BioCV Privacy Policy

Entity responsible (Controller): BioCV GmbH, Rüsingstr. 45, 44894 Bochum, Germany

Contact: info@biocv.org

This Privacy Policy describes how BioCV GmbH ("BioCV", "we", "us") processes personal data in connection with the LISA platform, including connected hardware (e.g., BioTag/BioNode), the LISA web/app, and the API (collectively, the "Services"). Where we act as a processor for enterprise customers, our Data Processing Agreement (DPA/AVV) governs that processing.

1. Summary (Key Points)

• We collect account, usage, device telemetry, and support data to operate and improve the Services.

• We do not sell or share personal data for cross‑context behavioral advertising.

• Transfers outside the EEA/UK/CH are protected by approved safeguards (e.g., Standard Contractual Clauses (SCCs) and UK Addendum).

• You have rights under GDPR/UK GDPR/CPRA, including access, deletion, portability, and objection, as applicable.

• Contact info@biocv.org for privacy requests.

2. Categories of Personal Data We Process

Account & Identity Data: name, email, password hash, organization, role, phone (optional).

Farm/Facility & Device Data: farm/site identifiers; device IDs (e.g., ear tags, gateways), deployment metadata (placement, timestamps), firmware/app versions.

Telemetry & Operations Data: sensor events, connectivity & reception metrics, uptime, error logs, configuration settings.

Usage Data: app activity, feature usage, API requests, device/app crash logs, diagnostics.

Support & Communications: tickets, emails, call notes, attachments.

Financial Admin Data: billing contact, invoice info and payment confirmations (card details handled by our PCI‑certified payment provider as independent controller).

Cookies & Similar: strictly necessary cookies; optional analytics (see §11).

3. Sources of Data

• Directly from you (account signup, in‑app inputs, support).

• Automatically from devices, apps, and APIs you connect.

• From your organization/administrator (seat management).

• From service providers (e.g., payment confirmations, fraud prevention).

4. Purposes & Legal Bases (GDPR/UK GDPR)

We process personal data for:

• Service delivery & account management (Art. 6(1)(b) contract).

• Security, fraud prevention, integrity of the Services (Art. 6(1)(f) legitimate interests).

• Diagnostics, quality, and product improvement, including Aggregated/anonymous analytics (Art. 6(1)(f)).

• Legal compliance (e.g., tax, accounting, export controls) (Art. 6(1)(c)).

• Consent‑based features where required (Art. 6(1)(a)); you can withdraw consent at any time.

5. Retention

We retain personal data for as long as necessary for the purposes above, then delete or anonymize it unless longer retention is required by law or to establish/exercise/defend legal claims. Telemetry linked to identified farms may be retained to support audits, warranty, and safety investigations, then aggregated/anonymized.

6. Recipients (Categories)

• Infrastructure & cloud hosting providers supporting storage, compute, databases.

• Customer support tooling (ticketing/email).

• Security, logging, and analytics tooling for integrity, debugging, and product metrics.

• Payment processors and financial institutions (independent controllers for card data).

• Professional advisors (legal/accounting) under confidentiality.

• Authorities where required by law.

7. International Transfers

Where personal data is transferred outside the EEA/UK/Switzerland, we use appropriate safeguards such as the EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum. We also conduct transfer risk assessments where appropriate. Copies of relevant safeguards are available on request (subject to redactions).

8. Your Rights

Subject to applicable law, you may have the right to request access, rectification, erasure, restriction, portability, or objection to processing, and to withdraw consent. Contact info@biocv.org. You may also lodge a complaint with your local supervisory authority. In North Rhine‑Westphalia, Germany, this is the Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW).

9. Children

Our Services are not directed to children. We do not knowingly collect personal data from children under the age required by applicable law (e.g., under 16 in the EU, under 13 in the U.S.). If we learn we have collected such data, we will delete it.

10. IoT Devices and Telemetry

Our connected devices (e.g., BioTag, BioNode) produce telemetry for operational insights. Device data often relates to animals and environments rather than natural persons. Where telemetry can be linked to an identifiable person (e.g., user accounts, location assignments), it is handled as personal data per this Policy.

11. Cookies & Analytics

We use strictly necessary cookies to operate the Services. We may use optional analytics to understand usage and improve performance. Where required, we will request consent (via banner or in‑app settings), and you can change your preferences at any time.

12. Security Overview

We implement administrative, technical, and organizational measures appropriate to risk, including encryption in transit, access controls, logging/monitoring, secure development practices, and incident response. See our Security Overview at https://biocv.org/security.

13. California Privacy (CPRA)

For California residents, BioCV acts as a service provider for Customer Personal Information processed to provide the Services. We do not sell or share personal information for cross‑context behavioral advertising. You may exercise access/deletion/correction rights and limit certain uses of sensitive information (where applicable) by emailing info@biocv.org. We will not discriminate against you for exercising your rights.

14. Changes

We may update this Policy from time to time. If material changes are made, we will provide notice (e.g., in‑app or email). Continued use after the effective date constitutes acknowledgment of the updated Policy.