Data processing agreement (DPA)

Version 1.0 · 1 November 2026

When a company, an advisory firm, an accountant or a cooperative uses Agro GPS to keep the notebooks of its clients or members, it is the controller of that data and Agro GPS is its processor (Art. 28 of Regulation (EU) 2016/679, GDPR). This agreement sets out how we process it. It is part of the terms of the company, advisor and cooperative plans and is accepted when you subscribe to them. If you need a signed copy, ask at support@agrogps.eu.

For a farmer who uses Agro GPS for their own farm, Agro GPS is the controller and the privacy policy applies.

1. Parties

• Processor: Daniel Román Martínez (Agro GPS), Spanish tax number 47815941E, C/ Federico García Lorca, 22, 4-1, 08042 Barcelona, Spain. Contact: support@agrogps.eu.
• Controller: the customer holding the company, advisor or cooperative plan.

2. Subject matter, duration and purpose

Providing the digital farm notebook and farm management service: storing, syncing, checking, exporting and, when the controller instructs it, sending to official registers the data entered. It lasts as long as the plan and, afterwards, the time needed to return and delete the data (section 9).

3. Data and data subjects

• Data: identification and contact (name, email, tax number), farm data (fields, crops, jobs, products, doses), applicator data (certificate), financial data (costs, income, invoices, payments, bank accounts), uploaded documents and files, and technical usage data.
• Data subjects: farm holders and members, applicators, workers, customers and suppliers recorded by the controller.
• No special categories of data (Art. 9 GDPR) are processed.

4. Processor obligations

• Process the data only on the controller's documented instructions, which are this agreement and its use of the service. If an instruction infringes the law, we will tell the controller.
• Confidentiality for every person authorised to process the data.
• Apply the security measures in section 5.
• Help the controller respond to data subjects' rights (access, rectification, erasure, objection, restriction and portability). The full export is free and in Settings, including downloading all the data in a single file.
• Assist with data protection impact assessments and prior consultations where relevant.
• Make available the information needed to demonstrate compliance and allow reasonable audits with prior notice.

5. Security measures

• Notebook data hosted in the EU; encryption in transit (TLS) for every connection.
• Credentials for third-party services (banks, e-invoicing, machinery, sensors) are stored encrypted and never leave in an export.
• Database access closed to the public: only the API reaches it, with a user session or an API key scoped to read or write.
• Permissions per farm and role; access log for advisors and accountants; change history for every job; deletions are dated.
• Error monitoring and a service status check every five minutes.

6. Sub-processors

The controller gives general authorisation to the published sub-processors. We bind them by contract to the same data protection obligations. We will email any change at least 30 days in advance; if the controller objects on reasonable grounds and there is no alternative, it may end the plan without penalty.

7. International transfers

Notebook data is hosted in the EU. Where a sub-processor processes data outside the European Economic Area, it relies on an adequacy decision or on the European Commission's standard contractual clauses, as shown in the sub-processor list.

8. Personal data breaches

We will notify the controller without undue delay, and at the latest within 48 hours of becoming aware, of any breach affecting its data, with the information available so it can notify the authority within the Art. 33 GDPR deadline.

9. End of the agreement

The controller can export all its data for free at any time, also after cancelling. When the plan ends, and unless the law requires us to keep it, we delete the data when the controller asks or at the latest 30 days after the account is deleted. Farming rules require the farm to keep its notebook for several years: export before deleting.

10. Governing law

Governed by the GDPR and Spanish law. Any dispute goes to the courts of Barcelona, unless the applicable law provides otherwise.