Data Protection Notice and Privacy Policy

Auxinex FlexCo. (hereinafter “AUXINEX” or "Company" or “We” or "Our" or “Us”) welcomes you to our internet pages and mobile applications (together also referred to as “Online Offers” ). We thank you for your interest in our company and our products & services.

1. Introduction

We respect your privacy and processes personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) where applicable.

This Privacy Notice explains how we collect, use, disclose, protect and retain personal data when you visit our website, register for or use the Platform, communicate with us, participate in our services or enter into a transaction with us.

This Notice concerns personal data. It does not mean that all information relating to an asset, farm, installation or business is personal data, although such information may qualify as personal data when it relates to an identified or identifiable individual.

2. Data Controller and Contact Details

The controller responsible for the processing described in this Notice is AUXINEX.

If a separate controller is responsible for a particular processing activity, or if we act as a processor on behalf of another organization, the applicable relationship and responsibilities will be determined by the relevant arrangement and applicable law.

3. Categories of Personal Data We Process

3.1 Account and identification data

Depending on the service, we may process your name, username, email address, telephone number, account credentials or authentication records, country, language, organization, role, professional affiliation and account status. Where identity verification is required, we may also process identity-verification results and supporting information or documents necessary for that process.

3.2 Asset and operational data

We may process information relating to registered assets, including locations, coordinates, map boundaries or polygons, land or installation characteristics, crop or asset types, operational periods, harvest or yield records, supporting documents and information concerning ownership, control or authorization. Such information may relate to individuals, businesses, cooperatives or other organizations.

3.3 Transaction and payment information

Where payments or other transactions are available, we may process transaction references, payment status, amounts, currencies, invoices, billing details, refunds and records required for accounting, fraud prevention or legal compliance. Full payment-card details and bank-account credentials are intended to be handled by the relevant payment provider rather than stored by us on the Platform.

3.4 Communications and support information

We may process information you provide through contact forms, support requests, email, onboarding communications, feedback, complaints or other interactions with us. This may include the content of your message and information reasonably necessary to respond.

3.5 Technical and usage data

When you visit or use the Platform, we may process technical information such as IP address, timestamps, requested pages or resources, device and browser information, operating system, authentication events, error logs, security events and information about how the Platform is used.

3.6 Referral, partner and performance data

Where applicable, we may process referral identifiers, invitation status, account attribution, onboarding progress, asset-submission status and other operational metrics associated with ambassadors, partners or organizational accounts. These records are used to administer the relevant relationship and assess service performance.

3.7 Information from other sources

Where lawful and relevant, we may receive information from authorized cooperatives, partners, service providers, public sources, mapping or remote-sensing providers, identity-verification providers, payment providers or other sources. We take reasonable steps to ensure that such information is handled in accordance with applicable law.

4. Purposes and Legal Bases of Processing

We process personal data only where an applicable legal basis permits the processing. Depending on the circumstances, the legal basis may be the performance of a contract or steps requested before entering into a contract, compliance with a legal obligation, our legitimate interests, or your consent.

4.1 Account administration and service delivery

We process relevant data to create and administer accounts, authenticate users, provide the Platform, manage registered assets, respond to requests, provide reports and insights, administer transactions and deliver requested services. The legal basis is generally the performance of a contract or steps taken at your request before entering into a contract.

4.2 Identity verification, asset review and fraud prevention

We may process relevant information to verify identity or authority, review asset submissions, identify inconsistencies, prevent duplicate or fraudulent claims, protect accounts and assess whether information is suitable for a requested service. The legal basis may be contractual necessity, compliance with a legal obligation or our legitimate interests in protecting the Platform and its users, depending on the activity.

4.3 Monitoring, analytics and service improvement

We may process relevant asset and operational information to generate agricultural or environmental insights, assess data quality, operate monitoring services, improve our models and systems, investigate technical issues and develop our services. Where personal data is involved, the legal basis will depend on the particular activity and may include contractual necessity or legitimate interests. Where consent is legally required, we will obtain it separately.

4.4 Payments, accounting and legal compliance

We process relevant transaction and account information to administer payments, reconcile transactions, handle refunds and disputes, maintain required business records, respond to lawful requests and comply with legal obligations. The legal basis may be contractual necessity or compliance with a legal obligation.

4.5 Communications and support

We use contact and communication data to respond to enquiries, provide support, investigate complaints and manage our relationship with users and partners. The legal basis may be contractual necessity or our legitimate interests in handling enquiries and maintaining effective operations.

4.6 Marketing and promotional communications

We may use business contact information for permitted communications about our services where applicable law allows this. Where consent is required, we will obtain it before sending the relevant communications. You may object to direct marketing or withdraw consent at any time, as applicable. We do not treat general registration or acceptance of this Privacy Notice as consent to all marketing activities.

4.7 Security and protection of rights

We may process relevant information to detect security incidents, prevent misuse, enforce our terms, establish or defend legal claims and protect the rights, property and safety of the Company, users and other parties. The legal basis may be compliance with legal obligations or our legitimate interests, as applicable.

5. Asset Data, Environmental Data and Permissions

The Platform may process asset locations, boundaries, crop or installation information, operational records and other data used to assess or monitor environmental or agricultural characteristics. Some of this information may be derived from satellite observations, weather sources, maps, analytical models or third-party datasets rather than directly from you.

We process such information to provide the relevant services, assess data quality, maintain asset records, generate insights and evaluate potential environmental outcomes. Processing does not mean that we acquire ownership of your land, installation or original data. Rights in submitted information remain subject to applicable law, existing rights and the relevant service terms.

You must be authorized to submit personal data and supporting information relating to other people, landholders, organizations or assets. Where a particular use requires consent or another specific authorization, that requirement must be addressed separately. We may request further evidence or restrict processing where the required rights or permissions are unclear.

Environmental or agricultural outputs may be estimated, experimental, incomplete or subject to revision. This Privacy Notice explains data processing and does not guarantee the availability, accuracy or delivery of any report, monitoring result or environmental credit.

6. Recipients and Disclosure of Personal Data

We disclose personal data only where necessary for the purposes described in this Notice, where an appropriate legal basis exists, or where disclosure is required or permitted by law. Depending on the service, recipients may include:

• Hosting, cloud infrastructure, software and technical support providers;
• Identity-verification, authentication and security providers;
• Payment processors and providers supporting transaction administration;
• Mapping, satellite, weather, analytics and other data providers;
• Authorized cooperatives, partners or representatives where access is necessary for onboarding or delivery of the relevant service;
• Professional advisers, auditors, insurers or other service providers where necessary and lawful;
• Courts, regulators, public authorities or law-enforcement bodies where legally required or permitted.

Access by partners, cooperatives or representatives is limited to the information and purposes appropriate to their authorized role. We do not assume that every partner is entitled to access all information associated with an account or asset.

Service providers processing personal data on our behalf are subject to appropriate contractual and legal requirements. Where another organization acts as an independent controller, its own privacy notice and responsibilities may also apply.

7. International Data Transfers

Some service providers or recipients may process personal data outside Austria or the European Economic Area (EEA), including in countries where data-protection laws may differ. Where the GDPR applies, we make such transfers only in accordance with applicable legal requirements.

Depending on the circumstances, a transfer may rely on an adequacy decision, appropriate safeguards such as standard contractual clauses, or another lawful transfer mechanism. Information about relevant safeguards may be requested from us using the contact details in this Notice.

8. Retention of Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including service delivery, account administration, security, dispute handling and compliance with legal obligations. The appropriate retention period depends on the type of data, the service involved, applicable legal requirements and whether information is needed to establish or defend legal claims.

Technical security logs may be retained for a limited period appropriate to their operational purpose. Records that must be retained for accounting, tax, contractual or other legal purposes may be kept for the applicable statutory period. Where data is no longer required, it will be deleted or irreversibly anonymized, subject to technical and legal limitations.

Specific retention periods may differ between account information, asset records, transaction documents, support communications and technical logs. Where a fixed period is used for a particular category, it should be stated in the applicable service documentation or internal retention schedule.

9. Cookies and Similar Technologies

Our website and Platform may use cookies or similar technologies to maintain essential functionality, remember preferences, protect accounts, measure service performance or support analytics and marketing. The technologies actually used depend on the services enabled on the relevant website or application.

Strictly necessary technologies may be used where required to provide a service you request or to ensure security and functionality. Non-essential analytics, advertising or tracking technologies will be used only where the required consent has been obtained. Where consent is required, you can refuse non-essential technologies without being forced to accept them as a condition of accessing unrelated services.

You can manage your preferences through the website's cookie settings where available. You may change or withdraw consent for future processing at any time. Blocking certain technologies through your browser may affect some functions.

The cookie notice or consent manager should identify the actual technologies, purposes, providers and relevant retention periods used on the website. The presence of a tool in a previous version of this Notice does not mean that it is currently active.

10. Third-Party Websites and Embedded Services

The website or Platform may contain links to third-party websites or embed external content and services. When you interact with those services, the relevant provider may collect or receive information under its own privacy notice and terms. We do not control independent third-party processing.

Where an embedded service or external connection requires consent under applicable law, it should not be activated before the required consent is obtained. Please consult the relevant provider's privacy notice for information about its processing.

11. Data Security

We implement technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure and unauthorized access. Measures may include access controls, authentication, secure communications, backups, monitoring and procedures for handling security incidents.

No system or method of transmission can be guaranteed to be completely secure. We review and improve our safeguards in light of technical developments, the nature of the data processed and the risks involved. Users must protect their credentials and promptly report suspected account compromise or unauthorized disclosure.

12. Your Data Protection Rights

Subject to applicable law and any relevant limitations, you may have the right to:

• Request access to your personal data and information about its processing;
• Request correction of inaccurate or incomplete personal data;
• Request deletion of personal data where the legal requirements are met;
• Request restriction of processing in the circumstances provided by law;
• Receive certain data you provided in a structured, commonly used and machine-readable format and, where applicable, request its transmission to another controller;
• Object to processing based on legitimate interests, on grounds relating to your particular situation, where the legal conditions are met;
• Object at any time to processing for direct marketing;
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Not be subject to a decision based solely on automated processing where the applicable legal protections provide that right.

These rights are not absolute and may be subject to legal conditions or exceptions. For example, some information may need to be retained to comply with legal obligations or to establish, exercise or defend legal claims.

To exercise your rights, contact us using the details in Section 2. We may request information reasonably necessary to verify your identity before responding.

13. Complaints to the Supervisory Authority

If you believe that our processing of your personal data infringes applicable data protection law, you may lodge a complaint with a competent supervisory authority. In Austria, the supervisory authority is the Austrian Data Protection Authority (Datenschutzbehörde).

Website: https://www.dsb.gv.at/

14. Children

Our services are not directed at children. Users must meet the applicable age and legal-capacity requirements for the service they use. Where personal data concerning a child is submitted, it must be provided only where lawful and with any authorization required by applicable law.

15. Changes to This Privacy Notice

We may update this Notice to reflect changes in our services, data-processing activities, technology or legal requirements. The current version will be published on the website with its effective date. Where required by law, we will provide additional information or obtain consent for new processing activities.

A change to this Notice does not itself constitute consent to processing where consent is legally required.