PRIVACY POLICY

Date Last Amended: June 6, 2018

This Privacy Policy articulates what personal information we collect from you and how this information is used and disclosed.

Policy

We are committed to maintaining the accuracy, security and privacy of your personal information in accordance with applicable legislation, including Canada’s Personal Information Protection and Electronic Documents Act, SC 2000, c 5, Alberta’s Personal Information Protection Act, SA 2003, c P-6.5, and other legislation which may apply from time to time. This policy is a description of our privacy principles and practices regarding the personal information we collect, use, and disclose.

What is Personal Information?

Personal information is information about an identifiable individual. This includes such things as name, age, gender, other physical attributes, address and other contact information, financial information, health information, preferences, activities and interests.

Commitment to Privacy

We are committed to protecting personal information and privacy, and we consider matters relating to the protection of personal information and privacy to be of the utmost importance. We adhere to the following principles to protect privacy:

We do not sell, rent, loan, trade, lease, transfer or otherwise disclose your personal information to third parties, except as otherwise provided in this Privacy Policy or as permitted or required by law.
We do not share any information which you have not agreed to disclose, unless required by law or as necessary to enforce our terms of use or to protect our rights, property or personal safety, and that of the public.
All personal information provided to us will be protected with industry-standard protocols and technology.

Collection and Use

Use of the Application

The personal information we collect from you will only be used for the purpose of providing and improving the Field Manager mobile application and website (collectively, the “Application”).

For this registration and subsequent login procedure, we collect the following information about you:

name;
email address; and
password

We process this information in order to provide you with additional information about the Application and other products of Digital Farming, to enable restoring information of your profile, to enable you to connect the Application to other Digital Farming products in the future, and to enable mobile in-app related profile saving.

E-mail marketing

If you have given us your consent to do so, we will share your personal data as listed below with the BASF company which is locally responsible for you based on the location of your business as specified in your consent (together "We"). You can find an overview of the respective BASF Agricultural companies here. For the purpose of providing you with personalized agricultural relevant information and advice, we will process the following of your personal data in order to send marketing e-mails to you:

Name
E-mail-address
Mobile phone number
Field-, field-zone and time-specific information:
- Primarily generated data through your usage of xarvio products, such as:
  - Soil e.g. tillage, soil type
  - Seeding e.g. seed variety, density, seeding date
  - Field observations e.g. disease/weeds observations
  - Irrigation e.g. amount of water
  - Fertilization e.g. timing, N, P, K amount used
  - Crop protection e.g. products and dose rate used
  - Harvest e.g. yield
  - Machine data e.g. as applied maps
- Remote data and model-based data e.g. (model data is based on farmer generated, remote and BASF data)
  - Satellite data e.g. visible spectrum, infrared spectrum, elevation levels
  - Climatic data e.g. rain fall, air temperature, humidity
  - Data from field-, machinery- or other sensors e.g. Insects, Weeds, Diseases, Crop Emergence, Crop Growth Stage, Nutrition or Water availability

The Field-, field-zone and time-specific information are necessary for personalizing the agricultural relevant information which we provide you with.

We will share your personal data with other affiliated companies of the BASF Group if they provide IT services for us or if this is necessary for operational reasons. Furthermore, we will pass on your personal data to the technical IT service providers we use from whom we obtain services. Our IT service providers are carefully selected and regularly checked by us. They process personal data only on our behalf and strictly in accordance with our instructions on the basis of corresponding contracts for order processing. In some cases, e.g. in the case of WhatsApp, the service provider might be located in a country outside of the EU which might not have a level of data protection comparable to the GDPR. By applying to our marketing services, you explicitly consent to the transfer of your personal data into such third countries.

We store your personal data collected within the scope of your consent for the above-mentioned purposes until your consent is revoked.

The legal basis for the processing of your personal data for the above-mentioned purposes is your consent, Art 6, paragraph 1, lit. a) GDPR.

You can revoke your consent at any time with effect for the future by clicking the unsubscribe link in the marketing e-mails.

You are at liberty to grant or withhold consent. This has no effect on the use of this Application.

If you revoke your consent, we will delete your personal data immediately, provided that we process them for marketing purposes on the basis of your consent. Please note that the revocation does not result in the deletion of all your personal data which we process in the course of the business relationship with you, if there is another legal basis for this. The revocation of your consent does not affect the legality of the data processing that has taken place up to that point.

Disclosure and Third Party Use

Disclosures of your personal information may include the following:

disclosure to third party service providers employed or retained by us to perform certain services or functions, such as payment processing, data processing, collection or research services; and/or
disclosure in the event of a sale, transfer or securitization of our business or assets.

For example, the Application works with PayPal Inc. (“PayPal”), a paying agent who procures and processes your payments and the related personal data on our behalf (commissioned processing). In order to be able to process your orders in our webshop, we need to process the following personal data:

your above mentioned personal data from registration
the product or service you have purchased
payment information you provide to us (e.g. credit card information)
invoice address and VAT-ID

In order to verify your payments made via PayPal, we will need to transfer the following personal data that you have provided to PayPal:

our name
the product or service you purchased
transaction number
total dollar amount of your purchase including taxes
invoice address

PayPal will ask you to provide the relevant information that is required to process the payment option you chose, such as your credit card information. PayPal processes this personal data to organize the execution of your payment. For this purpose, PayPal will forward your payment information to the respective payment service provider of the payment option that you chose (such as your credit card company or PayPal itself, if you, as a PayPal customer, choose to execute your payment via PayPal). If you would like to know more about how your payment service provider handles your personal data, please contact the respective payment service provider directly.

The Application also uses so-called “Cookies”. Cookies are small text files that are stored on your hard drive via your browser. They store certain information (e.g. your preferred language or site settings) that your browser might re-transfer to us upon your next access to our website (depending on the Cookies’ lifespan).

We differentiate between two categories of cookies: (1) functional Cookies, without which the functionality of our Application would be reduced, and (2) optional Cookies used for website analysis and marketing purposes. The following tables contain a detailed description of the Cookies we use:

Functional cookies

Purpose and content	Lifespan
DF_Token: Encoded token used to authenticate you within the service provided by Field Manager	Sessions
glt_APIKEY: Encoded token used to authenticate you within the service provided by GIGYA	Sessions

Optional cookies

Purpose and content	Lifespan	on/off
Website analysis with Google Analytics _ga These cookies assign a randomly generated ID your device, enabling urecognize your device uyour next access. For on website analysis plthe respective chapter below.	6 months	{{cookietoggler}}
Website analysis with Google Analytics _gat This Cookie does not store any data traceable to individual persons. It optimizes the transfer of the information required for web analyses.	10 minutes

You may use our Application without any Cookies being set. In your browser, you can at any time configure or completely deactivate the use of Cookies. This may, however, lead to a restriction of the functions or have adverse effects on the user-friendliness of our Application. You may at any time object to the setting of optional Cookies by using the respective objection option indicated in the table above.

By accepting the terms of this Privacy Policy you consent to set Cookies on your computer which enables us to make use of Google Analytics, a web analysis service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States (“Google”). Based on your consent, Google will analyze your use of our Application on our behalf in order for us to be able to better understand how you use this Application, which enables us to improve this Application according to our customers’ interests. The information collected by Google in connection with your use of our Application (e.g. content of our Application visited by you, your language settings, your operating system, your screen resolution, etc.) will be transmitted to a server of Google in the US, where it will be stored and analyzed. The respective results will then be made available to us in anonymized form. Your usage data will not be connected to your full IP address during this process. We have activated on our Application the IP anonymizing function offered by Google, which will delete the last 8 digits (type IPv4) or the last 80 bits (type IPv6) of your IP address. Moreover, Google is certified under the EU-US Privacy Shield, which ensures that an adequate level of data protection is maintained with respect to the processing of data by Google in the US.

Further information on Google Analytics is available in the Google Analytics Terms of Use, the Privacy and Data Protection Guidelines of Google Analytics and in the Google Privacy Policy

We only analyze your use of this Application, if we have obtained your prior consent upon your first access to our Application or if you make use of the switch above to turn app analytics on or off. You may revoke your consent at any time by using the same switch above.

We do not disclose your personal information to third parties except as described in this Privacy Policy, with your consent, or as permitted or required by law. In circumstances where we contract with third parties, such as Adjust, we restrict their use of personal information (contractually or otherwise) to what is necessary to assist us or act on our behalf. Any third parties which are provided access to personal information will also be required to comply with security requirements prescribed by us. Third parties are not related to us and are not governed by this Privacy Policy.

Other Collection, Use, and Disclosure

We also reserve the right to collect, use, and disclose your personal information without your knowledge or consent where permitted or required by law.

If we ever wish to use or disclose personal information in a way that is different from that stated in this Privacy Policy or stated at the time of collection, we will notify affected individuals who will then have a choice as to whether or not we can use or disclose their personal information in this different manner, unless that use or disclosure is necessary to provide a requested product or service or it is permitted or required by law.

Personal Information Aggregated or Made Anonymous

To the extent that we make any personal information anonymous or aggregate it with the personal information of others such that it can no longer be attributed to you, this personal information will no longer be considered to be personal information and we are entitled to use, retain, disclose and destroy such information in our absolute discretion.

Choosing to Provide Personal Information

When dealing with us, you may choose not to provide certain personal information. If you choose not to provide all information reasonably requested, it may limit the manner in which you can make use of the Application, or you may not be able to use the Application at all.

Unless we are otherwise informed, the submission of personal information to us or the utilization of the Application shall constitute consent to the collection, use and disclosure of personal information as described in this Privacy Policy. Implied consent may be obtained through amendments to this Privacy Policy, as provided below.

We will obtain express consent prior to or when collecting, using or disclosing any personal information for a purpose that is not described in this Privacy Policy, or for a purpose that we did not identify to the individual from whom we are collecting personal information from, or that was not reasonably expected at the time of collection, unless we are required or authorized by law not to obtain such individual’s consent.

In certain circumstances, without limiting the foregoing provisions, including but not limited to when dealing with certain legal or security issues, we may be authorized or required by law to disclose personal information without seeking or obtaining your knowledge or consent.

You may refuse to provide personal information to us, and you may also at any time, on reasonable notice to us, withdraw consent to any of our collection, use or disclosure of your personal information unless it is required to provide requested products or services or as required by law or by similar obligations. Alternatively, refusing to provide information or withdrawing consent may limit the products or services that we are able to provide, including use of the Application itself.

Upon request, you can receive instructions on how to withdraw consent for particular purposes and/or inform us of communication preferences if you decide that you do not want to receive emails or other communications from us.

Right of Access and Correction

You have the right to review any personal information stored in our system with regard to the use of the Application.

On your written request, and taking into consideration what is reasonable, we will provide you, not later than forty-five (45) days from our receipt of your request, or such additional time as permitted or required by law, with:

access to your personal information (if any) under our custody or control;
information about the purposes for which your personal information (if any) under our custody or control has been and is being used by us; and
the names of persons to whom, and the circumstances in which, your personal information (if any) has been and is being disclosed by us.

If you request a copy of your personal information and such information can reasonably be reproduced, we will provide you with a copy of the record or the part of the record containing the requested information or, if applicable, we will give you reasons for any delay in providing a copy of the requested information or record.

If you request to examine the record containing your personal information or if the requested record cannot reasonably be reproduced, we will permit you to examine or access the record or part of the record in accordance with this Privacy Policy.

All requests may be subject to reasonable fees and disbursements. Where appropriate, we may require advance payment of a deposit or the entire costs of responding to a request for access to personal information.

We require that all requests for access to personal information be in writing, be signed by the requestor, and include sufficient detail to enable us, with a reasonable effort, to identify any record in the custody or under our control containing the personal information in respect of which the request is made. Please email our Data Protection Officer at the (contact information below).

Limits on Right to Access

The ability to access personal information under our custody and control is not absolute. We reserve all rights not to disclose personal information, in whole or in part, in certain circumstances permitted or required by law, including but not limited to where:

the disclosure could reasonably be expected to threaten the safety or physical or mental health of an individual;
the disclosure would reveal personal information about another individual;
the information is protected by any legal privilege;
the disclosure of the information would reveal confidential commercial information; or
the personal information was collected by us for an investigation or legal proceeding.

If access to personal information is refused, in whole or in part, we will provide you with the reasons for the refusal, the legislative provision on which the refusal is based, and the name of the individual who can answer questions on behalf of us about the refusal, and will inform you that you may ask for a review of the refusal in accordance with the applicable legislation.

Accuracy and Completeness

When we collect, use or disclose personal information, we will make a reasonable effort to ensure that the personal information is accurate, up-to-date, and complete to the extent that is reasonable for our purposes in collecting, using, or disclosing the information. To do so, it may be necessary for us to request additional information from you or have you verify your personal information.

You can review your information by contacting our Data Protection Officer (contact information below), and you should inform us of any changes to your personal information.

Requests for Correction

On your written request, we will make every reasonable effort to correct errors or omissions in your personal information where that information is in our custody or control. We require that all such requests be in writing, be signed by the requestor, and include sufficient detail to enable us, with a reasonable effort, to identify any record in our custody or under our control containing the personal information in respect of which the request is made. Please email our Data Protection Officer (contact information below).

If you make such a request, we will, as soon as reasonably possible and not later than forty-five (45) days from our receipt of the request, or within such additional time as permitted or required by law, either:

correct the personal information and, if reasonable to do so, send correction notifications to any third party to whom we disclosed the incorrect information; or
decide not to correct the personal information, but we will annotate the personal information under our control to indicate that a correction was requested but not made.

We will inform you of the action that we have taken in response to your request for correction, the name of the individual who can answer questions on behalf of us about the request for correction, and that you may ask for a review of the action taken in accordance with applicable legislation.

Notwithstanding any requests for corrections of personal information, we will not correct or otherwise alter an opinion, including a professional or expert opinion.

Retention and Destruction

We may retain your personal information for as long as we reasonably require the personal information for the purposes for which it was collected or for legal or business purposes, including initiating a tracking of personal information in the event of actual or attempted unauthorized access to our servers. We will also retain your personal information for as long as reasonably necessary to resolve disputes, and to enforce this Privacy Policy and any terms of use.

Within a reasonable time period after we no longer reasonably require your personal information for the purposes for which it was collected or other purposes identified in this Privacy Policy, we will either destroy the records under our custody or control containing the personal information or we will render the personal information anonymous so that it can no longer be used to identify you.

Security

We protect personal information by implementing reasonable security safeguards appropriate to the sensitivity of the information, including technical and organizational security. Any personal information that you provide to us will be encrypted in transit to prevent its possible misuse by third parties. Our security procedures are continuously revised based on new technological developments.

We will act in a reasonable manner, including by contractual or other means, to require third parties to whom we disclose personal information in accordance with this Privacy Policy or as required or permitted by law to safeguard the personal information by abiding by terms contained in this Privacy Policy or by their own comparable privacy policies and by complying with applicable privacy legislation with respect to the personal information. However, we cannot guarantee such compliance by third parties.

Recourse

If you are concerned about the collection, use or disclosure of personal information, you may lodge a written complaint with our Data Protection Officer The complaint will be thoroughly investigated and the outcome will be communicated in a timely manner.

Contacts

If you have any problems, questions or ideas, please use the provided contact form or contact our company Data Protection Officer at: data-protection@basf.com

For further information regarding the provider of the services related to the Application, please refer to our imprint.

Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy at any time without providing notice to you. Updates will be published and available on the Application. The amended Privacy Policy shall automatically be effective when posted. Amendments may include, without limitation, additions, deletions or modifications to this Privacy Policy. The date on which this Privacy Policy was last amended is indicated at the start of this Privacy Policy.

Limited Nature of this Privacy Policy

Nothing contained in this Privacy Policy is intended to create a contract or agreement.