FarmSano Privacy Policy

The controller of the personal data of FarmSano Users is the Service Provider whose details are given below. For personal data matters, contact us at support@farmsano.eu or through the kontaktinę formą (topic "Personal data protection"). Capitalised terms have the meaning given in the Naudojimosi taisyklės.

• Account data: e-mail address, phone number, full name or company name, language, currency and notification settings;
• data from signing in with Google or Facebook: account identifier at the provider, first name, last name and e-mail address;
• content: Adverts, photos, descriptions of farms and pickup points (with address and location), messages, reviews, Reservations and notices;
• Sellers' billing data: invoice details (including tax ID), order and payment history, bank account number for payouts;
• location data: the location chosen by the User or, with consent given in the browser, taken from the device, and an approximate location derived from the IP address;
• technical data: IP address, device identifier, browser and system type, sign-in and security event history;
• content sent to artificial intelligence features: AI search queries, advert form content and attached photos;
• contact form data: name, e-mail address and message.

Providing data is voluntary, but some features cannot be used without certain data (for example you cannot sign in without an e-mail address or phone number, and you cannot order a Paid Service without invoice details).

• running the Account, publishing Adverts, messages, Reservations and reviews: Article 6(1)(b) GDPR (performance of a contract);
• providing Paid Services, payments, deposits and payouts: Article 6(1)(b) GDPR;
• issuing invoices and keeping accounting and tax records: Article 6(1)(c) GDPR (legal obligation);
• handling notices of illegal content, moderation decisions and appeals, and cooperation with authorities: Article 6(1)(c) GDPR in connection with the DSA;
• security of the Service, preventing abuse and fraud, protection against excessive requests, new sign-in alerts: Article 6(1)(f) GDPR (the Service Provider's legitimate interest);
• replying to contact form messages and handling complaints: Article 6(1)(b) or (f) GDPR;
• statistics and improving the Service, including the quality of search results: Article 6(1)(f) GDPR;
• establishing, pursuing and defending claims: Article 6(1)(f) GDPR;
• sending FarmSano news and promotions: Article 6(1)(a) GDPR (consent) and consent to receive commercial information by electronic means;
• showing Google maps: Article 6(1)(a) GDPR (consent in the slapukų nustatymuose).

We share data only as far as necessary for the purpose:

• with other Users: public data of Adverts and profiles (farm name, approximate location, description, photos), the first name or company name in messages, reviews and Reservations, and contact details according to their visibility settings;
• with the hosting and server infrastructure provider in the European Union: teikėjo pavadinimas bus papildytas;
• with the e-mail delivery provider: teikėjo pavadinimas bus papildytas;
• with the SMS gateway provider (sign-in codes and alerts): teikėjo pavadinimas bus papildytas;
• Stripe Payments Europe, Ltd. (Ireland): payment processing; for payment data Stripe acts as a separate controller;
• Google Ireland Limited (Ireland): Google maps after consent, address search and lookup (we send the address typed or the coordinates, without Account data) and signing in with Google;
• Meta Platforms Ireland Limited (Ireland): signing in with Facebook;
• with the address search and IP-based approximate location services used by the Service: ipwho.is, nominatim.openstreetmap.org, api.bigdatacloud.net;
• with artificial intelligence model providers, through the Service Provider's AI gateway: teikėjo pavadinimas bus papildytas;
• with accountants and legal and tax advisers, as needed to meet legal obligations;
• with public authorities, where required by law.

Entities processing data on behalf of the Service Provider do so under data processing agreements (Article 28 GDPR).

Some recipients (in particular Google, Meta, Stripe and artificial intelligence model providers) may process data outside the European Economic Area, including in the United States. Such transfers are based on a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified entities) or on standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), with additional safeguards where needed. You can obtain a copy of the safeguards by writing to support@farmsano.eu.

• Account data: for as long as the Account exists; after deletion, data is deleted or anonymised, except data we must keep longer;
• Adverts, profiles and reviews: while published and until deleted by the User or until the Account is deleted;
• messages and Reservations: for as long as the Account exists; after one party deletes their Account, the conversation remains available to the other party marked "Deleted account";
• invoices and billing documents: for 5 years from the end of the calendar year in which the tax payment deadline passed;
• content notices, moderation decisions, appeals, complaints and contact form messages: while they are being handled and then until the limitation period for claims expires;
• sign-in and security event history: for as long as needed for security and, in the event of an incident, until it is resolved;
• data processed on the basis of consent: until consent is withdrawn;
• data processed on the basis of legitimate interest: until an effective objection is made or the limitation period for claims expires.

You have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interest. You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it.

In the paskyros nustatymuose you can download a copy of your data, delete the Account and manage consents. For anything else, write to support@farmsano.eu. We reply without undue delay and within one month at the latest.

You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in the EU country where you live, work or where the infringement took place.

The Service stores and reads information on your device (cookies, browser local storage).

• Necessary: sign-in session, device identifier for Account protection and new sign-in alerts, safeguards for signing in with a link and with Google or Facebook, the chosen language, currency and location, the draft advert, the site theme and the record of your cookie choice. They are needed for the service you request and do not require consent.
• Functional (with consent): Google maps. Once enabled, your browser loads scripts and map tiles from Google servers, which receive your IP address and may store or read information on your device. Without consent you see a button to enable the map instead.

We do not use analytics or advertising cookies. If that changes, we will ask for your consent first.

You can change or withdraw your choice at any time in the slapukų nustatymuose (also linked in the page footer). You can also delete cookies in your browser settings.

We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you (Article 22 GDPR). The order of search results is set automatically based on distance, relevance, recency and promotion. The AI search interprets your query to select results. Automated tools may support content moderation, but decisions to remove content or restrict an Account are taken by a human.

The AI search, the advert form assistant and description suggestions send the text you type and attached photos to the Service Provider's AI gateway, which uses models from the providers listed in section 4. We record AI search queries and results to improve search quality and account for AI service costs. Do not enter other people's personal data or special categories of data (for example health data) into these features.

We use technical and organisational measures appropriate to the risk, in particular encrypted connections (HTTPS), encryption of bank account numbers, access control, security event logging and backups.

The Service is intended for adults. We do not knowingly collect data of people under 18.

We update this Privacy Policy when the law, the Service's features or the recipients of data change. We announce significant changes in the Service and, where they affect the Account, also by e-mail. The current version and its date are shown at the top of the document.