Farm Data Processing Agreement (template)

Template under UK GDPR Article 28 — have it reviewed before use.

Between [Farm business name] ("Controller") and AgriculturalAI [legal entity] ("Processor").

1. Subject matter and duration

Processing of parlour data to provide herd monitoring alerts, for the term of the subscription plus the return/deletion period.

2. Nature and purpose

Collection by automatic upload, storage, analysis (including by AI models), display in the portal and alerting.

3. Data and data subjects

Animal and milking records (not personal data) and staff/milker IDs and identifiers, user names and contact details of farm staff using the portal (personal data). Data subjects: the Controller's employees, family members and contractors. No special category data is intended.

4. Processor obligations (Art. 28(3))

1. Process only on the Controller's documented instructions, including on international transfers, unless required by law (in which case it will tell the Controller first unless prohibited).
2. Ensure persons authorised to process are bound by confidentiality.
3. Implement appropriate technical and organisational measures (Art. 32): encryption in transit, access control, per-farm isolation (row-level security), backups, least-privilege access.
4. Engage sub-processors only with the Controller's general written authorisation; current list: Supabase (hosting/database), Cloudflare (website), PayPal (billing data only), [AI provider]. Give 30 days' notice of changes, allowing objection; flow down equivalent obligations and remain liable for them.
5. Assist the Controller in responding to data subject rights requests.
6. Assist with Arts. 32–36 obligations (security, breach notification, DPIAs, prior consultation).
7. Notify the Controller of a personal data breach without undue delay and in any event within 48 hours of becoming aware.
8. At the end of the service, at the Controller's choice delete or return all personal data within 90 days, unless law requires storage.
9. Make available all information necessary to demonstrate compliance and allow for and contribute to audits, on reasonable notice.
10. Immediately inform the Controller if an instruction infringes data protection law.

5. International transfers

Only with appropriate safeguards (UK adequacy regulations, IDTA or UK Addendum to EU SCCs).

6. Controller obligations

The Controller warrants it has a lawful basis and has informed its staff that their milker IDs are processed for this purpose.

7. Liability

As set out in the Terms of Service.

Signed for Controller: ____________ Date: ______   Signed for Processor: ____________ Date: ______