Privātuma politika

This policy explains which personal data the AgroMap telematics service (the website agromap.lt, the shop, the customer application in the browser and the mobile application - together, the Platform) processes, why it processes it, to whom it passes it, for how long it keeps it and what rights you have. It is written under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Lithuanian Law on the Legal Protection of Personal Data.

The policy applies from 14 September 2026.

1. Who is responsible for your data

The data controller is UAB "Servera", company code 304051358, Architektų g. 56-101, LT-04111 Vilnius, Lithuania. For anything to do with data protection write to info@agromap.lt or call +370 5 2444443. We have not appointed a separate data protection officer, because Article 37 of the GDPR does not require one.

The Platform runs on our own servers in Vilnius, Lithuania. The databases, backups and uploaded photographs are kept there too.

2. Two roles: when we are the controller and when we are the processor

This is the most important part of this policy, so it comes first.

Trackers collect data about machines, but machines are driven by people. A tractor's position, route, speed and working hours, combined with who was in the cab that day, become data about a specific person - a driver or another farm worker. That is the most sensitive part of the Platform, and responsibility for it is divided like this:

When we are the processor, we process the data only on the Customer's instructions and only to provide the service: we receive, store and display it, calculate reports and, when the Customer says so, forward it to a system of the Customer's choosing. We do not decide whom or why the Customer tracks, and we do not use this data for our own purposes, apart from the technical upkeep described in Section 3.8.

What this means for the Customer. The Customer, as controller, must have a legal basis for monitoring its machines and employees, must inform drivers before monitoring starts (what is collected, why, for how long it is kept, who has access) and must comply with Article 27 of the Labour Code. The Customer may conclude a data processing agreement with us under Article 28 of the GDPR through the customer system at https://servera.lt (section "Agreements"); we sign it with a qualified electronic signature.

What this means for a driver. If you are a driver and want to know what data about you the farm holds, or to have it corrected or deleted, contact your employer - it is the controller and the only one who can decide. We help it carry out your request. If you contact us directly, we pass your request on to the Customer and tell you that we did (see Section 9).

3. What data we process, why and on what basis

3.1. Account and registration

At registration we ask for: first and last name, e-mail address, telephone, address, city and postcode; for a company or farm, its name, code and VAT number; and a password. We record when you agreed to the Terms and the privacy policy and whether you ticked the consent to receive news. We do not ask for a personal identification number.

We use this data to create the account and sign you in, to confirm the e-mail address, to issue invoices and to communicate with you. Basis: performance of the contract (Article 6(1)(b) GDPR); keeping the details on invoices - legal obligation (Article 6(1)(c)).

The Account owner may upload the farm's logo and, in the mobile application, a profile picture.

3.2. Orders and invoices

When you order in the shop we record: the order number, items, terms and prices, the delivery address, telephone and note for the courier, the payment method, the Stripe payment identifier (not card details), the invoice number and payment date, and the steps of preparing and dispatching the equipment.

Invoices are issued and payments accounted for by our own customer and accounting system servera.lt. We pass to it your e-mail, first and last name, company name, code and VAT number, telephone, address, country and language, and the contents of the order. The note for the courier is not passed to it.

Basis: performance of the contract; keeping accounting records - legal obligation under the Lithuanian laws on financial accounting and VAT.

3.3. Devices and IoT SIM cards

For every tracker we keep: IMEI, model, firmware version, configuration, when it first and last connected, and which account it belongs to. For every IoT SIM card: ICCID, IMSI, telephone number (MSISDN), tariff plan, connection status, which tracker it is working in, the data volume used per day and the country, and the configuration commands sent over the SIM card together with the tracker's replies.

This is needed to keep the tracker connected to the Platform, to notice a tracker that has stopped working or is sending unusually much data, to top up the data plan in time and to configure the tracker remotely. Basis: performance of the contract and our legitimate interest in managing our equipment and connectivity estate (Article 6(1)(f)).

We do not store the PIN and PUK codes of SIM cards: they are held in the network operator's portal and shown to our staff only on request, and every viewing is logged. The tracker's configuration password is stored encrypted.

3.4. Telematics data (processed on the Customer's behalf)

A tracker regularly sends: time, GPS coordinates, altitude, speed, heading, number of satellites and accuracy, ignition and movement state, odometer, battery and external supply voltage, GSM signal and operator and, depending on the model and wiring, fuel level, engine speed and other CAN bus parameters. Alongside it we keep the tracker's original packet (in hexadecimal form) with the tracker's network IP address, so that data can be recovered after a processing error.

From this data the Platform calculates what you see on screen: position on the map, trip history, working hours, fuel consumption and reports.

A tracker does not send the driver's identity - the Platform processes no card, iButton or RFID identifiers. A driver is linked to a machine only when the Customer assigns them on the Platform.

Basis: the Customer's instruction under the contract (Article 28 GDPR). The legal basis for the monitoring must be held by the Customer.

3.5. Machines, drivers and photographs (processed on the Customer's behalf)

The Customer enters machine data (registration number, VIN, make, model, year, name, notes, fuel tank capacity) and driver data (first and last name, telephone, notes, photograph, assignment to a machine) into the Platform. Up to 12 photographs can be uploaded per machine.

The server re-encodes every uploaded photograph into a new file and strips all hidden metadata (for example the place it was taken), keeps it outside any directory reachable from the internet and shows it only to a signed-in user of that account.

Basis: the Customer's instruction under the contract (Article 28 GDPR).

3.6. Members and invitations

The Account owner may invite other people by e-mail. We record the invitee's e-mail address, the rights granted (view only or edit) and the status of the invitation. An invitation is valid for 48 hours. An accepted invitation becomes a Member account with the same registration data as in Section 3.1. Basis: performance of the contract.

3.7. Integration keys and forwarding to GEOFACE

The Account owner may create an integration key with which third-party software reads the account's data (machine list, positions, routes, fuel data). We record when the key was created, when it was last used and whether it has been revoked.

With such a key the Customer may order continuous forwarding of data to geoface.com or another system of its choice. What is forwarded: the tracker number, time, coordinates, altitude, speed, heading, satellites, ignition state and fuel or CAN values. Drivers' names and machine registration numbers are not forwarded. Forwarding happens only when the Customer has ordered it, and only for the trackers the Customer named. The Customer can stop it at any time. Processing in the receiving system is the responsibility of the Customer and of that system's operator.

Basis: the Customer's instruction under the contract.

3.8. Security and technical records

To keep the Platform secure and working we process:

• sign-in tokens (valid 24 hours) and refresh tokens (90 days), stored only as hashes, with the browser or device name and a random device identifier;
• the public key for biometric sign-in (WebAuthn). We receive no fingerprint or face data - it never leaves your device;
• the number of sign-in attempts per IP address, to stop password guessing (sign-in - 30 attempts per 5 minutes, registration - 5 per hour);
• the Cloudflare Turnstile bot check on the sign-in, registration and contact forms;
• a log of our staff's actions in the administration area (who, what, when, from which IP address and browser);
• server access logs with IP addresses;
• in password-reset and password-changed e-mails we state the IP address, browser and operating system the action came from, so you can recognise an action that was not yours.

Basis: our legitimate interest in the security of the Platform and of accounts (Article 6(1)(f)). We do not accumulate the IP addresses of successful sign-ins and do not geolocate IP addresses.

3.9. Contact form and correspondence

The contact form asks for a name, an e-mail address and a message, and optionally a company. We also record the IP address so that the form cannot be used for bulk sending (no more than 5 messages per hour). We keep e-mails, calls and support requests made through https://servera.lt so that we can reply and later recall what was agreed. Basis: legitimate interest in answering enquiries and, if you are a Customer, performance of the contract.

3.10. News and offers

We send news about services and offers only to those who ticked the consent for it at registration. You can withdraw the consent at any time by writing to info@agromap.lt, and every such e-mail will carry an unsubscribe link. Withdrawal does not affect the service. Basis: consent (Article 6(1)(a)). Necessary messages about the account, orders, invoices and service changes go to all Customers, because the service could not work without them.

4. To whom we pass data

We do not sell data and do not pass it to advertising networks. Data reaches only the following recipients, and only as much as their role needs:

Only those of our staff who need it to provide the service have access to Platform data, and their actions in the administration area are logged.

5. Transfers outside the European Economic Area

The Platform and its data are in Lithuania. Data can leave the EEA only through the recipients listed in Section 4: Cloudflare and Esri (USA), Stripe group companies (USA), 1GLOBAL's sub-processors (UK, USA, Philippines), the OpenStreetMap Foundation (UK) and Google (USA). Such transfers rely on European Commission adequacy decisions (the UK; US companies certified under the EU-US Data Privacy Framework) or on the Commission's standard contractual clauses (Article 46(2)(c) GDPR). You can obtain a copy of these safeguards by writing to info@agromap.lt.

6. How long we keep data

When a period ends the data is deleted or anonymised so that you can no longer be identified.

7. How we protect data

• Passwords are stored only as hashes (bcrypt); we cannot see or recover them.
• The connection between your browser and the Platform is encrypted (HTTPS). Trackers talk to the server in the manufacturer Teltonika's protocol over the mobile network; those packets contain no names, only the tracker number and measurements.
• Sign-in tokens are valid for 24 hours; refresh tokens for 90 days, stored only as hashes and revoked on sign-out.
• Biometric sign-in (Touch ID, Windows Hello, Android) is based on the WebAuthn standard: the server holds only a public key, and the biometric data stays on your device.
• Sign-in, registration and other forms are protected against automated attempts (per-IP limits and Cloudflare Turnstile).
• Photographs are re-encoded, stripped of metadata, kept outside any internet-reachable directory and shown only after checking who they belong to.
• The PIN and PUK codes of IoT SIM cards are not stored by us; tracker configuration passwords are stored encrypted, and every viewing is logged (who, when, from which IP address).
• Every staff action in the administration area is logged with IP address and browser.
• A Member's access (view only or edit) is enforced on the server, not just on screen. An integration key can reach only that Customer's machines.
• An account starts working only once the e-mail address has been confirmed.

If a personal data breach occurs that is likely to result in a high risk to your rights, we will notify you and the State Data Protection Inspectorate within 72 hours, as Articles 33 and 34 of the GDPR require. Where we act as processor, we notify the Customer of a breach without delay.

8. Your rights

Where we are the controller (account, invoice details, orders, correspondence) you have the right to:

• access your data and get a copy of it (Article 15 GDPR);
• rectify inaccurate data - you can change your name, contact details and address yourself in your profile (Article 16). The company name and code cannot be changed in the profile because they are on invoices already issued - write to us;
• erase data when it is no longer needed or you have withdrawn consent (Article 17). We cannot erase data on invoices for 10 years;
• restrict processing (Article 18);
• receive the data you provided in a structured, machine-readable format and move it elsewhere (Article 20);
• object to processing based on legitimate interest, on grounds relating to your particular situation (Article 21);
• withdraw consent to receive news at any time (Article 7(3)).

Send your request by e-mail to info@agromap.lt from the address in your account, or by post to the address in Section 1. If we cannot be sure the request is yours, we will ask you to confirm your identity. We reply within 1 month at the latest; a complex or large request may take up to 2 further months, of which we will tell you. Requests are handled free of charge unless they are manifestly unfounded or repetitive.

9. Rights of drivers and the Customer's other employees

The controller of the telematics and driver data is the Customer (the farm or company), so the rights listed in Section 8 are exercised through the Customer for that data. Contact your employer. If we receive a driver's request directly, we pass it to the Customer within 5 working days and tell you to whom we passed it. At the Customer's request we hand over or delete a particular driver's or machine's data within 30 days.

10. Children and automated decisions

The Platform is meant for farms and companies; we do not create accounts for persons under 18. We take no decisions with legal or similarly significant effect on you by automated means alone, and we do not build profiles. Reports (working hours, fuel consumption) are calculations from tracker data that the Customer evaluates itself.

11. Complaints

If you think we are handling your data improperly, write to us first - most questions are settled by correspondence. You also have the right to lodge a complaint with the supervisory authority: the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, tel. +370 5 271 2804, e-mail ada@ada.lt, https://vdai.lrv.lt.

12. Cookies and browser storage

What the Platform writes to your browser and why is described in the separate cookie policy. In short: the Platform sets no cookies of its own and has no analytics or advertising tools.

13. Changes

When what we process or how we process it changes, we update this policy and the date at the top. We notify Customers of material changes by e-mail at least 30 days in advance. Earlier versions are available on request.