Privacy Policy
AgriSmart Technologies d.o.o. — v1.4, april 2026
PRIVACY POLICY
AVA Service — Agricultural Virtual Assistant
Version 1.3 | Effective date: April 2026
1. Introduction
AgriSmart Technologies d.o.o. (hereinafter: “we” or the “Provider”) is committed to protecting the privacy of individuals who use the AVA service. This privacy policy describes which personal data we collect, why and how we process it, to whom we disclose it, and what rights an individual has.
The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/2018), as well as other applicable data protection regulations.
2. Data controller
AgriSmart Technologies d.o.o., Savska cesta 32, 10000 Zagreb, Croatia
OIB: 67486966460 | MBS: 081398320
Contact email for privacy questions: ava@avaolo.com
3. What data is collected
3.1 Identification and contact data
first and last name;
phone number;
email address (optional);
country.
3.2 Location and farming operation data
GPS coordinates of the farm and agricultural land;
plot identifiers (ARKOD — Croatia, GERK — Slovenia);
settlement, municipality, address;
IP address (for approximate location determination);
crop types and varieties by plot;
records of materials (fertilizers, PPP, seed, fuel) — procurement, stock, consumption;
records of agricultural activities with dates, doses, and plots;
records of equipment and resources;
yield and harvest records;
events and reminders in the calendar.
3.3 Data from documents
uploaded files (PDFs, images of support applications, supplier invoices, etc.), stored on Amazon S3;
structured data extracted from documents;
document metadata (type, upload date, extraction confidence level).
3.4 Conversations with AVA
the complete conversation history between the User and AVA;
timestamps and message metadata;
photos of plants or the farm that the User uploads for diagnostics.
3.5 Technical and system data
IP address;
browser and device type;
session tokens (Redis, without permanent storage in the database);
system logs (records of activity in the application for security, troubleshooting, and service improvement purposes).
4. Purpose and legal basis for processing
4.1 Performance of a contract (Art. 6(1)(b) GDPR)
providing farm records, agronomic advice, and document processing;
personalization of AVA based on the User’s farm data.
4.2 Legitimate interests of the Provider (Art. 6(1)(f) GDPR)
Based on legitimate interests, we process data for the following purposes:
Improving the AVA service and developing new functionalities: we analyze usage patterns, conversations, and agronomic results to improve the artificial intelligence model and advisory algorithms.
Training and adapting AVA’s internal AI models: conversations and agricultural data may be used exclusively to adapt and improve AVA’s own (internal) models, with the data pseudonymized before being used for this purpose. This data is not provided to external AI providers for the purpose of training their models.
Internal business analytics: we analyze aggregated patterns of agricultural input consumption, yields, and practices for the purpose of planning service development.
Preventing misuse and ensuring system security.
Direct marketing and commercial opportunities: through the AVA service we may provide you with relevant offers of agricultural inputs, services, and opportunities to participate in agricultural trials. The Provider identifies relevant Users based on farm data (crop type, region, scale) and contacts them directly via AVA. User data is not disclosed to third parties without consent. In accordance with Art. 21 GDPR, the User has the right to object to this type of processing at any time via Settings → Privacy → Commercial notifications, which will be immediately respected without affecting access to the service.
Aggregated data analytics and market analyses: from User data we produce exclusively aggregated and anonymized analyses (e.g., regional crop trends, agricultural input consumption, market conditions). These analyses do not contain any data that would enable identification of an individual farmer or farm, and we may share or commercialize them with third parties. The Provider does not sell or share individual personal or agricultural data of Users with third parties without the User’s explicit consent.
When pursuing legitimate interests, we carried out a balancing test and assessed that these purposes do not override the fundamental rights and freedoms of individuals, taking into account the nature of the data, the reasonable expectations of farmers who entered data into the management system, and the implemented safeguards (pseudonymization, encryption, access restriction).
4.3 Legal obligations (Art. 6(1)(c) GDPR)
retention of documents and data to the extent and for the period required by applicable law.
4.4 Consent (Art. 6(1)(a) GDPR)
Marketing messages by email or SMS, when the User explicitly opts in.
Providing the User’s farm profile to selected third parties (input suppliers, research institutions, organizers of agricultural trials) — exclusively on the basis of the User’s explicit prior consent for each individual case.
5. Profiling and automated decision-making
AVA analyzes data about your farm (crops, location, agronomy, previous activities) for the purpose of personalizing agronomic recommendations. This constitutes profiling within the meaning of Art. 4(4) GDPR.
We emphasize that AVA recommendations do not constitute automated decision-making with effects on the User within the meaning of Art. 22 GDPR. All recommendations are informational support only — the final decision is made by the User. No AVA service triggers automatic legal or economic consequences for the User.
The User has the right to object to profiling in accordance with Art. 21 GDPR, which does not affect the basic functioning of the service.
6. Disclosure of data to third parties
6.1 Artificial intelligence providers — data processors
For the provision of agronomic advice and document processing, messages and relevant agricultural data of the User are provided to the following artificial intelligence model providers, who act as contractual data processors:
OpenAI, LLC (GPT models) — for intent classification, data extraction, and advice;
Anthropic, PBC (Claude models) — for document processing and certain advisory functions;
Meta Platforms Ireland Limited (WhatsApp Business Platform) — for processing messages via the WhatsApp integration.
Data processing agreements (DPAs) have been concluded with the above providers to ensure an appropriate level of data protection. These providers may not use the data for their own purposes, including training their own models, except to the extent permitted by the applicable DPAs. To the best of our knowledge and in accordance with the concluded agreements, the providers do not use User data beyond this scope. The Provider regularly checks the compliance of contractual partners with these requirements. Data provided to AI providers is also subject to their own privacy policies.
6.2 Infrastructure providers and data storage
Data is stored and processed within the following infrastructure systems:
Amazon Web Services (AWS), EU region — primary database (PostgreSQL/RDS), file storage (S3), cache (ElastiCache/Redis), and application hosting (ECS Fargate). AWS acts as a contractual data processor under a concluded DPA.
Pinecone — a vector database that stores vector representations (embeddings) of agricultural data and documents for semantic search and agronomic advice purposes. Pinecone acts as a contractual data processor. Data is stored in the EU region.
6.3 Business communication systems
Google Workspace (Google LLC) is used for the Provider’s business email and internal communications. Emails that Users send to ava@avaolo.com are processed via the Google Workspace infrastructure. Google acts as a contractual data processor under a concluded DPA.
6.4 Payment provider
Payment transactions are processed by Stripe, Inc. The Provider does not have access to the User’s payment card data.
6.5 Third parties based on consent
The User’s farm profile (including data on crops, location, and farm scale) is provided to third parties (agricultural input suppliers, research institutions, organizers of agricultural trials) exclusively on the basis of the User’s prior explicit consent for each individual case. The consent collection process will clearly identify the data recipient and the purpose of disclosure.
6.6 Public authorities
We will disclose data to public authorities exclusively on the basis of a lawful court or administrative order or when required by law.
7. Data transfers outside the EU
OpenAI and Anthropic are headquartered in the United States, and Meta Platforms operates through its Irish branch (EEA). The transfer of personal data to third countries (USA) is carried out on the basis of Standard Contractual Clauses (SCC) in accordance with Art. 46 GDPR.
8. Data security
We take the following technical and organizational measures to protect your data:
all data is encrypted in transit (HTTPS/TLS);
all data is encrypted at rest (AWS-managed encryption);
access to data is limited to authorized employees of the Provider;
administrator access is separately authenticated and logged;
regular security assessments and testing.
9. Data retention
We retain data only for as long as necessary for the purposes for which it was collected and in accordance with legal requirements:
Agricultural and operational data (plots, activities, materials, yields): for the duration of the subscription and 24 months after the subscription expires or is terminated.
Conversation data (chat logs with AVA): for the duration of the subscription and 24 months after expiry.
Uploaded documents (S3): for the duration of the subscription and 24 months after expiry.
Account and identification data: 24 months after subscription expiry or account deletion.
System logs: up to 12 months.
Session tokens (Redis): expire automatically (short TTL).
The User has the right to request immediate deletion of data before the end of the retention period, in accordance with the rights under Art. 17 GDPR. In cases where applicable law requires mandatory longer retention, that obligation takes precedence.
After the retention period expires, we permanently delete the data or effectively anonymize it.
10. Individual rights
In accordance with the GDPR, you have the following rights:
Right of access (Art. 15): you may request a copy of your personal data that we process.
Right to rectification (Art. 16): you may request correction of inaccurate data or completion of incomplete data.
Right to erasure (Art. 17): you may request immediate deletion of your data. The request will be fulfilled within 30 days, unless legislation requires longer retention.
Right to restriction of processing (Art. 18): you may request restriction of processing in certain cases.
Right to data portability (Art. 20): you may request delivery of your data in a structured, machine-readable format (JSON or CSV format) for transfer to another provider.
Right to object (Art. 21): you may object to processing based on legitimate interests, including profiling and direct marketing. The objection will be respected without affecting access to the service.
Right to withdraw consent: you may withdraw consent (e.g., for disclosure of data to third parties) at any time, without affecting the lawfulness of processing before withdrawal.
Send a request to exercise your rights to ava@avaolo.com. We will respond to the request within 30 days.
If you believe the GDPR is being violated, you have the right to lodge a complaint with a supervisory authority. In Croatia, the competent authority is the Personal Data Protection Agency — AZOP (azop.hr). Users from Slovenia may contact the Information Commissioner (ip-rs.si).
11. Cookies and tracking
The AVA service uses cookies and similar technologies to a limited extent for the technical functioning of the service (session, authentication). We do not set third-party advertising or analytics cookies without your consent. The cookie policy will be updated in the event additional tracking technologies are introduced.
12. Changes to the privacy policy
We may update this privacy policy from time to time. The User will be notified of material changes by email or via an in-app notification before they take effect. The date of the last update is stated at the top of this document.
13. Contact
For questions related to privacy or exercising rights:
Email: ava@avaolo.com
AgriSmart Technologies d.o.o., Savska cesta 32, 10000 Zagreb, Croatia
AgriSmart Technologies d.o.o. — Privacy Policy, version 1.3, April 2026.