Privacy notice

Digital Field Book web application

Version 19, in force from 2026-10-03

Language of this notice

Contents

In short Who is answerable for your data What data we process Why we process it, and on what basis How long we keep it Who we disclose it to Transfers outside the European Economic Area Cookies, and your choice How we protect it Your rights If you have no account in the application Automated decisions and profiling Changes to this notice Contact and complaints

This notice tells you what personal data we collect through the Digital Field Book web application, why we collect it, who we share it with, how long we keep it, and what you can ask of us. It is written to be read, not to be ticked off.

In short

Digital Field Book is a digital farm record. The personal data in it is entered by the company using it: its own staff accounts, the names of its workers, and the names of the owners of the land it farms.
We sell data to nobody, we run no advertising, and we use no behavioural analytics tool of any kind. There is not one tracking cookie in the application.
Three elements are optional and stay switched off unless you accept them: the map background, which our own server draws, the cadastral lookup at ANCPI and the fiscal register lookup at ANAF. The application records your parcels and your work without any of them.
Each company's data is separated from every other company's at the level of each individual query; no company sees another's data.
You have rights over your data and you can exercise them by writing to gdpr@fuzzy-works.com.

Who is answerable for your data

Digital Field Book is used by several companies, each with its own data. There are therefore two distinct roles, and who is answerable for what depends on which data is being discussed.

The company using the application is the controller: For the data it enters: its own users' accounts, the employees it records, the people named as owner, tenant or beneficiary on a parcel record, and the documents it uploads. It decides what to collect and why.
We, Fuzzy Works S.R.L., are the processor: For that same data. We process it only on the company's instructions and only in order to provide the service to it, never for purposes of our own.
We are the controller: For our own administration staff's accounts, and for the security data we keep in our legitimate interest -- the access log and the record of failed sign-in attempts.

Our contact details are at the end of this notice.

What data we process

Account data: First and last name, email address, telephone number, password (kept only as a bcrypt hash, never in the clear), the language and theme you chose, and -- if you turn on two-factor authentication -- its secret, encrypted, together with the recovery codes, which are also kept only as hashes.
Employee data: First and last name, entered by the company for its work log. These people have no account in the application.
Land data: The names of the owner, tenant and beneficiary as the company records them on the parcel. Where these are natural persons, they are personal data.
The work log: Who recorded which field operation or vehicle intervention and when, and who changed a parcel's boundary and when. It is a record of working activity and should be understood as one.
Uploaded documents: JPEG and PDF files attached to a parcel, a vehicle, an accessory, an employee or the company. Their content is chosen by the company; we store it, we do not read it.
Support tickets: The free text you write when you write to support -- to report a fault, ask a question or send a suggestion -- together with the page you sent it from and your account.
Billing data: For a company on a paid plan: the name and email address of the person who set the subscription up, and the state of that subscription -- which plan, active or not, paid until when. The payment itself is handled by Paddle, which sells the subscription; no card number, billing address or tax identifier is stored by us, and the invoices are held by Paddle rather than copied here.
Security data: The IP address, the browser identifier and the date of every sign-in, and the email address and IP address of failed attempts. Active sessions hold the same information, so that you can see and end them from your account page.

The application has no field intended for the special categories of data listed in Art. 9 -- health, trade union membership, beliefs. Two routes can nevertheless receive such data if someone enters it: documents attached to an employee record (a fitness-for-work certificate is health data) and the free text of a support ticket. Please do not upload such documents and do not write such information; if you do, your company is answerable for the basis on which it is processed.

Why we process it, and on what basis

Providing the service: Authentication, keeping the farm record, calculating areas, tracking vehicles and documents. Basis: performance of the contract between us and the company (Art. 6(1)(b)), and the company's legitimate interest in organising its own operations (Art. 6(1)(f)) for people who are not party to that contract.
Agricultural traceability and audit: The record of field operations, substances applied and harvests. Basis: the company's legal obligation to keep a register of treatments and operations (Art. 6(1)(c)) and its legitimate interest in being able to demonstrate what was done on each parcel.
Application security: Rate-limiting sign-in attempts, logging access, detecting abuse. Basis: our legitimate interest in protecting the accounts and the data we host (Art. 6(1)(f)); Art. 32 also requires us to take measures of this kind.
Operational communications: Password resets, confirmation of an erasure request, vehicle maintenance reminders. Basis: performance of the contract and the company's legitimate interest.
Tickets sent from the application: Resolving the problem reported. Basis: our legitimate interest in maintaining and improving the service.
Selling and administering the subscription: Taking payment for a paid plan, keeping it in force, and telling the application which plan a company is on. Basis: performance of the contract between us and the company (Art. 6(1)(b)), and our legal obligation to account for the sale (Art. 6(1)(c)). This is not optional for a company that chooses to pay us -- there is no way to be charged without it -- and it involves nobody who is not the person administering that account.
The map background: Showing a map underneath the parcel outlines. Basis: your consent (Art. 6(1)(a)), which you can withdraw at any time from the cookie settings dialog. Since 6 September 2026 the imagery comes from our own server rather than from an outside network, so the choice is now a control over a request and a tile cache rather than over a recipient -- we have kept it because it was offered to you and taking a choice away is worse than leaving one that costs you nothing.
The cadastral lookup at ANCPI: Fetching a parcel boundary from the national cadastre by its cadastral number, so that it does not have to be drawn by hand. Basis: your consent (Art. 6(1)(a)), withdrawable at any time from the same dialog. Refusing it does not stop you registering the parcel; the boundary is drawn on the map instead.
The fiscal register lookup at ANAF: Filling a company's own details in from Romania's fiscal register by its fiscal code, so that they do not have to be typed. Basis: your consent (Art. 6(1)(a)), withdrawable at any time from the same dialog. Only the fiscal code is sent, from our server and only when the button is pressed; refusing it leaves the fields for you to type.

How long we keep it

The periods below are the ones the application actually enforces, not intentions. Where deletion is automatic, the process that performs it is named.

What is kept	For how long	Deleted by
Access and change log — IP address, browser, account, what was done	30 days	cli/purge_log.php
Record change history — which record somebody created, changed or deactivated, and what an edited register entry said before	1095 days	cli/purge_log.php
Sign-in history and security events — IP address, browser, account, what was done	365 days	cli/purge_log.php
Failed sign-in attempts — email address and IP address	7 days	cli/purge_login_attempt.php
Expired or revoked mobile device tokens — device name, last used	30 days	cli/purge_api_token.php
Active web sessions — IP address, browser, last activity	Until sign-out, or 120 minutes of inactivity	cli/purge_session.php
Account and employee data, land owner names	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
Planned and recorded field operations, vehicle operations and boundary history	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
Who created and who last changed each company record — the account and the date	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
Uploaded documents and their metadata	Removed on request, or with the company account	Not deleted automatically
Scouting notes (text, kind, photo reference, optional position and author): for the lifetime of the company account. The position and the author are removed by the anonymising erasure; the whole note by the deleting one.	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
The position your handset recorded when you saved a field or vehicle entry, with how accurate it was and who saved it: for as long as that entry exists. It is what lets an inspection years later see that the entry was made in the field. The anonymising erasure clears the coordinates and the operator; the deleting one removes the row	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
Registered machines and handsets — the device name, the identifier it reports, and which user a handset belongs to. Customers frequently make the name a person’s name, which is why it is listed here	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
Support requests raised from inside the product — who raised it, which page from, the free text of the report and of our answer	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
The livestock register — animals, groups, events, grazing and breeding, including the attending veterinarian, whom an animal was bought from or sold to, and the reference of a hired sire. These are third-party names a customer typed, and the anonymising erasure clears them	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
Harvest lots and where they went — including the buyer a customer named	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
The vehicle register — machines, implements, their operations and their reminders, including the registration plate	For as long as the company's account exists, then per its erasure choice	Not deleted automatically
Raw readings sent in by machines and sensors the customer has connected - a position, a work session, a fuel or soil value, with the time the device recorded it. Kept briefly: a reading exists to be turned into a proposed field operation for somebody to confirm, and once that has happened the record it produced lives elsewhere.	90 days	cli/purge_device_reading.php
A short-lived note that a write from a mobile phone has already been carried out, so that a phone which lost its connection and sent the same work again does not record it twice. It holds no names, no positions and no document contents - only which kind of write a signed-in user made, at what minute, and what answer they got. Kept for about a week, which is how long a phone may plausibly be out of coverage with unsent work still on it.	7 days	cli/purge_api_idempotency.php
Records of access and portability requests — which account asked, from which address, when, and how often the link was used	365 days	cli/purge_data_export_request.php
Finished erasure requests — which account asked and when, whether it was confirmed, the mode, when and by which of our staff it was carried out, and any reason our staff recorded for completing it without the confirmation. A request still in progress is never deleted	365 days	cli/purge_company_erasure_request.php
Records of data takeouts — which account took a copy, from which address, when, and how much data	365 days	cli/purge_company_takeout.php
Acceptance of the data processing agreement — the name typed as a signature, the address and the browser it was typed from, and which text was accepted	For as long as the contract could be disputed. The name, the address and the browser are removed by an erasure; the record that the contract was accepted, and of which text, remains	Not deleted automatically
Finished requests to exercise a right that reached us by email — which right, the address it came from, what was asked, the deadline and what was decided. A request still open is never deleted, at any age	1095 days	cli/purge_data_subject_request.php
Payment notifications received from Paddle - the billing contact's name and address as the payment provider sent them. The record that a notification arrived is kept beyond this period, but carries no personal data once the body has been emptied.	365 days	cli/purge_paddle_event.php
Signups started on the public website - the company name, and the name and email address of the person who started one. Kept only as long as a recent purchase may still need reconstructing; most of these rows belong to people who never became customers.	180 days	cli/purge_company_signup.php
Database backups — a complete copy of the database, taken before every deployment as the only rollback a migration has. It contains whatever the database contained at that moment	30 days, then the copy is deleted. Backups are not searched and are restored only after a disaster, so data erased in the live system can survive in a backup until that backup is deleted	Not deleted automatically
The working directory a download is built in — while an access copy or a data takeout is being assembled, the file being built sits on the server. It is deleted as soon as the download finishes	Deleted the moment the download completes; anything a failed or interrupted download leaves behind is removed within 6 hours	cli/purge_staging.php

When a company ends its account, it chooses between two modes. Anonymisation removes the people -- every name, email address and telephone number recorded about a person, and every uploaded file -- and keeps the farm record. What the company typed itself, its notes and the names it gave its own fields, sheds, animals and flocks, is kept as it was written, so a person named in one of them stays named. Full erasure removes everything, the farm record included. Either one needs a separate confirmation through a link emailed to the company's first administrator, and is then executed by us as a distinct operation -- with one exception: when that email could not be sent, our staff may complete the request without the confirmation, choosing the mode themselves and recording why, and the register of erasures records that we authorised it rather than the company.

Who we disclose it to

We do not sell or rent data to anyone. Beyond the company it belongs to, data reaches only the providers below, and only to the extent strictly necessary for the service each one performs.

Recipient	Why it receives data	Where it processes	Can it be declined?	What it is to us
Host Europe GmbH	Runs the server and the database the application lives on, and holds the uploaded files.	Germany	No — the service cannot be provided without it	Sub-processor — engaged by us, under contract, acting on our instructions
Cloudflare, Inc. (cloudflare.com)	Sits in front of our server. Your browser's encrypted connection ends here, so this company reads every request whole on its way through — the address and password you type into the sign-in form, every document you upload, everything the mobile application sends — before passing it on to us. It filters abusive traffic and keeps a copy of the map tiles it has already served. The site cannot be reached without it.	Handled at a European Union edge; the company is established in the United States — EU–US Data Privacy Framework certification, with standard contractual clauses	No — the service cannot be provided without it	Sub-processor — engaged by us, under contract, acting on our instructions
Host Europe GmbH	Delivers the messages the application sends: password resets, erasure confirmations, maintenance reminders.	Germany	No — the service cannot be provided without it	Sub-processor — engaged by us, under contract, acting on our instructions
Host Europe GmbH	Serves the map imagery shown underneath the parcel outlines. The pictures are drawn by our own server from OpenStreetMap data, so the request for them reaches the same company that hosts everything else here, through the edge network above like every other request, and no map company. It carries your IP address and the area you are looking at.	Germany	Yes — only with your consent	Sub-processor — engaged by us, under contract, acting on our instructions
Paddle.com Market Ltd (paddle.com)	Sells and bills the subscription as Merchant of Record - it is the seller, not a supplier acting on our instructions, and is the controller of your payment details under its own privacy notice. It receives the billing contact's name and email address and the company reference; it returns only the state of the subscription. No card details, billing address or invoice line is stored by this application.	United Kingdom (adequacy decision), with group companies outside the EEA	No — the service cannot be provided without it	Not our sub-processor — a controller in its own right — it sells the subscription in its own name and is the controller of your payment details under its own privacy notice
ANCPI (geoportal.ancpi.ro)	The national cadastre. Queried from our server when a parcel is looked up by its cadastral number; it receives the number, not who asked.	Romania	Yes — only with your consent	Not our sub-processor — receives data under its own published terms — the authority's own published terms for the geoportal govern the disclosure
ANAF (webservicesp.anaf.ro)	Looks up what a fiscal code is registered to, so a company's own details can be filled in instead of typed. Only the fiscal code is sent, from our server; no account, address or device information goes with it. Used only when somebody presses the button.	Romania	Yes — only with your consent	Not our sub-processor — receives data under its own published terms — the authority's own published terms for its public web service govern the disclosure
Copernicus Data Space Ecosystem — Sentinel Hub API (dataspace.copernicus.eu, ESA / Sinergise)	Computes vegetation-index statistics for a parcel from satellite imagery. It receives the parcel boundary and a date range from our server — no name, no account detail, and not who asked.	European Union	On by default: while a company's Satellite (NDVI) feature is on, the boundary of each of its parcels is sent once a week. The company's administrator can switch the feature off under Company Settings → Features, and nothing is sent after that	Sub-processor — engaged by us, under contract, acting on our instructions

We may also disclose data where a public authority requires it of us under the law. In such a case we tell the company the data belongs to, unless the law forbids us to.

Transfers outside the European Economic Area

The farm data -- parcels, operations, employees, vehicles, documents -- is held on servers in the European Union. The table of recipients above shows where each one processes. Two things reach further, and both are named below.

The subscription payment goes to Paddle, which sells the subscription and is established in the United Kingdom, a country the European Commission has recognised as providing an adequate level of protection; its group includes companies outside the EEA, and those transfers are covered by standard contractual clauses. What is sent is the name and email address of the person administering the account, and the company reference. This concerns only companies on a paid plan, and only the person who set the subscription up -- no employee, landowner or field record is involved in it.

The map background does not leave the European Economic Area and has not since 6 September 2026. The imagery is drawn by our own server from OpenStreetMap data and reaches you from the same company that hosts everything else here, through the edge described in the next paragraph like every other request. The request still carries your IP address and the area you are looking at, which is why the map background stays optional and is not loaded unless you accept it; the parcels themselves are drawn from our own data and are visible without it.

What does reach a company outside the European Economic Area is every request you make to this site, including this page. Our server sits behind Cloudflare, Inc., which filters abusive traffic and caches what it can. Your browser's encrypted connection ends at Cloudflare, so it reads each request on its way through before passing it on to us. The traffic is handled at a Cloudflare location inside the European Union and the company itself is established in the United States, which makes it a transfer: it is covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Cloudflare is certified, and by standard contractual clauses that stand on their own if that decision ever falls. This one cannot be switched off, because the request that would carry your refusal has already passed through it.

The cadastral lookup to ANCPI stays inside the European Union, and is made from our server rather than from your browser: it sends the cadastral number being searched for, not the identity or the address of whoever is searching. It is nevertheless optional -- it is not performed unless you accept it, and a parcel can be registered without it by typing its cadastral number and drawing the boundary on the map.

If a provider comes to process data outside the EEA in future, the transfer will be made only under a European Commission adequacy decision or standard contractual clauses, and this notice will be updated beforehand.

Cookies, and your choice

A cookie is a small file the application stores in your browser. The web application uses the following:

Cookie	What it is for	Category	How long it lasts
dfb_session	Issued to every visitor. Until you sign in it identifies nobody and is stored nowhere; once you have, it keeps you signed in and carries the token that stops another site submitting forms on your behalf.	Strictly necessary	Until you sign out or the session expires
dfb_admin_session	The same, for the operator's own administration application. It is never set in a customer's browser.	Strictly necessary	Until you sign out or the session expires
dfb_form_token	Carries the random number that proves a form you send -- signing in, asking for a new password, confirming a deletion -- was sent from this browser and not by another site. It holds nothing about you and is not stored on our side at all.	Strictly necessary	Until you close the browser
dfb_cookie_consent	Remembers the choice you made in this dialog, so you are not asked again on every page.	Strictly necessary	182 days
dfb_theme	Remembers whether you chose the light or the dark theme. Written only when you press the theme button.	Preference	One year
dfb_language	Remembers the language you chose for this notice, so it opens in that language next time.	Preference	One year
__cf_bm	Set by Paddle, our payment provider, on its own domain when the billing page loads its checkout script. It protects that checkout against automated abuse. It is not used to track you and reaches no other page.	Strictly necessary	About 30 minutes

None of them tracks behaviour and none of them belongs to anybody else. The strictly necessary cookies keep your session open and prevent request forgery; without them signing in does not work, which is why they cannot be turned off. The preference cookies are written only when you choose something -- the dark theme, or the language of this notice -- and remember exactly that choice.

What we are asking you to accept is not, in fact, a cookie. There are three such things and none of them is one. The first is the map background: the imagery is drawn by our own server, and the request for it reaches the company that hosts this application through Cloudflare, the network in front of our server that every request to this site passes through and that keeps a copy of the map tiles it has already served; no map company receives it. It still carries your IP address and the area you are looking at -- which is, in practice, where the company's parcels are -- and it is still a request your browser would not otherwise make, which is why we go on asking. The second is the cadastral lookup: when a parcel is registered by its cadastral number, our server asks the national cadastre for its boundary and sends it that number. The third is the fiscal register lookup: when a company's details are filled in from its fiscal code, our server asks ANAF what that code is registered to and sends it the code. Without your acceptance the application refuses to make either of those two requests at all. Every refusal leaves the application working -- the parcels are drawn from our own data, a boundary can be drawn on the map by hand, and a company's details can be typed. You can change your mind about any of them at any time from the "Cookie settings" button.

Your choice is remembered for 182 days, after which we ask again. You can delete cookies at any time from your browser settings; deleting the session cookies signs you out.

How we protect it

Passwords are stored as bcrypt hashes and are recomputed automatically when the recommended algorithm moves on. Nobody, ourselves included, can read a password.
Two-factor authentication is available on every account and mandatory for our own administration staff. The secrets are encrypted in the database.
Sign-in is rate-limited both per account and per IP address, and the form does not reveal whether an email address is registered.
Every query uses prepared statements; the separation between companies is applied on each query from the session, never from anything the browser sends.
Uploaded files are checked by content rather than by extension, and images are re-encoded to strip anything hidden inside them. The directory they are held in is not reachable directly from the internet.
Page content is constrained by a security policy that permits no foreign script to execute, with one exception: the two pages on which a subscription is paid for -- the subscription page and the payment step of a signup -- load the checkout script of Paddle, which sells the subscription.
You can see your own sessions and connected devices on your account page and end them one at a time or all at once.

If a security breach nevertheless occurs that is likely to put your rights at risk, we notify the supervisory authority within 72 hours of becoming aware of it and, where the risk is high, we notify you as well.

Your rights

Regulation (EU) 2016/679 gives you the following rights over your data. You can exercise them at any time, free of charge, and we answer within one month of receiving the request (Art. 12(3)); if the request is complex we may tell you that we are extending that by two further months, and why.

Right of access (Art. 15): To find out whether we process data about you and to receive a copy of it, together with the purposes, categories, recipients and retention periods.
Right to rectification (Art. 16): To have inaccurate data corrected and incomplete data completed. You correct your own name and telephone number on your account page, and change your email address there too, confirmed through a link sent to the new address; the administrator of the company that created your account can also correct your name. What the company recorded about you in its own registers is corrected by the company.
Right to erasure (Art. 17): To have data erased where it is no longer necessary for the purpose it was collected for, where you withdraw consent and there is no other basis, or where the processing is unlawful. An administrator of the company that created your account can erase it from the user list: your name, email address, telephone number, sign-in history and connected devices are removed, your email address becomes free to use again, and what you recorded for the company stays in its registers under an account number with no name. Erasure of an entire company account is done from within the application and is described below.
Right to restriction (Art. 18): To require that data is only stored and not otherwise used, while we verify a challenge you have made to its accuracy or to the basis for processing it.
Right to portability (Art. 20): To receive the data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where that is technically feasible.
Right to object (Art. 21): To object to processing based on our legitimate interest, on grounds relating to your particular situation. We stop, unless we can demonstrate compelling legitimate grounds that override yours.
Withdrawing consent: Where we have relied on your consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Right to lodge a complaint (Art. 77): To complain to the supervisory authority. Its contact details are below. You do not have to come to us first, though it would help us to know.

Requests go to gdpr@fuzzy-works.com. So that we do not hand data to someone who has no right to it, we may ask you to prove your identity -- and if we cannot establish who you are, we are obliged to refuse (Art. 12(6)).

If you are an employee of a company that uses Digital Field Book, or the owner or tenant of a parcel recorded in it, your request concerns that company first -- it decides what data about you is entered. You can still write to us; we will point you to them and help them answer you.

If you have no account in the application

Some of the people whose data ends up in Digital Field Book have no account and never see the application. That is the case for employees recorded by a company for its work log, and for the owners, tenants and beneficiaries named on a parcel record. The Regulation applies to them exactly as fully as it does to a user with a password.

The company that entered your data is the one answerable for it: it decided to collect it, it knows why, and it can correct or delete it from within the application.
That company is obliged to inform you about the processing (Art. 14) -- including the fact that the data is held in an application hosted by us.
We act on the company's instructions. If you write to us directly we will acknowledge you, pass the request to the company, and support it in answering you in time.

If you do not know which company to approach, write to gdpr@fuzzy-works.com with what you do know and we will tell you.

Automated decisions and profiling

We do not take automated decisions producing legal effects concerning you or similarly significantly affecting you, within the meaning of Art. 22. We do not profile, we do not compute behavioural scores, and we do not assess anyone's performance from the data in the application.

The application calculates areas, fuel consumption and maintenance due dates. Those are arithmetic on entered data, not decisions about people.

Changes to this notice

This notice is version 19, in force from 2026-10-03. When we change something of substance -- a new purpose, a new recipient, a changed retention period -- we publish the new version, change its number, and bring it to your attention at your next sign-in. Wording fixes and translation corrections do not change the version number, because they do not change anything you need to know.

Contact and complaints

Controller: Fuzzy Works S.R.L., 38442280, Bumbacului nr. 19 bloc PB21 ap. 2, Oradea 410591, Bihor
Email for data protection matters: gdpr@fuzzy-works.com

If our answer does not satisfy you, you may approach the supervisory authority:

Supervisory authority: Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucureşti, România
: anspdcp@dataprotection.ro — https://www.dataprotection.ro