish law. In case of conflict between the Agreement and the Terms in matters of personal data protection, the Agreement prevails.

Annex A: Details of processing

Categories of data subjects

• Collaborators invited by the Controller to the Farm.
• Invited persons who have not yet created an account in the App.
• Persons mentioned by the Controller or Collaborators in notes.
• Persons assigned to treatments or tasks and persons marked as carrying out a treatment.

Categories of personal data

• Email addresses of persons invited to the Farm.
• User names and account IDs of Farm members and their roles.
• Names or other identifiers of persons appearing in note content entered by the Controller or Collaborators.
• Information about assignment to a treatment or task and about its completion.
• Personal data that may appear in attached photos or in free-text descriptions entered by the Controller.

The processing does not cover special categories of data (Article 9 GDPR) or data relating to criminal convictions (Article 10 GDPR); the Terms prohibit entering them into the App.

Processing operations

• Storing data in the database and file storage.
• Making data available to Farm members according to their roles.
• Syncing between devices and keeping a local copy on the device.
• Sending invitation emails and push notifications.
• Diagnosing App crashes, to the extent entrusted data appears in an error message, stack trace or masked session recording.
• Deleting data at the Controller’s request.

Annex B: Technical and organizational measures

• Encryption in transit: all communication between the App and the server uses an encrypted channel.
• Encryption at rest: the database and file storage are encrypted by the infrastructure provider.
• Data-level access control: database security rules limit row visibility to the Farms the user is a member of.
• Private photo storage: files have no public addresses; access requires permission for the related note.
• Authentication: passwords stored only as hashes, email confirmation at registration, two-factor authentication for administrative accounts.
• Least privilege: only the Processor has access to the production environment, to the extent needed to maintain the Service.
• Backup: An encrypted backup of the database and note photos is kept for 30 days and then deleted. Deleting an account does not immediately erase data that has already been copied into this backup. The archive is encrypted with a password that Google does not receive and is stored on Google Drive. The Controller should still regularly export spray records outside the App, using the PDF and CSV export.
• Separate environments: the test environment is separated from production and does not use production data.
• Breach procedure: a documented process for detecting, assessing and reporting breaches, with a breach register.

Annex C: Sub-processors

• Supabase (Supabase, Inc. (USA), infrastructure in the EU): Database, authentication, photo storage, server functions and sync. Scope: Personal data entrusted within a Farm, to the extent Supabase processes it as a sub-processor. Place of processing: European Union (Frankfurt, Germany). Transfer mechanism: Standard contractual clauses for any technical support access from outside the EEA.
• Resend (Resend, Inc. (USA)): Sending email invitations to collaborate on a farm. Scope: Recipient email address, name of the person sending the invitation, farm name. Place of processing: United States. Transfer mechanism: Standard contractual clauses.
• Expo Push (650 Industries, Inc. (USA)): Delivering push notifications to the device. Scope: Device notification token and notification content (e.g. a farm or field name). Place of processing: United States. Transfer mechanism: Standard contractual clauses.
• Google Firebase Cloud Messaging (Google Ireland Limited): Technical delivery of push notifications to Android devices. Scope: Device notification token and notification content. Place of processing: European Union and United States. Transfer mechanism: Adequacy decision: EU–US Data Privacy Framework.
• Apple Push Notification service (Apple Distribution International Ltd. (Ireland)): Technical delivery of push notifications to iOS devices. Scope: Device notification token and notification content. Place of processing: European Union and United States. Transfer mechanism: Standard contractual clauses.
• Sentry (Functional Software, Inc. (USA), operating as Sentry): App crash diagnostics: error reports and masked session recordings, so we can fix the errors. Scope: Personal data entrusted within a Farm only when it happens to appear in an error message, stack trace or session recording despite the masking of text, images and graphics. Place of processing: European Union (Frankfurt, Germany). Transfer mechanism: Adequacy decision: EU–US Data Privacy Framework; otherwise standard contractual clauses.
• Google Drive (Google Ireland Limited): Storing the encrypted backup of the database and note photos. Scope: Encrypted archive of personal data entrusted within a Farm and of note photos. Place of processing: European Union or United States, depending on the Drive account settings. Transfer mechanism: Adequacy decision: EU–US Data Privacy Framework.

Services queried directly by the user’s device (map and weather providers) are not sub-processors, because they do not receive entrusted personal data and do not act on the Processor’s instructions. They are listed in the App privacy policy.