Legal
Please read our privacy policy carefully.
We are delighted that you are interested in our company. The protection of your personal data is a matter of great importance to us. Aside from the processing required to operate the service and perform the contract, the use of FarmManager is generally possible without providing any further personal data. Insofar as the processing of personal data becomes necessary for individual functions and there is no legal basis for it, we obtain your consent.
The processing of personal data – such as your name, address, email address or telephone number – is always carried out in accordance with the General Data Protection Regulation (GDPR) and in compliance with the national data protection regulations applicable to us. By means of this privacy policy, we inform you about the nature, scope and purpose of the personal data we process and explain the rights to which you are entitled.
As the controller, we have implemented numerous technical and organisational measures to ensure the most complete protection possible of the data processed through this application. Nevertheless, internet-based data transmissions can in principle have security gaps, so that absolute protection cannot be guaranteed. You are therefore free to transmit personal data to us by alternative means, for example by telephone.
This privacy policy uses the terms of the General Data Protection Regulation (GDPR). So that it is understandable for all readers, we explain the most important terms in advance:
Personal data means any information relating to an identified or identifiable natural person (hereinafter the "data subject"). A natural person is regarded as identifiable if they can be determined, directly or indirectly – in particular by reference to a name, an identification number, location data, an online identifier or to one or more characteristics that express their physical, physiological, genetic, mental, economic, cultural or social identity.
Data subject means any identified or identifiable natural person whose personal data are processed.
Processing means any operation performed in connection with personal data – whether or not by automated means. This includes, among other things, the collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, transmission, alignment, restriction, erasure or destruction of data.
Restriction of processing means the marking of stored personal data with the aim of limiting their future processing.
Profiling means any automated processing of personal data in which such data are used to evaluate or predict personal aspects relating to a natural person – in particular aspects concerning performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Pseudonymisation means the processing of personal data in such a manner that they can no longer be attributed to a specific person without the use of additional information. This additional information is kept separately and is protected by technical and organisational measures.
Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Recipient means any person or body to which personal data are disclosed, whether a third party or not. However, public authorities which receive data in the context of a specific inquiry are not regarded as recipients.
Third party means any person or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process the data.
Consent means any freely given, informed and unambiguous indication of the data subject's wishes – in the form of a statement or another clear affirmative action – by which they signify their agreement to the processing of the data relating to them.
The controller within the meaning of the GDPR and other data protection provisions is:
Softwareentwicklung Sebastian Bleuel
Ortesweg 10
36145 Hofbieber
Deutschland
FarmManager is an access-protected application and uses exclusively technically necessary cookies and comparable storage technologies that are required for secure operation and for logging in. No analysis of your usage behaviour (tracking) takes place; no cookies are used for advertising or audience-measurement purposes.
Specifically, these are: a session cookie (e.g. "farmmanager_session") that secures your login and session; a CSRF token (e.g. "XSRF-TOKEN") to protect against cross-site request forgery; where applicable, a "stay logged in" cookie if you select this option; and the storage of your language selection. In addition, your browser uses local storage (localStorage) to remember that you have acknowledged our cookie notice. We also store your choice between net and gross prices (cookie "sb_price_display").
Since these cookies and storage technologies are strictly necessary for the provision of the service you have expressly requested, we are permitted to use them without your consent (§ 25 Abs. 2 Nr. 2 TDDDG); we base the associated processing of personal data on Art. 6 Abs. 1 lit. b and lit. f GDPR.
You can prevent the storage of cookies via the settings of your browser or delete cookies that have already been set. If necessary cookies are completely deactivated, login and central functions of the application may no longer be fully available to you.
Each time the application is accessed, our systems automatically collect a range of general data and information that is stored in the server's log files. The following may be collected: the type of browser used and its version, the operating system of the accessing system, the website from which the access is made (referrer), the sub-pages accessed, the date and time of access, the IP address, the internet service provider of the accessing system, as well as comparable data that serve to avert danger in the event of attacks on our IT systems.
We draw no conclusions about your person from this data. Rather, it serves to deliver the content of the application correctly, to ensure the permanent functionality of our IT systems, and to provide law enforcement authorities with the necessary information in the event of a cyberattack. The legal basis is our legitimate interest in a secure and functional web offering (Art. 6 Abs. 1 lit. f GDPR). The data in the server log files are stored separately from other personal data.
The use of FarmManager requires the creation of a customer account. During registration, we process the data you provide – in particular your name, email address, farm or company data and your password, which we store exclusively as a hash value. Which details are required is shown in the respective input form. The processing is carried out to establish and perform the user relationship on the basis of Art. 6 Abs. 1 lit. b GDPR. During registration we also record that you accepted the terms and conditions and the data processing agreement and took note of this privacy policy: which version, at what time, from which IP address and with which browser (user agent, i.e. details of the browser type, the browser version and the operating system). The legal basis is Art. 6 Abs. 1 lit. b GDPR and our legitimate interest in being able to prove the conclusion of the contract in the event of a dispute (Art. 6 Abs. 1 lit. f GDPR). We keep the IP address and the user agent until three years after the end of the year of acceptance (regular limitation period, §§ 195, 199 BGB), including beyond the deletion of your account (Art. 17 Abs. 3 lit. e GDPR); after that we delete them. The version and time of the acceptance remain; after your account has been deleted they are linked only to your pseudonymised account.
To protect your account, we offer two-factor authentication, login by means of passkeys, and confirmation of your email address. We process the data required for this – such as authentication features and the time of verification – to ensure account and data security (Art. 6 Abs. 1 lit. b and lit. f GDPR).
As the controller for your farm, you can create additional users (e.g. employees) and, within the application, process personal data of third parties. In this respect, you are the controller under data protection law; we process this data as a processor pursuant to Art. 28 GDPR on the basis of a data processing agreement. Your account data are passed on to third parties only insofar as this is necessary for the performance of the contract or there is a legal obligation to do so.
You can view and rectify the data stored in connection with your account at any time and – subject to statutory retention obligations – have it erased. Corresponding functions within the application as well as the contact named in Section 2 are available to you for this purpose.
For paid subscriptions, we process payments via the payment service provider Stripe. The provider for users in the European Economic Area is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; the technical operation and parent company is Stripe, Inc., USA.
If you choose a paid subscription, the data required for payment processing – in particular name, email address, billing address, the selected subscription and payment-instrument data (e.g. credit card or SEPA data) – are transmitted directly to Stripe and processed there. The complete payment-instrument data are collected and stored exclusively by Stripe; we ourselves receive only the information necessary for managing the contract and subscription, such as the payment status and a Stripe identifier.
The legal basis for the processing is the performance of the subscription contract (Art. 6 Abs. 1 lit. b GDPR) as well as our legitimate interest in secure and fraud-free payment processing (Art. 6 Abs. 1 lit. f GDPR). Insofar as data are transmitted to Stripe, Inc. in the USA, this is carried out on the basis of appropriate safeguards (EU standard contractual clauses or Stripe's certification under the EU-US Data Privacy Framework).
You can find further information on the data processing carried out by Stripe at https://stripe.com/de/privacy .
You can get in touch with us via the contact options provided in this application or in the legal notice – in particular by email – as well as via the integrated support function. We store and process the personal data transmitted in this context (e.g. name, email address and the content of your enquiry) exclusively to handle your request. This data is not passed on to third parties. The legal basis is Art. 6 Abs. 1 lit. a, b and f GDPR.
We process and store personal data only for as long as is necessary for the respective purpose or as provided for by the statutory retention periods to which we are subject.
If the purpose of storage ceases to apply or a prescribed period expires, the corresponding data are routinely blocked or erased in accordance with the statutory requirements. Where records that must be retained by law are affected, these are pseudonymised or anonymised instead of being erased.
As a data subject, you are entitled to numerous rights. To exercise them, you may contact the controller named in Section 2 at any time. For the rights of access and data portability, we also provide you with a self-service export function within the application.
You have the right to request confirmation from us as to whether we are processing personal data concerning you.
You have the right to request the rectification without undue delay of inaccurate personal data and – taking into account the purposes of the processing – the completion of incomplete personal data.
You have the right to request the erasure without undue delay of your data, provided that one of the grounds provided for by law applies and the processing is not necessary – for example where the data are no longer needed for the purposes pursued, you withdraw your consent, you object to the processing, the data have been processed unlawfully, or there is a legal obligation to erase them. Where we have made the data public, we will take reasonable measures, taking account of the available technology and the cost of implementation, to inform other controllers of your erasure request as well.
You have the right to request the restriction of processing if you contest the accuracy of the data, if the processing is unlawful and you oppose erasure, if we no longer need the data but you require them for the establishment, exercise or defence of legal claims, or if you have objected and it has not yet been established whose interests prevail.
You have the right to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller, provided that the processing is based on consent or a contract and is carried out by automated means. Where technically feasible, you may request that the data be transmitted directly to another controller.
You have the right, on grounds relating to your particular situation, to object at any time to the processing of data concerning you which is based on Art. 6 Abs. 1 lit. e or f GDPR; this also applies to profiling based on those provisions. In the event of an objection, we will no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for entering into or performing a contract, is authorised by law, or is based on your explicit consent.
You have the right to withdraw, at any time and with effect for the future, a consent you have given to the processing of personal data.
You have the right to obtain, free of charge and at any time, information about the data stored about you as well as a copy of this data. The information includes in particular:
Furthermore, you have the right to be informed whether data have been transferred to a third country or to an international organisation. In this case, you may request information about the appropriate safeguards relating to the transfer.
Depending on the processing situation, we base the processing of your personal data on different legal bases of the GDPR. Where we obtain your consent for a specific purpose, Art. 6 Abs. 1 lit. a GDPR is the legal basis. Where the processing is necessary for the performance of a contract with you or for the implementation of pre-contractual measures, it is based on Art. 6 Abs. 1 lit. b GDPR. Where we must process data to comply with a legal obligation – for example to meet obligations under tax and commercial law – Art. 6 Abs. 1 lit. c GDPR applies. In rare cases, processing may be necessary to protect the vital interests of a person (Art. 6 Abs. 1 lit. d GDPR). Finally, processing may be based on Art. 6 Abs. 1 lit. f GDPR where it is necessary to safeguard our legitimate interests or those of a third party and your interests, fundamental rights and freedoms do not override them.
Where the processing is based on Art. 6 Abs. 1 lit. f GDPR, our legitimate interest lies in the conduct of our business activities as well as in the secure, stable and user-friendly operation of our web offering.
The criterion for the duration of the storage of personal data is the respective statutory retention period. After its expiry, the corresponding data are routinely erased, provided they are no longer required for the performance or initiation of a contract.
We use extensive technical and organisational security measures to protect your data against accidental or unlawful processing, loss or unauthorised access. The data transmission between your browser and our servers is encrypted via the TLS protocol, recognisable by the lock symbol or by "https" in your address bar. Our security measures are continuously reviewed and adapted in line with technological developments.
We do not make any decisions based solely on automated processing – including profiling.
If you wish, FarmManager will inform you not only through notifications within the application but also via push notifications on your end devices (e.g. about due reminders or system messages). This function is deactivated by default and is used only after you have expressly activated it on each device (opt-in).
When you activate push notifications on a device, your browser generates a unique push address (endpoint) with the push service operated by the browser manufacturer (e.g. Google, Apple or Mozilla). We store this address provided by the browser together with the associated encryption keys in order to be able to deliver notifications to you. Which push service is used is determined solely by your browser or operating system; we have no influence over this. The contents of the notifications are transmitted in encrypted form.
The legal basis for this processing is your consent, which you give by activating the function (Art. 6 Abs. 1 lit. a GDPR). You can deactivate push notifications at any time with effect for the future – via the corresponding setting in your profile or on the respective device, or via the notification settings of your browser. When you deactivate them, the stored push address is deleted.
Because your browser itself selects the push service used and delivery takes place via the infrastructure of the respective browser manufacturer, there is in this respect no processor relationship between us and the provider of the push service; a data processing agreement with these providers is neither required nor possible for this purpose.
FarmManager is developed and operated by a single provider. For technical reasons – in particular for the provision, operation, maintenance, troubleshooting and support of the application – the operator, acting as a processor, generally has the technical ability to access and view all data of every farm (tenant) stored in the application. We wish to inform you about this access possibility openly and transparently.
Such access takes place solely to the extent that it is necessary for the aforementioned purposes – for example to analyse and remedy malfunctions, to handle your support requests or to ensure the proper and secure operation of the application. Your farm data are not used for our own purposes, disclosed to third parties or evaluated beyond these purposes.
The persons authorised to carry out the processing are bound to confidentiality. Access takes place on the basis of the data processing agreement concluded with you (Art. 28 GDPR) and is safeguarded by technical and organisational measures – in particular access control, logging and strict tenant separation. The legal basis for the underlying processing is Art. 6 Abs. 1 lit. b and lit. f GDPR.
At several points in the application, we embed interactive maps to display your fields, barns and machine locations. The available map layers are a street map (OpenStreetMap) and a satellite or aerial view. The map tiles are delivered to your browser directly from the servers of the respective provider: the street map is provided by the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom), and the aerial imagery is provided by Esri (Esri Inc., 380 New York Street, Redlands, CA 92373, USA).
In order to load the maps, your browser transmits the connection data technically required for this – in particular your IP address and the requested map section – to the respective provider; without this transmission, the maps could not be displayed. If you use the address or location search, the search term you enter is transmitted to the Nominatim search service of the OpenStreetMap Foundation in order to determine the corresponding coordinates.
The legal basis is our legitimate interest in a functional, location-based display of your farm data (Art. 6 Abs. 1 lit. f GDPR). For the United Kingdom, an adequacy decision of the European Commission is in place. Insofar as data are transmitted to Esri in the USA, this is carried out on the basis of appropriate safeguards (EU standard contractual clauses or – where available – a certification under the EU-US Data Privacy Framework).
To ensure stable and secure operation, we use a service for automated error and crash diagnostics (Sentry, operated by Functional Software, Inc., 45 Fremont Street, San Francisco, CA 94105, USA). We have selected the EU region of the service as the storage location; the error events collected are therefore stored in a data centre in Frankfurt am Main within the European Union. If a technical error occurs in the application, diagnostic data are collected automatically and transmitted to this service – in particular the error message and the affected program area, the date and time, the browser and device type, as well as, where applicable, your IP address and your user identifier.
We use this data exclusively to detect, isolate and remedy errors and thus to permanently ensure the security and functionality of the application. No evaluation beyond this and no combination of the data into usage profiles takes place.
The legal basis is our legitimate interest in the secure, error-free and permanently available operation of our application (Art. 6 Abs. 1 lit. f GDPR). The error events themselves are stored exclusively within the EU. Account and administrative data of the service – such as user accounts, organisation and project settings and access keys – by contrast continue to be processed in the USA; access from the USA may also occur in the course of error analysis and support. Insofar as data are transmitted to the USA in this context, this is carried out on the basis of appropriate safeguards (EU standard contractual clauses or a certification under the EU-US Data Privacy Framework).
In the context of the user relationship, we send you operationally necessary emails – for example to confirm your email address, to reset your password, in the event of security-relevant events, as reminders, and as part of support communication. For the technical dispatch, we use the email infrastructure of STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.
In doing so, the data required for delivery are processed, in particular your email address as well as the subject and content of the respective message. Dispatch takes place via servers in Germany; no transfer to third countries takes place.
The legal basis is the performance or initiation of the user contract (Art. 6 Abs. 1 lit. b GDPR) as well as our legitimate interest in the reliable and secure delivery of operationally necessary messages (Art. 6 Abs. 1 lit. f GDPR).
