1. General Information

Granxal Technologies S.L. ("we", "our", "the Company") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal information when you use our services.

This policy applies to all users of our services, regardless of how you access or use our platforms.

2. Data Controller

2.1 Data Protection Officer (DPO)

We have appointed a certified Data Protection Officer to oversee compliance with data protection regulations:

3. Data We Collect

3.1 Registration and Account Data

* Required for paid plans

** Country/region is used for geographic analysis of client origin and content personalisation.

3.2 Livestock Farm Data

• Animal Information: Identification, breed, weight, age, genealogy, location
• Veterinary Records: Treatments, vaccines, medications, withdrawal periods
• Reproductive Data: Inseminations, pregnancies, births, genealogy
• Machinery Information: Inventory, maintenance, operating costs
• Financial Data: Income, expenses, profitability analysis
• Land Information: Plots, surface areas, crops

3.3 Technical and Usage Data

4. Legal Basis for Processing

We process your personal data under the following GDPR legal bases:

4.1 Contract Performance (Art. 6.1.b GDPR)

• Providing contracted services
• Managing your user account
• Processing payments and billing
• Providing technical support

4.2 Legitimate Interest (Art. 6.1.f GDPR)

• Improving our services and developing new features
• Ensuring security and preventing fraud
• Conducting internal usage and performance analysis
• Service-related communications

4.3 Consent (Art. 6.1.a GDPR)

• Marketing communications (newsletters, promotions)
• Analytical and personalisation cookies
• Sharing data with third parties for additional features

4.4 Legal Obligation (Art. 6.1.c GDPR)

• Compliance with tax and accounting obligations
• Cooperation with competent authorities
• Compliance with livestock sector regulations

5. Purposes of Processing

5.1 Primary Purposes

• Service Provision: Providing access to the platform and all its features
• Account Management: Creating, maintaining and administering your user account
• Billing and Payments: Processing payments, generating invoices and managing subscriptions
• Technical Support: Resolving incidents and providing technical assistance
• Legal Compliance: Complying with legal and regulatory obligations

5.2 Secondary Purposes

• Service Improvement: Analysing usage to improve features
• Security: Detecting, preventing and responding to fraudulent activities
• Communications: Sending important notifications about the service
• Research and Development: Developing new features and services

5.3 Marketing and Commercial Communications (Only with Explicit Consent)

Commercial communications are sent only when the user has given explicit and unambiguous consent (Art. 6.1.a GDPR), through an independent checkbox in the registration form. This consent is:

• Voluntary: Denial does not affect access to the service
• Specific: Granted for Granxal communications, not shared with third parties
• Informed: With express indication of the purpose and legal basis
• Revocable: At any time without consequences for the service

Communications sent under this consent include:

• Newsletters with livestock sector news
• Information about new features and services
• Invitations to webinars and training events
• Special offers and promotions
• Content segmented by country/region and farm type

Important distinction: Transactional communications (invoices, security alerts, notifications of changes to the terms) are sent under the legal basis of contract performance (Art. 6.1.b) and legitimate interest (Art. 6.1.f), regardless of marketing consent.

6. Data Sharing

Your data may be shared only in the following circumstances:

6.1 Service Providers (Data Processors)

6.2 Competent Authorities

We may share data when required by law with:

• Tax Authority (tax obligations)
• Judicial authorities (court orders)
• Official livestock bodies (SITRAN, regional authorities)
• Data protection authorities (investigations)

6.3 Official Integrations

• SITRAN: Livestock traceability data exchange as required by regulation
• Regional Bodies: Reporting of aggregated statistical data
• Official Veterinarians: Health information when required

7. Data Security

We implement appropriate technical and organisational measures to protect your data:

7.1 Technical Measures

• Encryption: AES-256 at rest, TLS 1.3 in transit
• Authentication: Strong passwords, optional 2FA
• Access Control: Principle of least privilege
• Monitoring: 24/7 intrusion detection
• Backups: Encrypted backups every 15 minutes
• Segregation: Data separated by client

7.2 Organisational Measures

• Training: Staff trained in data protection
• Policies: Internal security policies
• Audits: Quarterly security audits
• Incident Management: Response procedures
• Confidentiality: Confidentiality agreements

7.3 Certifications and Compliance

7.4 Breach Notification

In the event of a security breach affecting your data:

• We will notify the supervisory authority within 72 hours
• We will inform you directly if there is a high risk to your rights
• We will take immediate steps to mitigate the impact
• We will investigate the cause and implement improvements

8. Your Rights as Data Subject

Under GDPR, you have the following rights:

8.8 How to Exercise Your Rights

Information required to exercise rights:

• Full name and email associated with the account
• Copy of identity document (to verify identity)
• Specific description of the right you wish to exercise
• Additional documentation if acting on behalf of a third party

9. Data Retention

We retain your data for the following periods:

9.1 Secure Deletion

At the end of retention periods:

• Data is deleted securely and irreversibly
• Cryptographic erasure is used for encrypted data
• Backups are overwritten multiple times
• A destruction certificate is generated when required

10. International Transfers

10.1 Server Locations

• Main Server: Frankfurt, Germany (AWS EU-Central-1)
• Secondary Backup: Dublin, Ireland (AWS EU-West-1)
• CDN: Multiple EU locations (Cloudflare EU)

10.2 Future Exceptions

If we were to transfer data outside the EU in the future, we would implement the following safeguards:

• European Commission adequacy decisions
• EU-approved standard contractual clauses
• Binding corporate rules (BCR)
• Recognised certifications (Privacy Shield successors)

In any case, we would notify you at least 30 days in advance of any change in the location of data processing.

11. Cookies and Similar Technologies

We use cookies and similar technologies. For detailed information, see our Cookie Policy.

11.1 Cookie Summary

11.2 Cookie Management

You can manage your cookie preferences:

• Through our cookie settings panel
• By configuring your web browser
• By contacting us at any time

12. Minors

Our services are directed at livestock sector professionals and businesses. We do not knowingly collect personal data from individuals under 16 years of age.

12.1 Policy on Minors

• Parental consent required for users aged 13–15
• Registration prohibited for those under 13
• Immediate deletion if we detect minors' data without consent
• Additional verification for suspicious accounts

12.2 If We Detect Minors' Data

If we discover we have collected data from a minor without parental consent:

• We will immediately suspend the account
• We will contact the parents/guardians
• We will delete all the minor's data
• We will strengthen our verification processes

13. Changes to this Policy

13.1 Update Process

We may update this policy occasionally. For significant changes:

• Advance notice: Minimum 30 days
• Personal email: To all registered users
• Platform notice: Visible banner in the application
• Versioning: We maintain a version history

13.2 Types of Changes

13.3 Your Response to Changes

In response to significant changes, you may:

• Continue using the service (tacit acceptance)
• Modify your privacy settings
• Exercise your right to object or restrict
• Cancel your account if you disagree

14. Contact Information

14.1 Office Hours

• DPO Queries: Mon–Fri 9:00–18:00 CET
• General Support: 24/7 (email), Mon–Fri 8:00–20:00 (phone)
• Security Emergencies: 24/7

14.2 Available Languages

We can handle enquiries in:

• Spanish: Full (primary language)
• Galician: Full
• English: Technical and legal queries
• Other languages: Enquire about availability

14.3 Supervisory Authorities