Data Processing Agreement

1. Purpose and parties

This agreement forms part of the BoviMonitor Terms of Use. It is entered into by the Customer —the Account holder—, as controller, and Inversiones Anaguaya S.A.S., a company domiciled in Barranquilla, Colombia (the "Company"), as processor. It governs the processing of the personal data contained in the Customer Content (the "Customer Data") that the Company carries out to provide the service. Capitalized terms have the meaning given to them in the Terms of Use.

The account and user data for which the Company is the controller are governed by the Privacy Policy, not by this agreement.

This agreement serves as the personal data transmission contract under Colombian law (Article 2.2.2.25.5.2 of Decree 1074 of 2015), as the processing contract under Article 28 of Regulation (EU) 2016/679 ("GDPR") and its United Kingdom equivalent (UK GDPR), and as the contract with the processor provided for in Article 39 of Brazilian Law 13,709 of 2018 ("LGPD").

2. Customer instructions

The Company processes Customer Data only to provide the service and in accordance with the Customer's documented instructions, which are: the Terms of Use, this agreement, and the configuration and use of the Platform by the Customer and its Users, including the plan it contracts, which sets how long photographs are kept. If, in the Company's opinion, an instruction infringes data protection law, it will inform the Customer. The Customer also authorizes the Company to anonymize Customer Data to obtain the aggregate figures provided for in section 8 of the Terms of Use, which do not allow anyone to be identified.

The Customer warrants that it has a legal basis to enter Customer Data in the Platform and that it has informed the people the data concern —in particular, those who work on its farms— that their activities, locations and photographs are recorded in it.

3. Confidentiality and security

The people authorized by the Company to process Customer Data are bound by confidentiality. The Company applies the technical and organizational measures in Annex 2 and reviews them periodically; it may change them as long as the level of protection does not decrease.

4. Sub-processors

The Customer authorizes the Company to engage the sub-processors in Annex 3. The Company will give the Customer at least 30 days' notice, by email to the Account holder or by a notice in the Platform, before adding or replacing one. The Customer may object on reasonable data protection grounds; if the parties do not reach an agreement, the Customer may terminate the affected service, with immediate effect and without penalty. The Company imposes on each sub-processor data protection obligations equivalent to those of this agreement and remains liable to the Customer for their performance.

5. Data subject rights

The Platform allows the Customer to consult, correct and export Customer Data, and to delete a User or the entire Account; with that, it can handle by itself the requests of the people the data concern. If one of them contacts the Company about Customer Data, the Company will forward the request to the Customer without answering it on its own, unless the Customer instructs it to. If the Customer cannot handle a request with the Platform's tools, the Company will assist it as far as is reasonable.

6. Security breaches

The Company will notify the Customer of any security breach affecting Customer Data without undue delay and no later than 48 hours after becoming aware of it. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of people and records affected, its likely consequences and the measures taken or proposed, and will be supplemented as more information becomes available.

7. Cooperation and audits

The Company will make available to the Customer the reasonable information it needs to carry out impact assessments, consult a data protection authority and demonstrate compliance with this agreement.

The Customer may audit that compliance once a year, at its own cost, with 30 days' notice, during business hours and without access to other customers' data, by itself or through an independent auditor bound by confidentiality. The Company may first respond with documentation and written answers; an on-site audit takes place if these are not sufficient or if an authority orders it.

8. End of the service

When the relationship ends, Customer Data is kept for 90 days so that the Customer can export it, as stated in section 13 of the Terms of Use. After that period, the Company permanently deletes it, unless the law requires it to be kept. Backups that still contain it are automatically renewed within a maximum of 90 days.

9. International transfers

The Company is in Colombia and hosts Customer Data in Chile; some sub-processors are in the United States (Annex 3).

• European Union and European Economic Area. Where the GDPR applies to the transfer of Customer Data to the Company, the parties enter into the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914, module two (controller to processor), which are incorporated by reference into this agreement with these options: clause 7 does not apply; in clause 9, option 2 (general authorization), with the 30-day notice in section 4; in clause 11, without the option; in clause 13, the supervisory authority is that of the Member State where the Customer is established or, if it is not, the one that applies under that clause; in clause 17, the law of Ireland, and in clause 18, the courts of Ireland. Annexes I, II and III of the clauses are completed with Annexes 1, 2 and 3 of this agreement.
• United Kingdom. Where the UK GDPR applies to the transfer, the Information Commissioner's Office International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B1.0) also applies, with its tables completed with this agreement and its annexes; neither party may end it under its section 19.
• Brazil. Where the LGPD applies to the transfer, the parties adopt, in full and without alterations, the standard contractual clauses in Annex II of Resolution CD/ANPD No. 19 of 2024, with the Customer as exporter and the Company as importer; the information those clauses require is completed with this agreement and its annexes.

With sub-processors in the United States, the Company relies on the EU-U.S. Data Privacy Framework where the sub-processor is certified and, otherwise, on the standard contractual clauses included in their terms.

In the event of a conflict, the standard contractual clauses prevail over this agreement, and this agreement prevails over the Terms of Use as regards the protection of Customer Data.

10. Liability and term

Each party's liability to the other is governed by the Terms of Use, without prejudice to what the standard contractual clauses provide with respect to the people the data concern. This agreement remains in force for as long as the Company processes Customer Data. Questions about it are handled at privacidad@bovimonitor.com.

Annex 1. Description of the processing

• Data subjects: the Account's Users —owners, administrators and those who work on the farms— and other people the Customer records in the Platform.
• Categories of data: name, username, contact email and phone; role and assigned farms; operational records with their date, time and who made them; GPS coordinates of the records that capture them; photographs and attachments; technical identifiers of the phones.
• Special categories of data: the Platform does not ask for them, and the Customer undertakes not to enter them.
• Nature of the processing: hosting, storage, synchronization with the phones, report calculation, backups and deletion.
• Purpose: providing the contracted service and support.
• Frequency and duration: continuous, for as long as the relationship lasts and during the periods in section 8. While it lasts, the file of each photograph is kept for the period of its plan: one year on the Basic plan and five on the All-inclusive plan, counted from the end of the month in which it was taken (section 6 of the Privacy Policy).

Annex 2. Technical and organizational measures

• Encryption in transit: all connections use HTTPS with TLS 1.2 or higher, and the browser is required to use it (HSTS).
• Encryption at rest: the database, the files and their backups are encrypted (AES-256) in Google Cloud.
• Separation between customers: each query is limited to the account and the farms of whoever makes it, and photographs and attachments only open with a dedicated image credential.
• Role-based access: what each User sees and does depends on the role the Customer assigns them.
• Passwords: stored with Argon2id, never in readable form.
• Sign-in protection: checks against automated access (Cloudflare on the web, Play Integrity on Android), a limit on attempts per IP address, and a 15-minute account lockout after 10 failed attempts.
• Sessions: the access token expires after 15 minutes; the refresh key changes on each use and, if someone is detected reusing an old one, the keys of that session are revoked. On the web, the key lives in a cookie that the page's code cannot read, and the page only runs its own code (content security policy).
• Phones: credentials are stored in Android's secure storage, and a lost phone can be blocked from the web. Since version 0.0.1386, the application is excluded from Android backup and from data transfer to another phone.
• Logs: which parts of the Platform each account accesses, with date, time and IP address, and the technical logs of each request, for 30 days.
• Backups: daily, keeping the 14 most recent, with recovery to any point in the last 7 days.
• Environments and staff: production, testing and development use separate databases, each with its own user; credentials are kept in a secrets manager, access to production is restricted and each deployment to production requires manual approval.

Annex 3. Sub-processors

• Google Cloud (Google LLC): hosts the application, the database, the photographs and the files in the Santiago, Chile region, and the technical logs.
• Zoho Corporation (servers in the United States): sends the Platform's emails, including alerts, which may contain Customer Data.
• Mapbox, Inc. (United States): satellite imagery and map thumbnails, on the web and in the Android application. It receives the IP address and the coordinates of the area shown; in thumbnails, also the outline of the place.
• Esri (Environmental Systems Research Institute, Inc., United States): satellite imagery on the web. It receives the IP address and the coordinates of the area shown.
• Google LLC (United States), with Google Maps Platform: map thumbnails on the web. It receives the IP address and the outline of the place.

Cloudflare, Inc. and Google LLC, with Play Integrity, protect the sign-in to the Platform and do not receive Customer Data.