Data Processing Agreement

For Customer Data entered into the Service, the Customer is the data controller and AcrePlus is the data processor, processing personal data only on the Customer’s documented instructions, which include the Terms, this DPA, and use of the Service’s features. For AcrePlus’s own account administration and billing, AcrePlus acts as an independent controller.

AcrePlus processes Customer Data solely to provide the Service: storing and displaying farm fields, products, application logs, tasks, harvest lots, audits, and compliance reports; sending notifications the Customer enables; generating exports and reports; and securing and maintaining the platform. The subject matter is the operation of an AgOps and compliance platform; the duration is the term of the subscription plus the retention period stated in the Privacy Policy.

AcrePlus will not process Customer Data for any purpose other than providing the Service and as instructed by the Customer, and will not sell Customer Data or use it for independent advertising or profiling.

The Customer authorizes AcrePlus to engage the following sub-processors, each bound by data protection obligations no less protective than this DPA:

AcrePlus will give the Customer notice of any intended change to its sub-processors and an opportunity to object.

AcrePlus implements appropriate technical and organizational measures, including: tenant isolation enforced by PostgreSQL row-level security; least-privilege database roles; role-based access control in the application; encryption of data in transit; and an append-only audit log for sensitive record changes.

AcrePlus ensures that personnel authorized to process Customer Data are bound by confidentiality obligations and access data only as needed to provide the Service.

AcrePlus will assist the Customer, taking into account the nature of processing, in responding to data subject requests to exercise access, correction, deletion, restriction, objection, and portability rights, including through the in-app data-export and deletion-request features.

AcrePlus will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data and will provide information reasonably necessary for the Customer to meet its own notification obligations.

AcrePlus will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.

At any time during the term, managers and admins may export the tenant’s complete Customer Data from Settings → Data & Privacy → Export All Data. The export is a downloadable ZIP archive containing the tenant’s fields, products, application logs, tasks, and team members in both CSV and JSON formats, plus an export metadata file documenting the tenant, timestamp, record counts, and platform version.

On termination or expiry of the subscription, and after a window allowing the Customer to export its data, AcrePlus will delete or return Customer Data in accordance with the retention period stated in the Privacy Policy, except where retention is required by law.

Customer Data may be processed outside the Customer’s jurisdiction via the sub-processors listed above.