Data Processing Agreement

1. Parties and subject matter

This agreement is entered into between the natural or legal person holding the account, hereinafter the Controller, and PENDIENTE DE COMPLETAR (razón social registrada), hereinafter the Processor.

This agreement forms an integral part of the Terms of Service and is incorporated into them as an annex, so that its content is presented alongside the main contract rather than by reference to an external document.

2. Definitions

Personal data

Any data relating to an identified or identifiable natural person, under article 3 of Law 8968.

Processing

Any operation on personal data: collection, recording, storage, consultation, modification, transfer or deletion.

Data subject

The natural person the data refers to: a farm worker, a supplier, a client.

Subprocessor

A third party engaged by the Processor that processes personal data on behalf of the Controller.

3. Scope of processing

The Processor processes the following data on behalf of the Controller:

Processing is carried out by automated means, for the term of the service contract and for the retention periods set out in section 9.

4. Processor obligations

The Processor undertakes to:

• Process data only on instructions. It will not use the data for its own purposes, nor to build profiles, nor to train models, nor for any purpose other than delivering the contracted service.
• Not sell or assign the data. Under no circumstances will it commercialise, disseminate or distribute the data to third parties.
• Maintain confidentiality. The duty of secrecy survives the end of the contractual relationship, under article 11 of Law 8968.
• Apply security measures. Those described in the Security Overview, which forms part of this agreement.
• Assist the Controller. It will provide the technical means to handle access, rectification and suppression requests received from data subjects.
• Notify incidents. It will report without undue delay any security breach affecting data processed on behalf of the Controller, with the information needed for the Controller to meet its own obligations.
• Return or delete. On termination it will proceed as set out in section 9.

5. Controller obligations

The Controller represents and undertakes to:

• Have informed data subjects, under article 5.1 of Law 8968, of the existence of the database, its purposes, who may consult it and how to exercise their rights.
• Have obtained express consent where the law requires it, independently of any other document, and to retain proof of having done so.
• Record only the data necessary for the stated purposes, refraining from entering sensitive data it does not need for farm management.
• Handle, in its capacity as controller, requests from data subjects within the 5 business days set by article 7 of Law 8968.
• Keep the list of users with access to its organisation up to date and revoke access for those who leave.

6. Subprocessors

The Controller gives the Processor general authorisation to engage subprocessors, subject to the following conditions:

• The current list is published in the Subprocessor List and forms part of this agreement.
• The Processor will impose on each subprocessor, in writing, data protection obligations no less demanding than those in this agreement.
• Any addition or replacement will be notified at least 10 business days in advance.
• The Controller may object in writing within 30 calendar days of the notification.
• If the objection is reasonable and no viable alternative exists, the Controller may terminate the contract without penalty, with a pro-rata refund of the unused portion.

The Processor is liable to the Controller for the acts and omissions of its subprocessors as if they were its own.

7. International transfers

The main database remains hosted in Costa Rica. File storage and network routing involve transfer to Cloudflare infrastructure outside the country.

Under Chapter III of Law 8968, those transfers rest on the informed consent of data subjects, which the Controller undertakes to obtain, and on contractual confidentiality and security commitments with the subprocessor.

8. Verification

The Controller may request, once a year and with 30 calendar days' notice, reasonable information to verify compliance with this agreement. The Processor will respond in writing and may satisfy the request with documentation of its security measures.

If the Controller requires an on-site audit, its scope, date and cost must be agreed in advance, and it may not compromise the confidentiality of other customers' data.

9. Return and deletion

On termination of the service contract:

• The Controller retains read-only access and export capability for 30 calendar days.
• After that period the Processor deletes the data from active systems.
• Encrypted backups retain copies for up to a further 90 calendar days while they rotate, without being accessible for ordinary use.

After deletion the Processor retains, for the sole purpose of evidencing compliance with its legal obligations, the record of acceptance of the contractual documents. That record contains no farm or staff data.

10. Liability

Each party is liable for breach of the obligations this agreement places on it.

11. Term and applicable law

This agreement takes effect on acceptance of the Terms of Service and remains in force for as long as the Processor processes data on behalf of the Controller.

It is governed by the laws of the Republic of Costa Rica, in particular Law 8968 and its Regulation, and submits to the jurisdiction of the Costa Rican courts.

For any communication relating to this agreement: [email protected].