Truleaf Fields data processing agreement

This data processing agreement ("DPA") forms part of the Truleaf Fields Terms. It applies when Truleaf processes personal data on behalf of a customer under Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Parties and roles

Controller: the customer, which is the workspace that holds the data. For a farm set up by an advisory practice and not yet claimed, the controller is the practice's workspace until the grower claims the farm (custody clause). For client lists imported by a practice, the controller is the practice's workspace until each client workspace exists.
Processor: Matheus Paranhos, a sole trader (empresário em nome individual) established in Portugal, trading as Truleaf, tax and VAT number PT308520050, tax address R. Antonio Manuel Frutuoso 54, 3700-042 São João da Madeira (Porto Metropolitan Area), Portugal ("Truleaf").
When an advisory practice or cooperative works in a client's workspace through an advisor link, it acts for that client. Truleaf processes that data for the client workspace, not for the practice.

2. Subject, duration, nature and purpose

Truleaf hosts and processes the personal data in the customer's workspace to provide Truleaf Fields: farm and field management, satellite and weather monitoring, sensor integrations, alerts, the logbook and observations, Kwáu over the workspace's data, "Find my fields", "Import my clients" and exports. This DPA lasts as long as Truleaf processes such data for the customer. Details are in Annex 1.

3. Instructions

Truleaf processes the personal data only on the customer's documented instructions. These instructions are the Terms, this DPA, the settings of the workspace and the actions its users take in Fields.
Truleaf tells the customer if it believes an instruction infringes data protection law.
Where EU or Member State law requires Truleaf to process the data otherwise, Truleaf informs the customer first, unless that law forbids it.

4. Confidentiality and staff access

People authorised to process the data are bound by confidentiality. Truleaf staff open a workspace's data only to provide support or keep the service secure, through an audited view that requires a recorded reason. Owners of the workspace can see each such access.

5. Security

Truleaf applies the technical and organisational measures in Annex 2 and keeps them appropriate to the risk (GDPR Art. 32).

6. Sub-processors

The customer gives Truleaf general authorisation to use sub-processors. The current list is Annex 3 and is published at Annex 3.
Truleaf announces any new or replaced sub-processor at least 30 days in advance. The customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the customer may end the affected service without penalty.
Truleaf imposes on each sub-processor data protection obligations equivalent to this DPA and remains responsible for it. The one exception is the public address search of the OpenStreetMap Foundation used during the invite-only pilot (Annex 3): a public service that signs no processing agreement and receives no customer or user identifier.

7. Transfers outside the EU

Customer data is stored in the EU. Some sub-processors process data outside the EU (Annex 3). Address search during the pilot goes to the United Kingdom, under the European Commission's adequacy decision for the United Kingdom. Every other such transfer uses the EU Standard Contractual Clauses (Decision (EU) 2021/914) or, where the recipient takes part in it, the EU-US Data Privacy Framework, together with a transfer impact assessment.

8. Requests from people and from authorities

If a person asks Truleaf to exercise their rights over data in a workspace, Truleaf passes the request to the customer within 5 working days and does not answer it on the customer's behalf unless instructed.
Truleaf helps the customer answer requests through the tools in Fields (export, correction, deletion) and, where needed, by other reasonable means.
If a public authority asks Truleaf for customer data, Truleaf discloses only what the law requires, and informs the customer first unless the law forbids it. For non-personal data held in the EU, Truleaf applies the safeguards of Article 32 of the EU Data Act (Regulation (EU) 2023/2854). The jurisdiction of Truleaf's infrastructure and these safeguards are described at section 16.

9. Personal data breaches

Truleaf notifies the customer of a personal data breach affecting its data without undue delay and within 24 hours of confirming it, with the information then available, and updates it as more is known. Truleaf helps the customer meet its own notification duties.

10. Assistance

Truleaf helps the customer, taking into account the nature of the processing and the information available to it, with data protection impact assessments, prior consultations and its security obligations.

11. Return and deletion

An owner of the workspace can export all its data at any time, free, in open formats.
When the customer deletes the workspace, or the Terms end, Truleaf keeps the data for 30 days so the workspace can be restored and exported, then deletes it, unless the law requires Truleaf to keep it. Deleted data leaves Truleaf's backups when those copies expire (Annex 2). If a backup is ever restored, deletions are applied again before the data is used.

12. Information and audits

Truleaf makes available the information needed to show it meets this DPA: its security documentation, the sub-processor list and, once a year on request, answers to a reasonable security questionnaire. An audit or inspection is allowed at 30 days' notice, once a year, or after a personal data breach, or when an authority requires it, under confidentiality, without access to other customers' data, and at the customer's cost unless it finds a material breach of this DPA. Documentation and the questionnaire come first.

13. Kwáu improvement (opt-in)

The customer instructs Truleaf to use conversation content to review and improve Kwáu only if an owner or admin of the workspace switches on "Help improve Kwáu" in its settings. Staff read a specific conversation turn only when its author also chose to share it. Cases used for evaluation are pseudonymised (names of people and fields replaced) and reviewed before use. If the setting is switched off, the workspace's cases are removed within 30 days. Conversations of an advisor that touch several client workspaces are used only if every one of those workspaces has the setting on.

14. Customer responsibilities

The customer is responsible for having a lawful basis for the data it puts into Fields, for informing the people concerned (for example the applicators, advisors and staff named in its records, or people visible in photos) and for the instructions it gives. A practice that sets up farms for growers, one by one or by import, is also responsible for the confirmations of the custody clause.

15. Liability and precedence

Liability under this DPA follows the Terms, except where the GDPR provides otherwise. If this DPA conflicts with the Terms on personal data in a workspace, this DPA prevails.

16. Where our infrastructure is (EU Data Act, art. 28)

Customer data is hosted as stated in Annex 2 and Annex 3. Truleaf is established in Portugal, under the jurisdiction of the EU and Portugal. Against unlawful access by foreign governments to non-personal data held in the EU, Truleaf discloses only what the law requires, checks that a request is lawful and proportionate, and informs the customer first unless the law forbids it.

Annex 1: Description of the processing

Item	Description
Data subjects	Farm holders who are natural persons; the customer's staff and members; applicators, operators and advisors named in records; people visible in photos or screenshots; growers and farm contacts listed in client lists imported by advisors
Categories of data	Farm locations and field outlines, register references linked to a holder (for example SIGPAC references); seasons and crops; logbook entries including treatments, irrigation, operator and equipment identities and professional numbers (for example NIF, ROPO, applicator card, ROMA); observations with location, free text, photos and their metadata; tasks; sensor connections and readings; satellite and weather results per field; alerts and their history; Kwáu conversations over the workspace's data; "Find my fields" sessions with the address text, confirmed pin and screenshots; client lists with grower names, emails, phones, country, language, crops and area; exports
Special categories	None intended. Fields does not ask for them
Processing operations	Storage, organisation, display, computation of indices, alerts and summaries, geocoding of addresses, AI-assisted answers and suggestions, export and deletion, on the customer's instructions
Frequency	Continuous, while the service is used
Retention	Life of the workspace, then 30 days, except: Kwáu conversations 18 months after the last activity (hidden at once and deleted 30 days later when an advisor loses access to a client whose data they used); "Find my fields" sessions and screenshots 30 days after the session ends; imported client lists (file and cell values) 7 days after commit, cancellation or expiry; export files 30 days; raw sensor readings 13 or 24 months depending on the plan

Annex 2: Technical and organisational measures

Area	Measures
Location	[to be completed before launch: hosting: where the database, files and servers actually are]. Customer data is stored in the EU
Encryption	In transit (TLS) and at rest. Sensor credentials additionally encrypted (AES-256-GCM) under a key kept apart from the database.
Separation between customers	Enforced in the database for every request (row-level security); other customers' records are reported as not found; background jobs check the workspace on every task, covered by automated tests
Access control	Roles per workspace; advisor access only through links approved by the farm and visible to it; revocable sessions with rotation and reuse detection; no shared service keys; scoped, expiring service credentials for automation
Staff access	Audited support view with a recorded reason, visible to workspace owners; a register of staff with access
Logging	Audit log (24 months) and access log (7 months; IP addresses of non-Brazilian users shortened after 30 days)
Minimisation	The AI provider receives only what an answer needs: no emails, no tax or professional numbers, no operator names, no field outlines, and an opaque user id; screenshots are stripped of metadata and resized; client lists reach it only as a header and at most 5 masked rows. The geocoder receives only the address text, from our servers. Field outlines are not sent to imagery or weather providers
Input safety	Uploaded files parsed only by workers with size and content limits; protection against harmful archives, XML and spreadsheet formulas; outbound requests to user-supplied addresses through one guarded client
Availability and recovery	[to be completed before launch: backups: what exists on the effective date (provider, frequency, retention, restore test)]; an incident procedure
Deletion	Deletion jobs for accounts and workspaces, including files; deletions re-applied after any restore

Annex 3: Sub-processors

Sub-processor	Purpose	Data received	Location	Transfer safeguard
[to be completed before launch: hosting provider, entity and region for the database, files and servers]	Database, file storage and servers for the API and workers	All customer data; data in transit and in memory; logs	EU	[to be completed before launch: hosting: safeguard for any support access from outside the EU]
Anthropic (Anthropic Ireland Ltd for EU customers; Anthropic PBC, US)	Kwáu answers; reading screenshot hints; suggesting column mappings for client imports	Questions and the minimised facts of Annex 2; resized screenshots without metadata; client-list headers and up to 5 masked rows. Deleted within 30 days, except content flagged under its usage policy (up to 2 years), classifier results (up to 7 years) and batch jobs (29 days). Not used for training	US / global; no EU processing available	Standard Contractual Clauses (Modules 2/3) in Anthropic's DPA
Resend (Plus Five Five, Inc., US)	Alert, digest, invitation and account emails	Recipient email and name, message content	US (logs and metadata)	Standard Contractual Clauses and EU-US Data Privacy Framework
Vercel Inc. (US)	Delivery of the web application	IP addresses and request data in edge logs; no workspace data through its servers	Global edge; US company	EU-US Data Privacy Framework and Standard Contractual Clauses
OpenStreetMap Foundation (public Nominatim service, United Kingdom), during the invite-only pilot only	Address search for "Find my fields" and the towns of imported client lists	Address or place text, language, country; coordinates of a point picked on the map; no user or workspace id, no end-user IP address	United Kingdom	European Commission adequacy decision for the United Kingdom. No processing agreement: a public service used under the OSMF usage and privacy policies (section 6)
[to be completed before launch: basemap provider and location]	Satellite basemap shown in the browser	End-user IP address, map area viewed, session token	See the provider column	[to be completed before launch: basemap provider: safeguard]
Browser push services (Google, Apple, Mozilla, Microsoft)	Delivery of push notifications users switch on	End-to-end encrypted payload; the service sees endpoint, size and timing	US	They act as independent controllers of their push infrastructure
[to be completed before launch: off-site backup provider, safeguard and retention period]	Encrypted off-site backups	Encrypted copies only	EU region	See the provider column
Spanish public geocoder CartoCiudad (Instituto Geográfico Nacional), farms in Spain only	Address search biased to Spain	Address text	EU (Spain)	Not needed

Announced change: when the pilot ends, Geoapify (KEPTAGO LTD, Cyprus) replaces the OpenStreetMap Foundation for address search, in the EU, receiving address text, language, country bias and a bias point rounded to 3 decimals, no user or workspace id, under its processing agreement. This change is announced here and needs no further notice under section 6.

Not sub-processors (no personal data received): satellite imagery sources (Element 84 Earth Search on AWS Open Data), weather sources (Open-Meteo, MET Norway, NASA POWER), official Spanish registers and services (SIGPAC, Catastro, PNOA, AEMET, SiAR), receiving tile codes, grid points, dates or register references. Sensor vendors the customer connects (for example Pessl FieldClimate, Davis WeatherLink) are the customer's own providers.