This agreement is made under Art. 28(3) of Regulation (EU) 2016/679 and governs the processing of personal data that Fuzzy Works S.R.L. carries out on the customer's behalf when the customer uses Digital Field Book. It is mandatory for both parties: its absence would be a breach by the customer as much as by us.
1. The parties and the subject matter
- The controller
- The company using Digital Field Book, identified by its account in the application. It determines the purposes and means of processing the data it enters.
- The processor
- Fuzzy Works S.R.L., 38442280, of Bumbacului nr. 19 bloc PB21 ap. 2, Oradea 410591, Bihor. It processes the data solely on the controller's behalf.
The subject matter is the processing of the personal data described in Annex I, for the purpose of providing the contracted service. This agreement applies for as long as the controller's account exists in the application and ends with it, subject to clause 9.
This agreement supplements the service contract. Where the two conflict on the processing of personal data, this agreement prevails.
2. What each party is answerable for
The controller decides what data goes into the application and why, and is answerable for the lawfulness of that decision. In particular, the controller warrants that it has a lawful basis for every category of data it enters and that it has discharged its own duty to inform the data subjects.
- Employees recorded in the application, and the people named as owner, tenant or beneficiary on a parcel, **have no account and never see the application**. The duty to inform them (Art. 14) rests with the controller, not with us. We publish a privacy notice that can be used for that purpose.
- The processor does not use the data for its own purposes, does not sell it, and does not use it to train automated systems.
- The processor is a controller in its own right only for the security data of sign-in and for its own administration staff's accounts. Those are outside this agreement.
If in our opinion an instruction from the controller infringes the Regulation or other data protection provisions, we inform the controller immediately and may suspend that instruction until the matter is resolved (Art. 28(3), final sentence).
3. Processing only on documented instructions — Art. 28(3)(a)
We process personal data only on the controller's documented instructions, including as regards transfers to a third country.
The controller's documented instructions are: this agreement, the service contract, and the controller's users operating the features the application provides. In other words, an operation the application offers and one of the controller's users performs is by definition instructed.
Any instruction beyond these is to be given in writing, to gdpr@fuzzy-works.com. Where Union or Romanian law requires us to process beyond the instructions, we inform the controller before processing unless that law prohibits the notice on important grounds of public interest.
4. Confidentiality — Art. 28(3)(b)
We ensure that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
- Our staff's access to a customer's data is limited to what is strictly necessary to operate the platform and to provide support the customer has asked for.
- Every platform administration account is personal rather than shared, and carries two-factor authentication.
- The list of people holding such an account is reviewed periodically, and a record of those reviews is kept.
5. Security of processing — Art. 28(3)(c) and Art. 32
We implement the technical and organisational measures listed in Annex II. Each measure there names the file in the application that implements it, so that it can be checked rather than merely believed.
Measures may change over time provided the level of security is not reduced. **A change that weakens a measure in Annex II is a change to this agreement** and produces a new version, and therefore a fresh acceptance.
6. Sub-processors — Art. 28(2) and (3)(d)
The controller gives a general authorisation for the engagement of the sub-processors listed in **Annex III**. Each of those is bound by contract to data protection obligations at least as strict as those in this agreement, and we remain fully liable to the controller for their performance.
**Annex III-B lists other recipients, and this clause does not apply to them.** They are not our sub-processors: a payment provider that sells the subscription in its own name and is the controller of your payment details under its own notice, and public services the application queries under their own published terms. We do not instruct them and cannot bind them by contract, so we do not warrant that we have. Annex III-B names what governs each disclosure instead, and the table says which of them you can decline.
Both annexes are generated from the application's own configuration and cannot omit a recipient the system actually uses.
7. Assistance with data subject rights — Art. 28(3)(e)
Taking into account the nature of the processing, we assist the controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests for exercising the rights in Chapter III of the Regulation.
- The application lets you correct, deactivate and delete the data you entered, without needing to ask us for anything.
- Erasure of the whole account, with a choice between anonymisation and full deletion, is initiated from the application and confirmed through a link emailed to your first administrator. If that email cannot be sent, our staff may complete the request without the confirmation, choosing the mode themselves and recording why; clause 9 sets out that case.
- If a request reaches us directly from a data subject whose data belongs to you, we do not answer it on the merits: we pass it to you without undue delay and support you in answering in time.
- For requests the application cannot satisfy by itself — in particular an access or portability request needing an extract — we answer your request within 10 working days, so that you can meet the one month allowed by Art. 12(3).
8. Assistance with Arts. 32–36 — Art. 28(3)(f)
We assist the controller in complying with its obligations on security of processing, breach notification and impact assessment, taking into account the nature of the processing and the information available to us.
- Breach notification (Art. 33(2))
- We inform the controller **without undue delay and within 48 hours at the latest** of becoming aware of a personal data breach affecting its data. The period is deliberately shorter than the 72 hours the controller has towards the authority, so that those 72 hours remain usable.
- What the notice contains
- The nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot provide all of it at once, we provide it in phases as it becomes available.
- Impact assessment (Arts. 35–36)
- On request we provide the information about the processing and the security measures needed for a data protection impact assessment or a prior consultation with the authority.
9. Deletion or return at the end — Art. 28(3)(g)
At the end of the provision of the service, at the controller's choice, we delete or return all the personal data and delete existing copies, unless Union or Romanian law requires storage.
- The choice between **anonymisation** and **full deletion** is yours and is made from within the application. Anonymisation removes every name, email address and telephone number recorded about a person, and every uploaded file, and keeps the farm record; what you typed yourselves — your notes, and the names you gave your own fields, sheds, animals and flocks — is kept as it was written, so a person named in one of them stays named. Full deletion removes everything, the farm record included. Both remove the uploaded files from our disks.
- One exception: when the confirmation email for an erasure request could not be sent, our staff may complete the request without the confirmation, choosing between the two modes themselves and recording the reason, and the register of erasures records that we authorised it rather than you. It is the only case in which we erase your data without your confirmation.
- Full deletion runs as a single database transaction, with the files removed after it commits; a failure to delete a file is recorded individually, because a swallowed error is indistinguishable from a successful deletion.
- Data present in backups disappears as those backups expire, within 90 days at most. During that period the backups are not used for anything but restoring the system.
- Return is made in a structured, commonly used, machine-readable format.
10. Information and audit — Art. 28(3)(h)
We make available to the controller all information necessary to demonstrate compliance with the obligations in Art. 28, and allow for and contribute to audits, including inspections, conducted by the controller or an auditor it mandates.
- Annex II and the published technical documentation are the first level of response and are, in most cases, sufficient.
- An audit is announced at least 30 days in advance, takes place during business hours and does not unreasonably disrupt operations. Unless an authority directs otherwise, it is carried out at most once a year.
- A mandated auditor may not be a competitor of the processor and signs a confidentiality undertaking.
- An audit may not extend to other customers' data, nor to shared infrastructure whose exposure would affect the security of those other customers.
11. International transfers
Data is hosted in the European Union. We do not transfer personal data outside the European Economic Area unless the transfer is covered by a European Commission adequacy decision or by standard contractual clauses, and Annex III states where each recipient processes.
The map background is no longer such an element and has not been since 6 September 2026: the imagery is rendered by our own server, so the request reaches the hosting provider named in Annex III and goes no further. **The one recipient outside the EEA is the edge in front of our server**, Cloudflare, Inc., which every request passes through and which therefore sees everything in transit. It is covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework and by standard contractual clauses, both stated in Annex III, and it **cannot be declined**, because the request carrying the refusal would pass through it first.
12. Changes to this agreement
We may change this agreement where a change in law, a decision of the supervisory authority, a change of sub-processors or a development in the security measures requires it. Substantive changes take a new version and are put to you for acceptance at your next sign-in; until you accept, the version you previously accepted continues to apply.
Wording fixes and translation corrections do not change the version, because they change neither party's rights or obligations.
13. Governing law and disputes
This agreement is governed by Romanian law and by the law of the European Union. Disputes are settled by the courts competent at the processor's registered office, without prejudice to the right of data subjects to approach the supervisory authority or the courts under Arts. 77–79 of the Regulation.
- Supervisory authority
- Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
- B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucureşti, România
- anspdcp@dataprotection.ro — https://www.dataprotection.ro
Annex I — Description of the processing
Nature and purpose of the processing: providing a digital farm record covering land, field operations, vehicles, employees and the documents attached to them. Duration: for as long as your account exists, subject to the retention periods below.
| Personal data | Categories of data subject | Purpose |
|---|---|---|
| Name, email address, telephone number, password hash, two-factor secret and recovery codes, language and theme | The customer's own staff | Authenticating the customer's users and giving each the access their role requires |
| First and last name | The customer's employees, who have no account | Recording which worker carried out which field operation |
| Names recorded as owner, tenant or beneficiary of a parcel | Owners, tenants and beneficiaries of land — third parties with no relationship to the platform | Identifying who holds and who farms each parcel, for agricultural records and subsidy audit |
| Which account recorded which field or vehicle operation, and when; who changed a parcel boundary | The customer's own staff | Agricultural traceability, and being able to demonstrate what was done on each parcel |
| JPEG and PDF files attached to a parcel, vehicle, accessory, employee or the company, and their metadata | Any of the above, depending on what is uploaded | Storing the customer's own paperwork against the record it belongs to |
| Free text written by a user, the page it was sent from, and the account | The customer's own staff | Resolving faults and suggestions the customer reports |
| IP address, browser identifier, sign-in times, failed sign-in attempts | The customer's own staff | Protecting the accounts and detecting abuse — an Art. 32 obligation in its own right |
The retention periods the application actually enforces are as follows. Where deletion is automatic, the process that performs it is named:
| What is kept | For how long | Deleted by |
|---|---|---|
| Access and change log — IP address, browser, account, what was done | 30 days | cli/purge_log.php |
| Record change history — which record somebody created, changed or deactivated, and what an edited register entry said before | 1095 days | cli/purge_log.php |
| Sign-in history and security events — IP address, browser, account, what was done | 365 days | cli/purge_log.php |
| Failed sign-in attempts — email address and IP address | 7 days | cli/purge_login_attempt.php |
| Expired or revoked mobile device tokens — device name, last used | 30 days | cli/purge_api_token.php |
| Active web sessions — IP address, browser, last activity | Until sign-out, or 120 minutes of inactivity | cli/purge_session.php |
| Account and employee data, land owner names | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Planned and recorded field operations, vehicle operations and boundary history | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Who created and who last changed each company record — the account and the date | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Uploaded documents and their metadata | Removed on request, or with the company account | Not deleted automatically |
| Scouting notes (text, kind, photo reference, optional position and author): for the lifetime of the company account. The position and the author are removed by the anonymising erasure; the whole note by the deleting one. | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| The position your handset recorded when you saved a field or vehicle entry, with how accurate it was and who saved it: for as long as that entry exists. It is what lets an inspection years later see that the entry was made in the field. The anonymising erasure clears the coordinates and the operator; the deleting one removes the row | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Registered machines and handsets — the device name, the identifier it reports, and which user a handset belongs to. Customers frequently make the name a person’s name, which is why it is listed here | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Support requests raised from inside the product — who raised it, which page from, the free text of the report and of our answer | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| The livestock register — animals, groups, events, grazing and breeding, including the attending veterinarian, whom an animal was bought from or sold to, and the reference of a hired sire. These are third-party names a customer typed, and the anonymising erasure clears them | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Harvest lots and where they went — including the buyer a customer named | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| The vehicle register — machines, implements, their operations and their reminders, including the registration plate | For as long as the company's account exists, then per its erasure choice | Not deleted automatically |
| Raw readings sent in by machines and sensors the customer has connected - a position, a work session, a fuel or soil value, with the time the device recorded it. Kept briefly: a reading exists to be turned into a proposed field operation for somebody to confirm, and once that has happened the record it produced lives elsewhere. | 90 days | cli/purge_device_reading.php |
| A short-lived note that a write from a mobile phone has already been carried out, so that a phone which lost its connection and sent the same work again does not record it twice. It holds no names, no positions and no document contents - only which kind of write a signed-in user made, at what minute, and what answer they got. Kept for about a week, which is how long a phone may plausibly be out of coverage with unsent work still on it. | 7 days | cli/purge_api_idempotency.php |
| Records of access and portability requests — which account asked, from which address, when, and how often the link was used | 365 days | cli/purge_data_export_request.php |
| Finished erasure requests — which account asked and when, whether it was confirmed, the mode, when and by which of our staff it was carried out, and any reason our staff recorded for completing it without the confirmation. A request still in progress is never deleted | 365 days | cli/purge_company_erasure_request.php |
| Records of data takeouts — which account took a copy, from which address, when, and how much data | 365 days | cli/purge_company_takeout.php |
| Acceptance of the data processing agreement — the name typed as a signature, the address and the browser it was typed from, and which text was accepted | For as long as the contract could be disputed. The name, the address and the browser are removed by an erasure; the record that the contract was accepted, and of which text, remains | Not deleted automatically |
| Finished requests to exercise a right that reached us by email — which right, the address it came from, what was asked, the deadline and what was decided. A request still open is never deleted, at any age | 1095 days | cli/purge_data_subject_request.php |
| Payment notifications received from Paddle - the billing contact's name and address as the payment provider sent them. The record that a notification arrived is kept beyond this period, but carries no personal data once the body has been emptied. | 365 days | cli/purge_paddle_event.php |
| Signups started on the public website - the company name, and the name and email address of the person who started one. Kept only as long as a recent purchase may still need reconstructing; most of these rows belong to people who never became customers. | 180 days | cli/purge_company_signup.php |
| Database backups — a complete copy of the database, taken before every deployment as the only rollback a migration has. It contains whatever the database contained at that moment | 30 days, then the copy is deleted. Backups are not searched and are restored only after a disaster, so data erased in the live system can survive in a backup until that backup is deleted | Not deleted automatically |
| The working directory a download is built in — while an access copy or a data takeout is being assembled, the file being built sits on the server. It is deleted as soon as the download finishes | Deleted the moment the download completes; anything a failed or interrupted download leaves behind is removed within 6 hours | cli/purge_staging.php |
Annex II — Technical and organisational measures
The measures implemented under Art. 32. The third column names the provision of the Regulation each measure answers.
| Measure | What is implemented | Article |
|---|---|---|
| Encryption at rest | Session payloads and two-factor secrets are encrypted with AES-256-GCM. Passwords are bcrypt hashes and are rehashed automatically when the recommended algorithm moves on; API tokens and reset links are stored only as hashes. The encryption key can be rotated without signing anybody out. | Art. 32(1)(a) |
| Encryption in transit | HTTPS with Strict-Transport-Security, and the session cookie marked Secure, HttpOnly and SameSite=Lax. A Content-Security-Policy with a per-request nonce means no injected script executes. | Art. 32(1)(a) |
| Access control | Every page and every data endpoint — in the web application and in the mobile API alike — is checked against the privilege the navigation is built from, so "can this user see the page" and "can this user read or write these rows from a phone" cannot give different answers. An unmapped endpoint is refused rather than passed. | Art. 32(1)(b) |
| Separation between customers | Every company-scoped query is filtered by the company identifier taken from the session and never from anything the browser sends. No customer can address another customer's data. | Art. 32(1)(b) |
| Authentication | Two-factor authentication (TOTP, RFC 6238) is available on every account, mandatory for the operator's administration staff, with single-use recovery codes and a replay guard. The sign-in form does not disclose whether an address is registered. | Art. 32(1)(b) |
| Brute-force protection | Rate limiting per account and per IP address, shared by the web application, the administration application and the mobile API. | Art. 32(1)(b) |
| Injection resistance | Every query uses prepared statements with emulation disabled; output is escaped at every sink; a per-session token is required on every state-changing request. | Art. 32(1)(b) |
| Upload handling | Uploads are checked by content rather than by file extension, images are re-encoded to strip embedded payloads and EXIF data, and the storage directory is not reachable over HTTP. | Art. 32(1)(b) |
| Logging | Sign-ins and record changes are logged with the account, the IP address and the browser, and purged automatically once the retention period expires. | Art. 32(1)(b) |
| Session and device management | Each user can see their own live sessions and connected mobile devices and revoke any of them. Deactivating an account, suspending a company or resetting a password destroys the sessions immediately. | Art. 32(1)(b) |
| Availability and integrity | Stored files are checksummed, and a reconciliation job reports any file without a record or record without a file. Restoring from backup is tested and the test is recorded. | Art. 32(1)(c) |
| Testing and review | An automated test suite runs against a real database built from the shipped schema. A compliance page checks the live data against the stated retention periods and security expectations, and records the recurring reviews. | Art. 32(1)(d) |
Annex III — Authorised sub-processors
The sub-processors authorised as at version 5 of this agreement — engaged by us, acting on our instructions — with where each one processes and whether it is necessary or optional. Every entry in this table is bound by contract to data protection obligations at least as strict as those in this agreement, which is the warranty clause 6 gives:
| Recipient | Why it receives data | Where it processes | Can it be declined? | What it is to us |
|---|---|---|---|---|
| Host Europe GmbH | Runs the server and the database the application lives on, and holds the uploaded files. | Germany | No — the service cannot be provided without it | Sub-processor — engaged by us, under contract, acting on our instructions |
| Cloudflare, Inc. (cloudflare.com) | Sits in front of our server. Your browser's encrypted connection ends here, so this company reads every request whole on its way through — the address and password you type into the sign-in form, every document you upload, everything the mobile application sends — before passing it on to us. It filters abusive traffic and keeps a copy of the map tiles it has already served. The site cannot be reached without it. | Handled at a European Union edge; the company is established in the United States — EU–US Data Privacy Framework certification, with standard contractual clauses | No — the service cannot be provided without it | Sub-processor — engaged by us, under contract, acting on our instructions |
| Host Europe GmbH | Delivers the messages the application sends: password resets, erasure confirmations, maintenance reminders. | Germany | No — the service cannot be provided without it | Sub-processor — engaged by us, under contract, acting on our instructions |
| Host Europe GmbH | Serves the map imagery shown underneath the parcel outlines. The pictures are drawn by our own server from OpenStreetMap data, so the request for them reaches the same company that hosts everything else here, through the edge network above like every other request, and no map company. It carries your IP address and the area you are looking at. | Germany | Yes — only with your consent | Sub-processor — engaged by us, under contract, acting on our instructions |
| Copernicus Data Space Ecosystem — Sentinel Hub API (dataspace.copernicus.eu, ESA / Sinergise) | Computes vegetation-index statistics for a parcel from satellite imagery. It receives the parcel boundary and a date range from our server — no name, no account detail, and not who asked. | European Union | On by default: while a company's Satellite (NDVI) feature is on, the boundary of each of its parcels is sent once a week. The company's administrator can switch the feature off under Company Settings → Features, and nothing is sent after that | Sub-processor — engaged by us, under contract, acting on our instructions |
A change to this list triggers the notice described in clause 6.
Annex III-B — Other recipients
These are **not** our sub-processors and clause 6 does not apply to them. They are listed here because the disclosure is real and a list of recipients that omits them would be incomplete — not because we hold a data protection contract with them. The last column names what governs each disclosure instead:
| Recipient | Why it receives data | Where it processes | Can it be declined? | What it is to us |
|---|---|---|---|---|
| Paddle.com Market Ltd (paddle.com) | Sells and bills the subscription as Merchant of Record - it is the seller, not a supplier acting on our instructions, and is the controller of your payment details under its own privacy notice. It receives the billing contact's name and email address and the company reference; it returns only the state of the subscription. No card details, billing address or invoice line is stored by this application. | United Kingdom (adequacy decision), with group companies outside the EEA | No — the service cannot be provided without it | Not our sub-processor — a controller in its own right — it sells the subscription in its own name and is the controller of your payment details under its own privacy notice |
| ANCPI (geoportal.ancpi.ro) | The national cadastre. Queried from our server when a parcel is looked up by its cadastral number; it receives the number, not who asked. | Romania | Yes — only with your consent | Not our sub-processor — receives data under its own published terms — the authority's own published terms for the geoportal govern the disclosure |
| ANAF (webservicesp.anaf.ro) | Looks up what a fiscal code is registered to, so a company's own details can be filled in instead of typed. Only the fiscal code is sent, from our server; no account, address or device information goes with it. Used only when somebody presses the button. | Romania | Yes — only with your consent | Not our sub-processor — receives data under its own published terms — the authority's own published terms for its public web service govern the disclosure |
A change to this list triggers the same notice as a change to Annex III.