Privacy Policy

1. Who we are

This website, agrofieldgroup.com, is operated by AGROFIELD S.R.L., a company registered in Romania (“AGROFIELD”, “we”, “us”). We provide independent inspection of animal feed and forage exported from Europe to the Middle East and North Africa. We do not buy, sell, broker, transport or store the goods we inspect.

AGROFIELD is the controller of the personal data described in this policy. You can reach us at office@agrofieldgroup.com. We have not appointed a data protection officer; privacy questions are handled by our office at the same address.

This policy explains what personal data we process, why, who receives it, how long we keep it and what rights you have under Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.

2. Data we collect

Enquiries. The public website has no contact forms and no public accounts. When you call us, message us on WhatsApp or write to us by e-mail, we receive what you choose to send: typically your name, company, phone number, e-mail address and details of the shipment you are asking about.

Client portal. Portal accounts are created only by AGROFIELD, by invitation. For each user we hold a name, e-mail address, company name and sign-in and session data. For each order we hold the purchase order number, product, quantity, origin and destination, inspection stage, vessel name, IMO and MMSI numbers, estimated arrival date and notes.

Files. AGROFIELD uploads files to the portal for the client company: export documents, photos, videos and inspection reports. These files may contain personal data, such as names on documents or people who appear in photos.

Technical data. Our hosting provider may record your IP address and browser details in server logs when you visit the website or the portal.

3. Why we use data and on what legal basis

To reply to your enquiry and to take steps at your request before a contract is made, and to perform our inspection contract with you or your company (Article 6(1)(b) GDPR).

To keep records and meet obligations under Romanian accounting, tax and other laws (Article 6(1)(c) GDPR).

For our legitimate interests (Article 6(1)(f) GDPR): keeping the website and portal secure, sending service e-mails about your orders and account (new order, stage change, new files, invitations and password resets), and establishing, exercising or defending legal claims. We balance these interests against your rights and do not rely on them where your interests override ours.

Where we ever rely on your consent, you may withdraw it at any time; withdrawal does not affect processing that took place before.

We do not sell personal data and we do not use it for advertising.

4. Who receives your data

We share personal data only with service providers that process it on our behalf, under data processing terms, and only as needed to run the website and portal:

Netlify: hosting and delivery of the website; may log IP address and browser data.

Supabase: portal authentication, database and file storage. The project is hosted in the EU (AWS, Ireland).

Mailgun: sending portal notification e-mails and invitation and password-reset e-mails (EU region).

Google Fonts: font files are loaded from Google servers, which therefore receive your IP address when a page loads.

VesselFinder: when a vessel is set on an order, a map from vesselfinder.com is embedded in the portal’s vessel-tracking tab and the provider receives technical data from your browser.

Inside a client company, portal data is visible only to that company’s users and to AGROFIELD staff. We may also disclose data to public authorities, courts or professional advisers where the law requires it or where needed to establish, exercise or defend legal claims.

If you choose to contact us through WhatsApp (Meta), your phone app or your e-mail provider, those services apply their own privacy policies.

5. International transfers

Our hosting and portal data are stored in the European Union. Some providers, or their group companies and support staff, are located outside the European Economic Area, for example in the United States. Where personal data is transferred outside the EEA, we rely on safeguards recognised by the GDPR, such as the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.

You can ask us for more information about these safeguards at office@agrofieldgroup.com.

6. How long we keep data

Enquiries that do not lead to a contract are deleted within 24 months of the last contact.

Portal accounts and the related order data are kept while our business relationship with the client lasts. Afterwards they are deleted or anonymised, except for records that we must keep by law or that we need to establish, exercise or defend legal claims.

Accounting and tax documents are kept for the period required by Romanian accounting and tax law.

Server logs kept by our hosting provider are retained only for the short period needed for security and operation.

7. How we protect data

All connections to the website and portal are encrypted (HTTPS). Portal accounts are created only by invitation and administrators can block a login at any time. Access is restricted per client company, so users see only their own company’s orders and files. Files are held in private storage and are delivered through time-limited links. Clients can view and download files but cannot change them.

No system is completely secure. If a personal data breach affects you, we will notify you and the authorities where the law requires it.

8. Cookies and local storage

The public website sets no cookies and uses no analytics or advertising tools. It uses your browser’s session storage only for a technical flag that prevents a reload loop after a site update.

When you sign in to the client portal, your login session is kept in your browser’s local storage. This is strictly necessary for signing in. We do not use it for tracking.

9. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time.

To exercise a right, e-mail office@agrofieldgroup.com. We may need to verify your identity first. We will respond within one month; this may be extended by up to two further months for complex requests, and we will tell you if so.

You also have the right to lodge a complaint with the Romanian data protection authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro, or with the authority in your own country of residence or work.

10. Automated decisions and children

We do not make decisions based solely on automated processing, and we do not profile visitors or users.

Our website and services are intended for businesses and are not directed at children. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy, for example if we add a service or a provider. The current version is always published on this page with its date of last update. Material changes affecting portal users will also be communicated to them.