AcreAtlas is a precision agriculture platform. We take your data seriously — and not in the usual corporate way. Your field data is yours. We process it to run the service and improve your experience; we do not sell it, we do not build profiles for advertisers, and we do not share it with third parties unless you have authorised it or law requires it.
1. Who We Are
AcreAtlas is operated as a sole proprietorship trading under the names AcreAtlas / AkkerAtlas, registered with the Dutch Chamber of Commerce under number 99197081, and is the data controller for the personal data described in this Policy. (Note: the controller will be replaced by Acreatlas B.V. once incorporated and the relevant transfer formalities are completed.)
Company: AcreAtlas
Contact: info@acreatlas.eu
KvK number: 99197081
Registered address: as registered with the Chamber of Commerce (KvK 99197081)
If you have a question about this Policy, your data, or how to exercise your rights, contact us at the address above. We aim to respond within 5 business days.
2. What Data We Collect and Why
We collect only data that is necessary to provide you with the Platform and to comply with our legal obligations. The table below sets out each category.
| Category | Examples | Why we collect it | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Account data | Name, email address, company name, phone number | To create and manage your account; to contact you about your service | Performance of contract (Art. 6(1)(b)) |
| Field data | Field boundary coordinates, GPS data, crop type, growth stage records | To generate Spray Maps, Orthomosaics, and compliance reports for you | Performance of contract (Art. 6(1)(b)) |
| Drone imagery | Aerial images uploaded to the Platform, orthomosaics, NDVI data | To process and generate your Spray Maps and field analytics | Performance of contract (Art. 6(1)(b)) |
| Spray & application records | Spray Map exports, application dates, product records | To generate compliance reports; for your own audit trail | Performance of contract (Art. 6(1)(b)); Legal obligation (Art. 6(1)(c)) where applicable |
| Usage data | Pages visited, features used, session timestamps, error logs | To improve the Platform; to diagnose technical issues | Legitimate interest (Art. 6(1)(f)) — improving service reliability |
| Payment data | Invoice details, payment method (processed by payment provider) | To process payments for Platform subscriptions | Performance of contract (Art. 6(1)(b)) |
| Communications | Emails and messages you send us; support requests | To respond to your questions and support requests | Legitimate interest (Art. 6(1)(f)) — customer support |
| Cookie data | Session cookies, analytics cookies (see Cookie Policy) | Platform functionality; usage analytics | Consent (Art. 6(1)(a)) for non-essential cookies; Legitimate interest for strictly necessary |
3. Your Field Data — You Stay in Control
Field boundaries, drone imagery, crop records, and spray records are your data. We hold one firm principle on this:
We do not sell your field data. We do not share your identifiable field data with third parties for commercial purposes without your consent and interest. We do not use your data to build profiles for advertisers. Your data is processed to run and improve the service for you — nothing else.
Specifically:
- We process your Field Data only to provide Platform services to you — generating Spray Maps, processing imagery, and producing compliance reports.
- We use data for model training only after applying technical and organisational measures intended to render the data anonymous, including removal of direct identifiers, stripping of GPS metadata where appropriate, boundary cropping, aggregation, and exclusion of data that can reasonably be linked back to an identifiable person or individual farm. Where data cannot be sufficiently anonymised, we will treat it as personal data and process it only where a valid GDPR legal basis applies.
- If you use a third-party agronomist, spray contractor, or other professional through or alongside the Platform, you control whether and how your data is shared with them. We will not share your data with such parties without your authorisation.
- We do not transfer your personal data outside the European Economic Area (EEA) unless appropriate safeguards are in place (see Section 7).
4. Who We Share Your Data With
We do not sell your data. We share it only in the following circumstances:
4.1 Sub-processors (technical service providers)
To operate the Platform, we use third-party technical service providers ('sub-processors') who process your data on our behalf and under our instructions. These are contractually bound to protect your data and use it only for the purposes we specify. Our current sub-processors include:
| Service | Provider | Purpose | Location |
|---|---|---|---|
| Cloud hosting / infrastructure | Microsoft Azure (Microsoft Ireland Operations Ltd) | Storing and processing Platform data | European economic area |
| Email delivery | Microsoft 365 (Microsoft Ireland Operations Ltd) — transactional email via the founder's M365 mailbox | Sending transactional emails (account notifications) | European economic area |
| Payment processing | None (invoicing handled manually by AcreAtlas; no third-party payment processor) | Processing subscription payments | European economic area |
| Analytics | None (no third-party analytics; only first-party server logs) | Platform usage analytics | European economic area |
We will update this list when we add new sub-processors. If you have a Data Processing Agreement with us, we will notify you of material sub-processor changes as required by that agreement.
AcreAtlas uses Firebase Authentication (Google LLC) as its identity layer. You can sign in with a Google account, with a Microsoft (Entra) account, or with a one-time code sent to your email address. The identity layer receives only the minimum identifiers required to authenticate you (email address and profile identifier) and does not receive Field Data. If you enable two-factor authentication, your mobile phone number is processed to deliver the SMS verification code. Signing in with a Google or Microsoft account involves a transfer of authentication metadata to the United States under the EU–US Data Privacy Framework. The Platform also offers optional integrations with DJI Cloud (drone mission planning) and John Deere Operations Center (prescription map delivery to compatible tractors); these are third-party services activated only when the User configures them, are governed by the User's own agreement with those providers, and AcreAtlas transmits only the data strictly necessary for the requested integration. None of these third parties receive Field Data beyond what is needed for the specific function the User has requested.
4.2 Legal requirements
We may disclose your data to a competent authority (including the Autoriteit Persoonsgegevens, courts, or other regulators) where we are legally required to do so, or where necessary to protect our legal rights or the safety of others. We will tell you if this happens unless we are legally prohibited from doing so.
4.3 Business transfers
If AcreAtlas is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.
5. How Long We Keep Your Data
| Data category | Retention period | Reason |
|---|---|---|
| Account data | Duration of account + 2 years after closure | To handle post-closure queries and legal claims |
| Field data (boundaries, imagery, records) | Duration of account. Deleted or returned within 30 days of written request after account closure. | Your active use of the service; you can request deletion at any time |
| Spray & compliance records | Duration of account + 7 years | Retained for the duration of the account and, where applicable, for such longer period as required by law or reasonably necessary for audit, dispute resolution, or compliance purposes. Users remain responsible for retaining their own legally required agricultural records. |
| Usage / analytics data | 24 months rolling, then anonymised | Service improvement; anonymised data retained indefinitely |
| Payment records | 7 years from transaction date | Dutch Belastingdienst bookkeeping requirements (Wet op de omzetbelasting) |
| Support communications | 3 years from last contact | To handle follow-up queries and disputes |
You can request deletion of your Field Data at any time — see Section 6. We may need to retain some data longer if required by law or for legitimate dispute resolution purposes.
6. Your Rights Under GDPR
Under the General Data Protection Regulation (GDPR / AVG) and Dutch data protection law, you have the following rights:
| Right | What it means | How to exercise it |
|---|---|---|
| Access (Art. 15) | You can ask for a copy of the personal data we hold about you. | Email info@acreatlas.eu — we respond within 30 days |
| Rectification (Art. 16) | You can ask us to correct inaccurate or incomplete data. | Email or correct it directly in your account settings |
| Erasure (Art. 17) | You can ask us to delete your personal data. We will do so unless we have a legal obligation to retain it. | Email info@acreatlas.eu — we act within 30 days |
| Portability (Art. 20) | You can ask for your Field Data in a structured, commonly used, machine-readable format. | Email info@acreatlas.eu — we provide in standard machine-readable formats: PNG/GeoTIFF (imagery), ISOXML or .SHP (prescription maps), KML (boundaries), CSV (tabular records) |
| Restriction (Art. 18) | You can ask us to pause processing your data in certain circumstances. | Email info@acreatlas.eu |
| Objection (Art. 21) | You can object to processing based on legitimate interest. We will stop unless we have compelling grounds. | Email info@acreatlas.eu |
| Withdraw consent (Art. 7) | Where processing is based on consent (e.g., marketing emails), you can withdraw at any time. | Unsubscribe link in emails, or contact us |
We do not charge for exercising your rights and will respond within 30 days. If your request is complex, we may extend this by a further 60 days and will notify you.
If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch data protection authority:
Autoriteit Persoonsgegevens (AP)
autoriteitpersoonsgegevens.nl | Tel: +31 70 888 8500
7. International Data Transfers
We aim to process and store all personal data within the European Economic Area (EEA). Where any sub-processor operates outside the EEA, we ensure appropriate safeguards are in place, such as European Commission Standard Contractual Clauses (SCCs) or adequacy decisions. Details of applicable safeguards are available on request.
8. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encrypted data storage and transmission (TLS/HTTPS), access controls and authentication, and regular security reviews.
Where we act as controller, we will notify the Autoriteit Persoonsgegevens and affected individuals where required by the GDPR (in principle within 72 hours of becoming aware of a breach that is likely to result in a risk to rights and freedoms). Where we act as processor on behalf of a customer, we will notify the customer in accordance with the applicable Data Processing Agreement so that the customer can assess its own notification obligations.
9. Cookies
Our Cookie Policy provides further information about the cookies and similar technologies used on our website and Platform, including their purposes, retention periods, and how users can manage their preferences. The Cookie Policy is available at acreatlas.eu/cookies. Strictly necessary cookies are placed automatically to make the site work; analytics and other non-essential cookies are placed only with your consent.
10. Children
The Platform is intended for use by agricultural businesses and professionals. We do not knowingly collect personal data from persons under 18 years of age. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 30 days before they take effect. The current version is always available at acreatlas.eu/privacy. Your continued use of the Platform after the effective date of a revised Policy constitutes acceptance of those changes.
12. Contact and Complaints
For any questions, data requests, or complaints about this Privacy Policy or our data practices:
AcreAtlas | KvK 99197081 | info@acreatlas.eu
If you are not satisfied with our response, you can contact the Autoriteit Persoonsgegevens at autoriteitpersoonsgegevens.nl.