Communications privacy

Who determines the processing

SHINY BRAIN, S.L., Spain, is the entity providing Datafruit. The privacy contact is info@datafruit.es. Its identification details are provided in the legal notice.

When a customer company or farm determines the purpose of notifications and their recipients, that entity acts as controller of those data. SHINY BRAIN, S.L. processes the information on its behalf as a processor, in accordance with the relevant instructions and service agreement.

SHINY BRAIN, S.L. is the controller for its own processing necessary to manage contacts, respond to service enquiries and meet its legal obligations. You can contact us even if you do not know which customer entity is associated with your number; we will help direct your request without disclosing other people's data.

What information the module uses

• Recipients: telephone number and its association with the account, company, farm or growing season for which notifications are configured.
• Operational content: details of the record that triggers the notification, such as the farm, crop, variety, phenological change or treatment and its date, to the extent included in the message.
• Traceability: identifiers and dates of the sending attempt, provider reference and acceptance, sending, delivery, reading or error statuses supplied by WhatsApp.
• Security and support: technical information needed to authenticate communications, prevent duplicates and resolve incidents.

The information comes from the settings and records provided to the service, from recipients when they request or manage notifications, and from statuses returned by the provider. A personal WhatsApp address book is not imported to select recipients.

Purposes and conditions of notifications

The module allows configured operational events to be communicated, the outcome of sending to be checked and incidents to be handled. In this module, data is not used to sell personal information or for advertising campaigns.

Recipients are selected explicitly. Being a farm owner, manager or technician does not, by itself, enrol a person in notifications. Providing another person's telephone number does not replace their permission to receive messages.

The controller must inform the recipient and have an appropriate legal basis: performance of a contract when processing is necessary for a service requested by that person, a legitimate interest where appropriate after assessing their rights, or consent where necessary. In addition, before messaging begins, the recipient's permission required for that channel must be in place and any request to opt out must be respected.

Publishing information about the service or Meta approving a template does not constitute the recipient's consent or automatically activate sending.

Providers and data disclosures

Meta's WhatsApp Business Platform transports notifications and provides their statuses, Amazon Web Services (AWS) runs the transport and protects its credentials, and Supabase handles processing and storage for the module. Each provider receives or processes the information needed for its role, under the applicable terms and data processing agreements.

WhatsApp also processes data for its own purposes, as described in its privacy policy. The terms concerning its role as a processor apply to the processing covered by those terms; not all Meta processing is carried out on behalf of Datafruit.

Using these providers may involve processing or access outside the European Economic Area. Transfers requiring safeguards must be covered by the applicable safeguards, such as adequacy decisions or standard contractual clauses and any necessary supplementary measures. You can request information about the relevant safeguards at info@datafruit.es.

• WhatsApp privacy policy and WhatsApp Business data processing terms.
• AWS data protection information.
• Supabase data processing agreement.

Retention

The configuration and history are kept for as long as necessary to provide the service, check notifications and handle incidents, according to the controller's instructions. Afterwards, the relevant data will be deleted, returned or restricted, except where retention is necessary for legal obligations or liabilities.

Disabling future notifications does not automatically delete their history. Statuses for a delivery already initiated may arrive after new sending is suspended, to complete its traceability. The retention period depends on the type of data and the purpose for which it is kept.

Opting out and your rights

To stop receiving notifications, ask the entity that configured them to remove you, or write to info@datafruit.es with the subject “Opt out of Datafruit notifications” and state the telephone number concerned. You do not need to keep receiving messages or explain why you wish to opt out.

You can exercise rights of access, rectification, erasure, objection, restriction and portability where applicable, and withdraw consent for processing based on it. If the data is processed on behalf of a customer entity, we will coordinate the request with that entity for it to resolve as controller.

The deletion instructions explain what information to provide and how requests are handled. You can also lodge a complaint with the Spanish Data Protection Agency.