Политика за поверителност
AgriSmart Technologies d.o.o. — v1.0, april 2026
PRIVACY POLICY
AVA Service — Agricultural Virtual Assistant
Version 1.0 | Effective date: 6 September 2026
1. Introduction
AgriSmart Technologies d.o.o. (hereinafter: »we« or the »Provider«) is committed to protecting the privacy of the individuals who use the AVA service. This privacy policy describes which personal data we collect, why and how we process it, to whom we disclose it and what rights the individual has.
Personal data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and the Croatian Act implementing the General Data Protection Regulation (NN 42/2018) and other applicable data protection rules.
2. The controller of personal data
AgriSmart Technologies d.o.o., Savska cesta 32, 10000 Zagreb, Croatia
OIB: 67486966460 | MBS: 081398320
Contact e-mail for privacy questions: ava@avaolo.com
3. Which data is collected
3.1 Identification and contact data
first name and surname;
telephone number;
e-mail address (optional);
country.
3.2 Location and farming data
GPS coordinates of the farm and of agricultural areas;
parcel identifiers (ARKOD — Croatia, GERK — Slovenia);
settlement, municipality, address;
IP address (for approximate location);
crop types and varieties by parcel;
material records (fertilisers, plant protection products, seed, fuel) — purchase, stock, use;
records of agricultural activities with dates, doses and parcels;
records of equipment and machinery;
records of yields and harvest;
events and reminders in the calendar.
3.3 Data from documents
uploaded files (PDFs, images of subsidy applications, supplier invoices and similar), stored on Amazon S3;
structured data extracted from documents;
document metadata (type, upload date, confidence level of the extraction).
3.4 Conversations with AVA
the entire history of conversations between the User and AVA;
timestamps and message metadata;
photographs of plants or of the farm which the User uploads for diagnosis.
3.5 Technical and system data
IP address;
browser and device type;
session tokens (Redis, without permanent storage in the database);
system logs (records of activity in the application for the purposes of security, fault correction and improvement of the service).
4. The purpose and legal basis of processing
4.1 Performance of the contract (Article 6(1)(b) GDPR)
providing agricultural records, agronomic advice and document processing;
personalisation of AVA on the basis of data about the User's farm.
4.2 The Provider's legitimate interests (Article 6(1)(f) GDPR)
On the basis of legitimate interests we process data for the following purposes:
Improving the AVA service and developing new functionality: we analyse patterns of use, conversations and agronomic results in order to improve the artificial intelligence models and the advisory algorithms.
Training and adapting AVA's internal AI models: conversations and agricultural data may be used solely to adapt and improve AVA's own (internal) models, and the data is pseudonymised before being used for that purpose. That data is not supplied to external AI providers for the training of their models.
Internal business analytics: we analyse aggregated patterns of agricultural input use, yields and practices for the purpose of planning the development of the service.
Preventing misuse and securing the system.
Analytics of aggregated data and market analyses: from the User's data we produce solely aggregated and anonymised analyses (for example regional crop trends, use of agricultural inputs, market conditions). Those analyses contain no data that would allow an individual farmer or farm to be identified, and we may share or commercialise them with third parties. The Provider does not sell or share an individual User's personal or agricultural data with third parties without the User's express consent.
In pursuing these legitimate interests we carried out a balancing test and concluded that these purposes do not override the fundamental rights and freedoms of individuals, taking into account the nature of the data, the reasonable expectations of farmers who entered data into a management system, and the safeguards implemented (pseudonymisation, encryption, restriction of access).
4.3 Legal obligations (Article 6(1)(c) GDPR)
keeping documents and data to the extent and for the period required by applicable legislation.
5. Profiling and automated decision-making
AVA analyses data about your farm (crops, location, agronomic practice, previous activities) in order to personalise agronomic recommendations. That constitutes profiling within the meaning of Article 4(4) GDPR.
We emphasise that AVA's recommendations do not constitute automated decision-making with effects on the User within the meaning of Article 22 GDPR. Every recommendation is solely informational support — the final decision is made by the User himself. No AVA service triggers automatic legal or economic consequences for the User.
The User has the right to object to profiling in accordance with Article 21 GDPR, which does not affect the basic functioning of the service.
6. Disclosure of data to third parties
6.1 Artificial intelligence providers — processors
In order to provide agronomic advice and document processing, the User's messages and relevant agricultural data are supplied to the following providers of artificial intelligence models, who act as contractual data processors:
OpenAI, LLC (GPT models) — for intent classification, data extraction and advice;
Anthropic, PBC (Claude models) — for document processing and some advisory functions;
Meta Platforms Ireland Limited (WhatsApp Business Platform) — for processing messages through the WhatsApp integration.
Data processing agreements (DPAs) have been concluded with these providers which ensure an appropriate level of data protection. Those providers must not use the data for their own purposes, including training their own models, except to the extent permitted by the applicable DPAs. To the best of our knowledge and in accordance with the agreements concluded, the providers do not use the User's data outside that scope. The Provider regularly checks the compliance of its contractual partners with these requirements. Data supplied to AI providers is also subject to their own privacy policies.
6.2 Infrastructure providers and data storage
Data is stored and processed within the following infrastructure systems:
Amazon Web Services (AWS), EU region — the primary database (PostgreSQL/RDS), file storage (S3), cache (ElastiCache/Redis) and application hosting (ECS Fargate). AWS acts as a contractual data processor on the basis of a concluded DPA.
Pinecone — a vector database storing vector representations (embeddings) of agricultural data and documents for the purposes of semantic search and agronomic advice. Pinecone acts as a contractual data processor. The data is stored in an EU region.
6.3 Business communication systems
Google Workspace (Google LLC) is used for the Provider's business e-mail and internal communications. E-mails Users send to ava@avaolo.com are processed through the Google Workspace infrastructure. Google acts as a contractual data processor on the basis of a concluded DPA.
6.4 Payment provider
Payment transactions are processed by Stripe, Inc. The Provider has no access to the User's payment card data.
6.5 Public authorities
We will disclose data to public authorities solely on the basis of a lawful judicial or administrative order or where the law requires it of us.
7. Transfers of data outside the EU
OpenAI and Anthropic are established in the United States of America, and Meta Platforms operates through an Irish branch (EEA). Transfers of personal data to third countries (the USA) are carried out on the basis of standard contractual clauses (SCC) in accordance with Article 46 GDPR.
8. Data security
We take the following technical and organisational measures to protect your data:
all data is encrypted in transit (HTTPS/TLS);
all data is encrypted at rest (AWS managed encryption);
access to data is restricted to authorised employees of the Provider;
administrator access is separately authenticated and logged;
regular security assessments and testing.
9. Data retention
We keep data only for as long as is necessary for the purposes for which it was collected and in accordance with legal requirements:
Agricultural and operational data (parcels, activities, materials, yields): for the duration of the subscription and 24 months after its expiry or termination.
Conversation data (chat logs with AVA): for the duration of the subscription and 24 months after expiry.
Uploaded documents (S3): for the duration of the subscription and 24 months after expiry.
Account and identification data: 24 months after the expiry of the subscription or the deletion of the account.
System logs: up to 12 months.
Session tokens (Redis): expire automatically (short TTL).
The User has the right to request the immediate deletion of data before the retention period expires, in accordance with the rights under Article 17 GDPR. Where applicable legislation prescribes mandatory longer retention, that obligation takes precedence.
When the retention period expires we permanently delete or effectively anonymise the data.
10. The rights of the individual
Under the GDPR you have the following rights:
The right of access (Article 15): you may request a copy of the personal data we process about you.
The right to rectification (Article 16): you may request the correction of inaccurate data or the completion of incomplete data.
The right to erasure (Article 17): you may request the immediate deletion of your data. The request will be met within 30 days, unless legislation prescribes longer retention.
The right to restriction of processing (Article 18): you may request a restriction of processing in certain cases.
The right to data portability (Article 20): you may request the delivery of your data in a structured, machine-readable form (JSON or CSV format) for transfer to another provider.
The right to object (Article 21): you may object to processing based on legitimate interests, including profiling. The objection will be upheld without affecting access to the service.
The right to withdraw consent: you may withdraw consent (for example to the use of your photographs for promotional purposes) at any time, without affecting the lawfulness of processing before the withdrawal.
Send a request to exercise a right to ava@avaolo.com. We will reply to the request within 30 days.
If you consider that we are in breach of the GDPR, you have the right to lodge a complaint with a supervisory authority. Our supervisory authority is the Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia
11. Cookies and tracking
The AVA service uses cookies and similar technologies to a limited extent for the technical functioning of the service (session, authentication). We do not set third-party advertising or analytics cookies without your consent. The cookie policy will be updated if additional tracking technologies are introduced.
12. Changes to the privacy policy
We may update this privacy policy from time to time. The User will be notified of material changes by e-mail or by a notice within the application before they take effect. The date of the last update is stated at the top of this document.
13. Contact
For questions about privacy or about exercising a right:
E-mail: ava@avaolo.com
AgriSmart Technologies d.o.o., Savska cesta 32, 10000 Zagreb, Croatia
AgriSmart Technologies d.o.o. — Privacy Policy, version 1.0, September 2026.