AgFlo Privacy Policy

Version: 1.0
Effective Date: October 28, 2026 (the “Effective Date”)
Last Updated: October 28, 2026

1. Application of this Policy

This Privacy Policy (the “Policy”) describes how AgFlo Solutions inc. (“AgFlo,” “we,” “us,” or “our”) collects, uses, discloses, stores, retains, safeguards, and otherwise processes Personal Information in the course of its activities.

This Policy applies in particular to Personal Information collected through:

• a)AgFlo’s products;
• b)the AgFlo website;
• c)the AgFlo web portal (the “Portal”);
• d)User Accounts;
• e)Services associated with the Portal, the Sensors, and any other products sold by AgFlo;
• f)customer service, support activities, and technical support communications, including by email, telephone, text message (SMS), chat, and other electronic means;
• g)alerts sent by email or text message;
• h)sales of products and Services, and related activities, including but not limited to demonstrations, distribution, and installation;
• i)webhooks and integrations configured at a Customer’s request;
• j)other commercial interactions among AgFlo, its Customers, Users, partners, distributors, resellers, installers, and service providers.

This Policy should be read together with the AgFlo Terms of Use, General Terms and Conditions of Sale, and any other agreement applicable to AgFlo products or Services.

2. Who Is Responsible for Personal Information?

AgFlo is accountable for Personal Information under its custody or control and has implemented policies and practices intended to protect such Personal Information in accordance with applicable privacy laws.

In certain circumstances, AgFlo processes Personal Information on behalf of a Customer and in accordance with the Customer's instructions, as further described below.

AgFlo appoints a person responsible for privacy and the protection of Personal Information.

Questions, requests, or concerns, or complaints regarding Personal Information, this Policy, or AgFlo’s privacy practices may be directed to AgFlo:

Privacy Contact
AgFlo Solutions inc.
1727, de la Fresniere
Chambly, Quebec J3L 0M5, Canada
Email : privacy@agflo.io
Telephone: 1-855-951-2884

3. Definitions

3.1 “Account”

Means the individual account assigned to a User for accessing the Services.

3.2 “Customer”

Means the individual, entity, organization, or other person that purchases, owns, operates, or uses AgFlo products or Services.

3.3 “Customer Data”

Means technical and operational data associated with a Customer’s Sensors, bins, sites, and installations. Customer Data may include:

• a)distance measurements;
• b)volume and level estimates;
• c)inventory history;
• d)bin settings and dimensions;
• e)measurement dates and times;
• f)battery information;
• g)LTE connectivity data;
• h)Sensor status;
• i)alert configurations; and
• j)forecasts and outputs generated by AgFlo algorithms.

Not all Customer Data is Personal Information. However, Customer Data may constitute Personal Information if it identifies or can reasonably be associated with an identifiable individual.

3.4 “Installer” or “Technician”

Means a User authorized to install, activate, configure, diagnose, maintain, or service Sensors and their associated settings.

3.5 “Organization”

Means the logical environment configured in the Portal to group a Customer’s Users, Sensors, bins, sites, and installations.

3.6 “Personal Information”

Means information about an identifiable individual, whether the individual is identified directly or indirectly, as defined by applicable law. In jurisdictions using the term “personal data,” references to Personal Information include personal data to the extent applicable.

3.7 “Read-Only User”

Means a User who has been granted permission by an Organization Administrator to view specific Customer Data without modifying it.

3.8 “Sensor”

Means an AgFlo IoT device installed on a feed bin, grain bin, silo, or other compatible equipment for the purpose of collecting and transmitting operational and technical measurements.

3.9 “Services”

Means the Portal, User Accounts, digital features, alerts, webhooks, support, and other services associated with AgFlo Sensors.

3.10 “User”

Means an individual who accesses the Services, including but not limited to an Organization Administrator, Read-Only User, Installer or Technician, distributor representative, Customer employee, consultant, nutritionist, supplier, or member of AgFlo Support.

4. AgFlo’s Role and the Customer’s Role

4.1 Information Collected for AgFlo’s Own Purposes

AgFlo is generally responsible for the Personal Information it collects, uses, and otherwise processes in connection with its business activities, including to:

• a)create and administer Accounts;
• b)manage commercial relationships;
• c)provide technical support;
• d)administer billing;
• e)communicate with Customers and Users;
• f)secure, maintain, and improve the Services; and
• g)comply with legal and regulatory obligations.

4.2 Information Processed on Behalf of a Customer

In some circumstances, AgFlo processes Personal Information on behalf of the Customer and in accordance with the Customer’s instructions. This may occur when the Customer invites employees or partners, configures alerts, requests an integration, assigns access rights, or provides information about representatives or business partners.

In those circumstances, the Customer is responsible for determining the purposes of the processing, who may be invited, which access should be granted, whether the collection and disclosure are lawful, which notices or consents are required, and when access must be removed.

4.3 Shared Responsibility

Before providing AgFlo with Personal Information about another person, the Customer must ensure that it has the necessary authority, rights, notices, and consents. AgFlo remains responsible for its own processing practices and for the safeguards it applies to Personal Information under its control.

5. Personal Information AgFlo May Collect

The Personal Information collected by AgFlo depends on the person’s relationship and interactions with AgFlo, and the products, services, and features used.

The examples below are intended to illustrate the categories of Personal Information that may be collected and are not exhaustive:

5.1 Identity and Account Information

• a)first and last name;
• b)job title or role;
• c)company or organization name;
• d)email address;
• e)telephone number;
• f)preferred language;
• g)country, province, state, or region;
• h)Account identifier;
• i)roles and access permissions;
• j)Account preferences;
• k)accepted or declined invitations; and
• l)Account creation and last-use dates.

AgFlo does not store passwords in directly readable form. Passwords are processed using appropriate technical protection mechanisms.

5.2 Commercial Information

• a)Customer name and contact information;
• b)information included in requests for quotation, proposals, and orders;
• c)products, services and subscriptions purchased;
• d)Customer, order, and invoice numbers;
• e)delivery information;
• f)commercial and customer service communication history;
• g)renewal, suspension, and termination information;
• h)commercial and communication preferences; and
• i)communications with authorized distributors, resellers, and partners.

5.3 Payment Information

Payments may be processed by AgFlo or by a third-party payment service provider. Depending on the payment method, AgFlo may collect or receive the payer’s name, billing address, payment status, payment amount and date, the last four digits of a payment method when supplied by the payment processor, a transaction identifier, and information required for accounting, billing, and reconciliation. AgFlo may not receive or retain full payment card details, including the full payment card number when payment is processed directly by a specialized third-party payment service provider.

5.4 Technical Support Information

Technical support information may include information provided in connection with a support request or generated during troubleshooting and service delivery, including:

• a)the content of the support request;
• b)support communications, messages and attachments;
• c)screenshots and other materials provided for troubleshooting purposes;
• d)information about the affected products, Services, Sensors, or Accounts;
• e)diagnostic data and technical logs;
• f)dates and times of support communications;
• g)troubleshooting steps performed;
• h)information needed to verify the requester’s identity or authority; and
• i)support records and follow-up notes.

5.5 Installation Information

• a)farm, site, building, or installation name;
• b)address or general location;
• c)site coordinates when required for installation or Service operation;
• d)name assigned to a bin;
• e)bin dimensions and characteristics;
• f)photographs of the installation, bin, site, or related equipment;
• g)installer name;
• h)installation date and status; and
• i)Sensor serial number or identifier.

Information about a farm or bin is not necessarily Personal Information. It may become Personal Information when associated with an identifiable individual, including a producer operating as a sole proprietor.

5.6 Technical and Usage Data

• a)IP address;
• b)device type;
• c)operating system;
• d)browser type and version;
• e)login dates and times;
• f)pages and features viewed;
• g)actions performed in the Portal;
• h)authentication, access, and security logs;
• i)errors and technical events;
• j)session identifiers;
• k)security and abuse-detection data; and
• l)device language and regional settings.

This information may be associated with a User to operate and secure Accounts, provide technical support, troubleshoot issues, investigate incidents, trace configuration changes, and understand how the Services are used.

5.7 Data Transmitted by Sensors

• a)ultrasonic measurements or derived results;
• b)level and volume estimates;
• c)temperature data, where available;
• d)battery status;
• e)cellular signal quality or strength;
• f)network information;
• g)measurement and transmission dates and times;
• h)Sensor diagnostics;
• i)firmware version;
• j)installation, update, or restart events; and
• k)detected technical anomalies.

These data are primarily technical and operational in nature and do not generally identify an individual. However, they may constitute Personal Information when associated, directly or indirectly, with an identifiable individual.

5.8 Alerts and Communications

• a)recipient email address or telephone number;
• b)requested alert type;
• c)selected thresholds, settings, and notification preferences;
• d)time sent;
• e)delivery status; and
• f)delivery errors or failures.

This information may be used to configure, deliver, monitor, and manage alerts, notifications, and other communications relating to the Sensors and the Services.

5.9 Webhooks and Integrations

• a)destination URL;
• b)third-party system identification information;
• c)configuration settings;
• d)transmission logs;
• e)response codes;
• f)communication errors;
• g)Customer Data selected for transmission.

This information is primarily technical and operational in nature. Depending on the integration and the data transmitted, it may include or relate to Personal Information. The Customer and Users should not provide AgFlo with access credentials or secrets that are not required for an authorized configuration.

5.10 Marketing Communications

• a)business email address;
• b)recipient name and organization;
• c)subscription and communication preferences;
• d)date, method, and source of consent where required;
• e)opens, clicks, and interactions when tracking is enabled; and
• f)unsubscribe requests.

This information may be used to manage subscriptions, deliver marketing and promotional communications, maintain consent records, and measure engagement where permitted by law.

6. Sources of Information

AgFlo may collect Personal Information from different sources, including directly from the individual; from the Customer or Organization Administrator; from an authorized employee or representative; from an authorized distributor, reseller, or installer; automatically through the Portal or Sensors; from payment, communications, hosting, and support providers; from a third-party system connected or authorized for connection at the Customer’s request; from lawful public or commercial sources; or during trade shows, demonstrations, inquiries, and other business interactions.

When AgFlo receives Personal Information from a Customer about its Users, the Customer is responsible for providing any notices and obtaining any consent required by law.

7. Purposes of Collection and Use

AgFlo collects, uses, and discloses Personal Information only for the purposes described in this Policy, identified at the time of collection, or otherwise permitted or required by applicable law.

7.1 Providing Products and Services

• a)create and administer an Organization;
• b)create, authenticate, and manage Accounts;
• c)assign roles and permissions;
• d)associate Sensors with Customer installations;
• e)display, store, process, and transmit Customer Data;
• f)produce histories, charts, and estimates, reports, and analytics;
• g)configure and send alerts;
• h)provide authorized webhooks and integrations;
• i)apply Portal and Sensor updates; and
• j)operate the Services.

7.2 Managing the Commercial Relationship

• a)respond to inquiries;
• b)prepare demonstrations and quotations;
• c)process orders;
• d)coordinate delivery and installation;
• e)manage subscriptions and renewals;
• f)administer billing and collection;
• g)maintain business, contractual and accounting records;
• h)communicate with Customer representatives; and
• i)manage relationships with authorized distributors, resellers, and other business partners involved in providing the Products and Services.

7.3 Support and Customer Service

• a)respond to support and customer service requests and inquiries;
• b)verify identity or authority;
• c)diagnose problems;
• d)access an Organization or Sensor when necessary to provide support or maintain the Services;
• e)correct configurations;
• f)investigate anomalies, errors, and incidents;
• g)document interventions, communications, and resolutions; and
• h)improve support.

7.4 Security and Abuse Prevention

AgFlo may use Personal Information to secure its products, Services, Accounts, Sensors, systems, Users, and business operations, including to:

• a)authenticate Users;
• b)detect suspicious, malicious, or unauthorized activity;
• c)prevent unauthorized access;
• d)protect Accounts, Services, and systems;
• e)detect fraud, hacking, misuse, and other security threats;
• f)investigate security incidents, vulnerabilities, and complaints;
• g)enforce the Terms of Use, Terms and Conditions of Sale, and other applicable agreements;
• h)protect AgFlo, Customers, Users, partners, and service providers; and
• i)maintain security logs, audit trails, and records relating to security events.

7.5 Operating and Improving the Services

• a)monitor performance of the Services;
• b)diagnose errors;
• c)improve transmission reliability;
• d)improve the User experience;
• e)evaluate feature usage;
• f)develop new features, functionality, and services;
• g)optimize updates and maintenance activities; and
• h)improve Sensor and network compatibility.

7.6 Improving Calculations and Algorithms

AgFlo may use technical and operational data, and aggregated, de-identified, or anonymized information derived therefrom, to improve algorithms, mathematical models, volume estimates, detection methods, anomaly detection, result accuracy, research and development, and the overall quality, performance, reliability, and functionality of AgFlo products and Services.

7.7 Operational Communications

AgFlo may use Personal Information to communicate with Users and to send configured alerts, maintenance notices, security notices, Account messages, installation or Sensor information, renewal, suspension, or termination notices, and notices regarding changes to the products, Services, agreements, or this Policy. Such communications are necessary to provide the Services.

7.8 Commercial Communications

Subject to applicable law, AgFlo may use certain Personal Information to promote products and Services, announce new features, invite individuals to events or demonstrations, share professional news or content, and measure communication effectiveness. To the extent such communications are not necessary to provide the Services, Recipients may withdraw consent or unsubscribe using the unsubscribe mechanism or by contacting AgFlo.

7.9 Legal Obligations

AgFlo may use Personal Information to comply with applicable laws, regulations, court orders, and lawful requests from government authorities; maintain required records; establish, exercise, protect, or defend legal rights; meet tax, accounting, audit, and regulatory obligations; and manage privacy, security, or compliance incidents.

8. Legal Bases for Processing

Where applicable law requires AgFlo to identify a legal basis, processing may be based on the following grounds:

8.1 Performance of a Contract

Processing may be necessary to create and administer an Account, provide the products and Services, perform a subscription, provide support, configure an alert or integration, process transactions, manage the Customer relationship, or otherwise fulfill AgFlo’s obligations to the Customer.

8.2 Consent

AgFlo may rely on consent for certain marketing communications, optional cookies, secondary uses, or other processing that requires consent under applicable law. Consent may be withdrawn at any time, subject to legal or contractual restrictions and obligations, and a reasonable period required to implement the request.

8.3 Legitimate Interests

Where permitted, AgFlo may rely on legitimate interests to secure the Services, prevent fraud, improve products and Services, administer Customer relationships, maintain records, defend rights, and ensure continuity, reliability, and security of the products and Services. AgFlo considers the rights and interests of affected individuals when relying on this basis.

8.4 Legal Obligation

AgFlo may process Personal Information where necessary to comply with a legal obligation to which AgFlo is subject.

8.5 Vital Interests

In exceptional circumstances, AgFlo may process Personal Information where necessary to protect an individual’s vital interests.

9. Consent

Consent may be express or implied depending on the sensitivity of the Personal Information, the purposes for which it is collected, the individual’s reasonable expectations, the commercial relationship, and applicable law.

When a Customer provides Personal Information about a User, employee, contractor, or partner, the Customer confirms that it has the authority to do so and has satisfied any applicable notice, consent, or other legal requirements.

An individual may refuse or withdraw consent where processing is based on consent. Refusal or withdrawal may prevent AgFlo from creating or maintaining an Account, sending certain alerts, providing certain features or Services, responding to requests, or maintaining a business relationship where the Personal Information is necessary for those purposes.

AgFlo does not require consent for the collection, use, or disclosure of Personal Information beyond what is reasonably necessary for the purposes described in this Policy or otherwise permitted or required by applicable law, except for genuinely optional features or processing activities for which consent is required by law.

10. Cookies and Similar Technologies

10.1 Essential Cookies

The website and Portal may use cookies or similar technologies required to maintain sessions, authenticate Users, remember settings, prevent fraud, ensure security, maintain Service functionality, and operate the Portal. Blocking essential cookies may prevent parts of the Portal from functioning or functioning properly.

Cookies and similar technologies may be provided by AgFlo or by authorized third-party service providers acting on AgFlo's behalf.

10.2 Measurement and Analytics

With consent where required, AgFlo may use measurement tools to understand website or Portal usage, identify errors, measure performance, and improve the Services. These tools may collect pages viewed, visit duration, device type, IP address or a truncated IP address, and interactions with features.

10.3 Advertising

AgFlo may use advertising cookies and similar technologies only after obtaining any consent required by applicable law.

10.4 Preference Management

Where a consent manager is offered, individuals may change preferences related to cookies and similar technologies through the banner or preference center. Browser settings may also be used to block or delete certain cookies.

11. Disclosure of Personal Information

AgFlo does not sell Personal Information. AgFlo may disclose Personal Information in the circumstances described below and as otherwise permitted or required by applicable law.

11.1 Service Providers

AgFlo may disclose Personal Information to providers that support cloud hosting, databases, cellular telecommunications, text messaging, email, payment processing, customer relationship management, technical support, cybersecurity, analytics, system monitoring, accounting, professional services, delivery, and logistics. Providers may use Personal Information only to perform agreed services on AgFlo’s behalf, or as permitted by applicable law.

11.2 Users Authorized by the Customer

Customer Data and associated Personal Information may be accessible to Organization Administrators, Read-Only Users, Users, distributors, and other persons to whom the Customer grants access. Subject to AgFlo’s own obligations, AgFlo is not responsible for the Customer’s decision to grant, modify, maintain, revoke, or manage such access.

11.3 Webhooks and Third-Party Systems

At the Customer’s request, AgFlo may transmit Customer Data to a third-party system through a webhook or integration. Once transmitted to the third-party system, such information is also governed by the third party’s privacy and security practices, terms, and policies, for which AgFlo is not responsible. The Customer is responsible for selecting the third-party system, providing the destination address, confirming its authority to transmit the data, assessing the third party and its privacy, security and data-handling practices, determining whether the integration remains appropriate, and requesting deactivation when no longer required.

11.4 Distributors, Installers, and Partners

AgFlo may disclose Personal Information to a distributor, reseller, installer, or partner where necessary to prepare, negotiate, or complete a sale, deliver or install a product, provide support, process a Customer request, or administer an authorized business relationship.

11.5 Professional Advisors

AgFlo may disclose Personal Information to legal counsel, accountants, insurers, auditors, and other professional advisors where reasonably necessary.

11.6 Business Transactions

In connection with a proposed or completed merger, acquisition, financing, change of control, corporate reorganization, sale of a business, or sale of assets, AgFlo may disclose Personal Information to involved parties and advisors, subject to appropriate confidentiality safeguards and legal requirements.

11.7 Legal Requirements and Protection of Rights

AgFlo may disclose Personal Information where it reasonably believes disclosure is necessary to comply with applicable law or a court order, respond to a legally valid request, investigate fraud, misuse, or an incident, protect personal safety, protect AgFlo’s rights, property, products, Services, or systems, enforce an agreement, or establish, exercise, protect or defend a claim or legal right.

11.8 Customer-Authorized Recipients

AgFlo may disclose Personal Information and Customer Data to persons or organizations, as designated or requested by the Customer or an authorized User. AgFlo processes and discloses such Personal Information in accordance with the Customer or User’s instructions, and subject to AgFlo’s own obligations under applicable law, AgFlo is not responsible for disclosures made as a result of such instructions.

12. Sale, Sharing, and Behavioural Advertising

12.1 No Sale for Monetary Consideration

AgFlo does not sell Personal Information in exchange for monetary consideration.

12.2 Broader U.S. Definitions

Certain U.S. privacy laws define “sale,” “sharing,” or “targeted advertising” more broadly than ordinary usage. Where such laws apply, AgFlo will provide any rights, notices, and mechanisms required by applicable law.

12.3 Cross-Context Behavioural Advertising

AgFlo does not use or share Personal Information collected through the Portal to deliver cross-context behavioural advertising.

13. International Hosting and Transfers

13.1 Processing in Multiple Jurisdictions

AgFlo and its providers may process, store, access or host Personal Information in Canada, the United States, or other countries where they operate. Personal Information may therefore be subject to local laws and may be accessible to courts, government authorities, or regulators in accordance with such laws.

13.2 Provider Assessment

AgFlo selects service providers and assesses international processing arrangements having regard to the nature and sensitivity of the Personal Information, the purposes of the processing, safeguards, processing location, contractual commitments, and applicable legal requirements.

13.3 Transfers from the European Economic Area

Where the GDPR applies and Personal Information is transferred to a country without an applicable adequacy decision, AgFlo uses a recognized transfer mechanism where required, such as the European Commission Standard Contractual Clauses, applicable Binding Corporate Rules, a permitted derogation, or another legally valid mechanism.

13.4 Transfers from the United Kingdom

Where United Kingdom law applies, AgFlo may use recognized transfer mechanisms, including applicable contractual clauses or addenda.

13.5 Transfers from Australia

Where the Australian Privacy Principles apply, AgFlo takes reasonable steps required in relation to disclosure of Personal Information to overseas recipients.

13.6 Additional Information

Individuals may contact AgFlo for general information about the jurisdictions in which their Personal Information may be processed or about the safeguards applicable to such processing.

14. Aggregated and Anonymized Data

14.1 Aggregation, De-Identification, and Anonymization

AgFlo may transform Customer Data and associated Personal Information so that it no longer reasonably identifies a person or Customer. Measures may include removing names and contact details, deleting or generalizing identifiers, combining data from several sites, reducing geographic precision, applying aggregation thresholds, restricting access to detailed data, and applying other technical or organizational controls designed to reduce the likelihood of identification or re-identification.

14.2 Uses

AgFlo may use technical and operational data, and aggregated, de-identified, or anonymized information derived therefrom to improve products, Services, and algorithms, assess measurement accuracy, develop statistics, conduct research, identify general trends, design new services, and produce analyses that do not identify an individual or the Customer.

14.3 Retention

Subject to applicable law, validly anonymized data is no longer treated as Personal Information and may be retained for as long as it remains useful for business, research, statistical, analytical, product development, or other legitimate purposes.

14.4 No Re-identification

AgFlo applies reasonable measures to prevent re-identification and does not attempt to re-identify individuals from anonymized data except as necessary to verify, evaluate, or test the effectiveness of the anonymization process, or where permitted by law.

14.5 Use of Aggregated and Anonymized Information

AgFlo may create aggregated, de-identified, or anonymized datasets from Customer Data and associated information, including Personal Information where applicable, and may use such datasets for the purposes described in this Policy. Such datasets are designed not to identify an individual, Customer, Organization, or installation.

15. Artificial Intelligence and Machine Learning

15.1 Service Improvement

AgFlo may use statistical, machine-learning, or artificial-intelligence methods to improve volume calculations, signal processing, anomaly detection, predictions, measurement-quality assessment, Sensor performance, and overall Service reliability, using datasets selected and processed in accordance with this Policy and applicable privacy laws.

15.2 Preferred Data

AgFlo prioritizes aggregated and anonymized data when developing, training, testing, or validating such models.

15.3 Identifiable Profiling

If AgFlo were to use Personal Information to train a model intended to identify, profile, evaluate, or make predictions or decisions about an identifiable individual, AgFlo would assess the lawfulness and necessity of the processing, provide required information, obtain additional consent where required, provide applicable rights, and implement appropriate safeguards.

15.4 Automated Decisions

The Portal is a decision-support tool and not an autonomous control system. AgFlo does not use Personal Information to make decisions without human involvement that produce significant legal effects or similarly significant effects for a User, unless expressly disclosed and permitted by applicable law. Volume estimates, alerts, trends, and forecasts displayed in the Portal are not automated decisions concerning an individual’s legal rights or similarly significant interests.

16. Retention of Personal Information

16.1 General Principle

AgFlo retains Personal Information only for as long as necessary for the purposes described in this Policy, the provision of the products and Services, contract performance, Service operation, legal compliance, protection of rights, fraud prevention, and security.

16.2 Accounts and Customer Data

During an active subscription, AgFlo retains Customer Data, including Personal Information, as required to operate the Account and Services.

After the subscription ends, the Account may be disabled and AgFlo may retain certain contractual, accounting, legal, operational, technical, inventory, or statistical information, including Personal Information, for longer periods, where required or permitted by applicable law. During such periods, the Customer may request a copy of the data. After such periods, Customer Data, including Personal Data, may be deleted, de-identified, anonymized, or otherwise processed in accordance with this Policy and applicable law.

16.3 Backup Data

Personal Information may remain temporarily in backup systems until normal rotation or deletion. Backup copies are not returned to active use except where restoration is necessary for continuity, security, system integrity, or disaster recovery purposes.

16.4 Commercial and Accounting Records

AgFlo may retain contracts, invoices, transactions, and commercial documents for periods required by tax, accounting, audit, or commercial law.

16.5 Security Logs

Access, authentication, and security logs may be retained for a reasonable period to detect incidents, investigate misuse, investigate security incidents, and protect systems.

16.6 Requests and Complaints

Personal Information relating to an access request, complaint, dispute, privacy incident, or regulatory inquiry may be retained as long as necessary to document its handling and defend legal rights.

16.7 Retention Criteria

Specific periods are determined based on the amount and sensitivity of Personal Information, risk of unauthorized use or disclosure, processing purposes, availability of less intrusive alternatives, legal and contractual obligations, and applicable limitation periods.

17. Destruction and Anonymization

In accordance with Section 16.2 above, at the end of the applicable retention period, AgFlo takes reasonable steps to securely destroy Personal Information, remove it from active systems, de-identify, or anonymize it, where continued retention of related operational, technical, inventory, or statistical data remains useful, require relevant providers to apply appropriate contractual and technical measures, and restrict access pending final deletion. The method used depends on the medium, sensitivity of the Personal Information, and reasonably available technical capabilities.

18. Accuracy of Information

AgFlo takes reasonable steps to ensure that Personal Information used for the purposes described in this Policy is accurate, complete, and current. Users can assist by updating their profiles, reporting changes, notifying AgFlo of errors, keeping Administrator details current, and removing access for persons who are no longer authorized. Individuals may request correction of their Personal Information as described below.

19. Security Measures

19.1 General Measures

AgFlo applies reasonable administrative, technical, and physical safeguards appropriate to the nature and sensitivity of the Personal Information. Measures may include role-based access controls, individual Accounts, password protection, logging, monitoring, update and vulnerability management, internal access restrictions, confidentiality commitments, provider due diligence and contractual safeguards, and incident-response procedures.

19.2 User Responsibilities

Customers and Users must select strong passwords, avoid sharing credentials, protect devices, close Accounts for persons leaving the organization, keep contact information current, promptly report suspicious access and security incidents, and follow AgFlo security instructions.

19.3 Multi-Factor Authentication

AgFlo may add multi-factor authentication and may recommend or require it for certain Accounts when available.

19.4 No Absolute Security

Despite AgFlo’s implementation of reasonable administrative, technical, and physical safeguards designed to protect Personal Information, no network, system, Services, device, or transmission method can be guaranteed to be completely secure.

20. Privacy and Security Incidents

20.1 Incident Management

AgFlo maintains a process to detect, investigate, contain, respond to, and remediate privacy and security incidents.

If a confidentiality incident involving Personal Information occurs, AgFlo will take the steps required by applicable law, including assessing the incident and providing any notifications required by law.

20.2 Assessment

In the event of an incident, AgFlo considers the nature of affected Personal Information, persons or organizations impacted, the cause and scope of the incident, possible consequences, likelihood of harmful use, and mitigation measures.

20.3 Notices and Reports

Where required by law, AgFlo maintains an incident record, notifies the competent privacy authority, informs affected persons, informs the Customer where AgFlo processes data on its behalf, and implements other required measures within the timeframes and in the manner required by applicable law.

20.4 Customer Cooperation

The Customer must promptly inform AgFlo of an incident affecting an Account, a device used to access the Services, User credentials, a connected third-party system, a webhook address, or Customer Data, and must provide information reasonably requested by AgFlo to investigate, assess, contain, or remediate the incident.

20.5 Mitigation

AgFlo may take reasonable steps to contain, mitigate, investigate, remediate, or prevent a privacy or security incident, including temporarily restricting access to Accounts, integrations, webhooks, devices, or Services where reasonably necessary to protect Personal Information, Customer Data, Users, the Customer, or the Services.

21. Privacy Rights

Available rights vary depending on jurisdiction, the individual’s relationship with AgFlo, and applicable law. Subject to legal exceptions, an individual may have the following rights:

21.1 Right to Information

The right to receive information about the categories of Personal Information collected, processing purposes, recipient categories, retention periods or criteria, international transfers, and available rights.

21.2 Right of Access

The right to ask whether AgFlo holds Personal Information about the individual, obtain access, receive information about its use and disclosure, and obtain a copy.

21.3 Right to Correction

The right to request correction of inaccurate, incomplete, outdated, or ambiguous Personal Information.

21.4 Withdrawal of Consent

Where processing is based on consent, the right to withdraw consent at any time, subject to legal or contractual restrictions and applicable legal requirements.

21.5 Deletion or Erasure

Where provided by applicable law, the right to request deletion or erasure of Personal Information. AgFlo may retain Personal Information to provide a requested Service, prevent fraud, ensure security, establish, protect, or defend rights, maintain required records, or otherwise as permitted or required by applicable law.

21.6 Restriction of Processing

Where the GDPR or a comparable law applies, the right to request the restriction of processing of Personal Information in certain circumstances.

21.7 Data Portability

Where required by applicable law and technically feasible, the right to receive certain computerized Personal Information relating to the individual in a structured, commonly used technological format and, where applicable, to request its communication to another person or organization authorized by the individual. Portability does not necessarily apply to data created by AgFlo, algorithms or models, anonymized data, AgFlo intellectual property, or information about others.

21.8 Right to Object

Where processing is based on legitimate interests or relates to marketing communications, the right to object in circumstances provided by applicable law.

21.9 U.S. Sale, Sharing, and Targeted Advertising Rights

Where applicable U.S. law provides, the right to opt out of sale, sharing for cross-context behavioural advertising, certain targeted advertising, or certain uses of sensitive Personal Information. AgFlo does not discriminate against an individual for exercising any applicable privacy rights.

21.10 Automated Decision Rights

Where applicable law provides, the right to obtain information or exercise rights concerning a decision based exclusively on automated processing of Personal Information, including any rights relating to review, explanation, or observations provided by law.

21.11 Right to Complain

The right to complain to AgFlo and, where eligible, to the competent privacy or data protection authority.

22. Exercising Privacy Rights

22.1 Submitting a Request

Requests may be sent to AgFlo at privacy@agflo.io or to the postal address stated in Section 2. A request should identify the requester, provide an email address and other contact information, explain the relationship with AgFlo or the Customer, specify the right being exercised, identify the related Personal Information and time period, and include details needed to process the request.

22.2 Identity Verification

AgFlo may request reasonable information to verify identity, authority, association with the Customer, an Organization, or a representative’s mandate. AgFlo requests only information reasonably necessary for verification.

22.3 Requests Relating to Customer-Controlled Accounts

Where AgFlo processes Personal Information on behalf of a Customer, AgFlo may refer the request to that Customer or ask the requester to contact the Organization Administrator. AgFlo may cooperate with the Customer to address the request in accordance with applicable law.

22.4 Timing

AgFlo responds to requests within the time limits required by applicable law. Where legally permitted, AgFlo may extend the response period for complex or multiple requests and will provide notice of the extension and the reasons for it.

22.5 Fees

Requests are generally handled without charge. Where permitted by applicable law, AgFlo may charge a reasonable fee for a manifestly unfounded, excessive, or repetitive request, or for requests requiring a special format or method of delivery, after giving advance notice.

22.6 Refusal

AgFlo may refuse all or part of a request where a legal exception applies. AgFlo will generally explain the reason for the refusal and any available recourse, unless prohibited by applicable law.

23. Rights in Quebec and Canada

Where applicable Quebec or Canadian law provides, an individual may request access, request correction, withdraw consent, request cessation of dissemination or de-indexing in circumstances provided by law, request communication of certain computerized Personal Information in a structured and commonly-used technological format, request that such Personal Information be communicated to another person or organization where technically feasible and provided by law, and file a complaint with the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada, as applicable.

24. Rights in the European Economic Area

Where the GDPR applies, an individual may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, protection from certain solely automated decisions, and the right to lodge a complaint with the supervisory authority of the individual’s habitual residence, workplace, or place of the alleged infringement.

24.1 Data Protection Officer

Where required by applicable law, AgFlo will appoint a Data Protection Officer or designate another appropriate privacy contact.

25. Rights in Australia

Where the Privacy Act 1988 and the Australian Privacy Principles apply, an individual may request access to or correction of Personal Information, request information about AgFlo’s processing practices, submit a complaint to AgFlo, and complain to the Office of the Australian Information Commissioner where applicable. AgFlo handles complaints in accordance with applicable requirements and its reasonable procedures.

26. Rights in the United States

Rights vary by state and apply only where the relevant law applies to AgFlo. An eligible individual may have the right to know categories collected, access Personal Information, request correction or deletion, receive a portable copy, opt out of certain sales, sharing, or targeted advertising, limit certain sensitive-data processing, appeal a denial where provided, and not be discriminated against for exercising rights. AgFlo may request information needed to verify identity and residency. An authorized agent may submit a request where permitted and valid authorization is provided.

27. Children and Minors

AgFlo products and Services are intended for businesses and professional Users. AgFlo does not knowingly seek to collect Personal Information from children. Customers must not create an Account for or invite a child to use the Services unless permitted by law and all required consents, authorizations, or permissions have been obtained. If AgFlo learns that it collected a child’s Personal Information without authorization, it will take reasonable steps to delete or otherwise handle the Personal Information in accordance with applicable law.

28. Third-Party Sites and Services

AgFlo’s website or the Portal may contain links to third-party sites, applications, or services. AgFlo is not responsible for such third parties’ privacy practices, security, or content. Access to or use of third-party sites, applications, or services is governed by the terms, conditions, and policies of the applicable third party, and individuals should review such documentation of the third party before providing information, including Personal Information. This includes systems connected by webhook, agricultural-management software, distributor or supplier platforms, payment providers, and external links.

29. Electronic Communications

29.1 Service Communications

AgFlo may send communications necessary to provide, maintain, secure, or support the Services, even if an individual has opted out of receiving promotional communications. These may concern security, alerts, Accounts, maintenance, billing, suspension, termination, agreements, changes to the Services, or this Policy.

29.2 Commercial Electronic Messages

Commercial electronic messages are sent in accordance with applicable law. Recipients may unsubscribe using the link provided or by contacting AgFlo. Processing may take a reasonable period and any applicable legal requirements will continue to apply during such period.

30. Complaints

30.1 Submitting a Complaint

A person who believes AgFlo has handled Personal Information improperly may contact the Privacy Officer or other designated privacy contact. The complaint should describe the relevant facts, affected Personal Information, approximate dates, any steps already taken to address the matter, and the desired outcome.

30.2 Handling

AgFlo acknowledges the complaint within a reasonable time, reviews it impartially, may request additional information, communicates its findings or general conclusions, and takes corrective action where justified.

30.3 Privacy Authorities

Where permitted by applicable law, a person may contact the Commission d’accès à l’information du Québec, the Office of the Privacy Commissioner of Canada, an applicable European data protection authority, the Office of the Australian Information Commissioner, or the competent U.S. state privacy authority or attorney general.

31. Changes to this Policy

AgFlo may amend this Policy to reflect changes in Services, practices, technology, legal or regulatory requirements, or clarifications. The “Last Updated” date appears at the beginning of this Policy. For material changes, AgFlo provides reasonable notice by email, through the Portal, on its website, or by another appropriate method. Where a new consent is legally required, AgFlo obtains it before collecting, using, or disclosing Personal Information for the new purpose or processing activity.

32. Language

This Policy is available in French and English and may be translated into other languages. If the versions differ, the version designated by AgFlo as controlling will govern, to the extent permitted by applicable law, and subject to mandatory law in the applicable jurisdiction.

33. Contact Information

For general questions about the Services:
AgFlo Support
Email: support@agflo.io
Telephone: 1-855-951-2884
Normal support hours: 9:00 a.m. to 4:00 p.m., Montreal time, on business days

For privacy questions, requests, or complaints:

Privacy Contact
AgFlo Solutions inc.
1727 de la Fresniere
Chambly, Québec J3L 0M5, Canada
Email: privacy@agflo.io
Telephone: 1-855-951-2884

APPENDIX A — CATEGORIES OF SERVICE PROVIDERS

The categories above are intended to describe the types of service providers that may process Personal Information on AgFlo’s behalf. The identity of specific providers or subprocessors may change over time. AgFlo may make the identities of specific providers or subprocessors available where required by applicable law, contractual commitment, or written agreement.

APPENDIX B — SUMMARY OF PROCESSING ACTIVITIES

The periods above are general. AgFlo may apply a different retention period where required or permitted by applicable law, contractual obligations, litigation holds, legal proceedings, security requirements, or other legitimate business purposes.