ENBHS
Sign inSign up
BHSEN
DirectoryMapKnowledgeAboutSign inSign up →

Privacy policy

How AgroTour Connect collects, uses and protects your personal data in line with GDPR and BiH LPPD.

Last updated: 2026-10-12

1. Who we are

AgroTour Connect (agrotour.eu) is operated by UAB „Silotech“ within the SMART ERA Challenge #7 grant. UAB „Silotech“ is the controller of the personal data described in this policy.

  • UAB „Silotech“
  • Company code: 306971572
  • VAT number: LT100020253611
  • Registered office: Ateities g. 2, Pakrovų k., LT-33211 Molėtų r., Lithuania
  • Contact for data protection: support@agrotour.eu

We have not appointed a data protection officer. Write to the address above about any data protection matter.

2. What data we collect

  • Account data: first and last name, email address, phone number (if you give one), password (stored hashed), preferred language, your role on the platform, the time you accepted the terms and this policy, and your marketing choice.
  • Organization profile: business name, type, municipality, descriptions, offerings, photos and short videos, location on the map, and the contact details and business identifiers you enter (email, phone, website, street address, legal form, JIB, VAT status). Some profiles are prepared by our coordinators on the business's behalf, from information the business gives them; the owner can review and correct it.
  • Content you create: knowledge-hub articles, packages, messages to other members and partnership requests.
  • Enquiries sent through the public pages: if you use the “Send an enquiry” form on a profile or a package, we store your name, email address, phone (if you give one), the message text and the time you confirmed consent, solely so the owner can reply to you. No account is needed. Your IP address is used only momentarily, to limit abuse, and is not stored with the enquiry.
  • API access requests: the email address, organization and message you send through the “Request API access” form.
  • AI assistant, where available: your questions, the conversation history, files you attach (for example a PDF or a photo) and usage records (feature, token counts, time).
  • Sign-in security: staff accounts (moderators, coordinators, administrators) receive a one-time code by email. We store the code only as a hash and it is valid for 10 minutes.
  • Technical data: IP address, browser type, server logs and error reports, for security and fixing faults. When your password changes, the security email we send you includes the IP address and browser the change was made from.
  • Page views: we count how many times a profile, package or article is opened per day. The count holds no identifier of the reader.

Account data is required to open an account, and name, email and message are required to send an enquiry. Without them we cannot provide that service.

3. Purposes and legal bases

  • Your account and use of the platform: performance of the contract with you (GDPR Art. 6(1)(b)).
  • Publishing your organization profile in the directory, on the map and in search, and sharing it with trusted partner platforms: Art. 6(1)(b), because this is the service you register for. Contact details are shown only to signed-in members and to those partners.
  • Profiles prepared by our coordinators: steps taken at the business's request before and during registration (Art. 6(1)(b)).
  • Enquiries from the public pages: the legitimate interest of the owner in replying to you (Art. 6(1)(f)), together with the consent you confirm in the form. We do not verify the address you enter, so that consent corroborates the processing rather than being its sole basis.
  • API access requests: our legitimate interest in answering them (Art. 6(1)(f)).
  • Page view counter: our legitimate interest in showing owners and grant evaluators how often content is read (Art. 6(1)(f)). No personal data is stored.
  • AI assistant and writing aids (drafts, translation, summaries): Art. 6(1)(b), when you choose to use them.
  • Account emails and notifications (confirmation, password change, security notices, enquiries, moderation, deadline reminders): Art. 6(1)(b). You can switch off each notification category in Settings.
  • Copy of the signup confirmation email: when an account is registered, a copy of its signup confirmation email is also sent to the platform operator's mailbox. During onboarding we often register accounts on an organization's behalf, and we need the link to complete the verification. Only this email is copied, never password-reset or email-change emails, and the copy is not used for anything else. Legal basis: our legitimate interest in onboarding the organization (Art. 6(1)(f)).
  • Security: staff sign-in codes, the bot check on sign-in and registration, request rate limits and error monitoring rest on our legitimate interest in keeping the service and its accounts secure (Art. 6(1)(f)).
  • Coordinator access: grant coordinators and evaluators with the coordinator role may connect an AI assistant of their choice to the platform through an authorized connection (MCP with OAuth). It reads the coordinator view, which does not include owners' email addresses, phone numbers or the content of enquiries, and can carry out a small set of logged actions. Legal basis: our legitimate interest in monitoring and coordinating the grant project (Art. 6(1)(f)).
  • Record of a completed erasure: our legitimate interest in being able to prove that a deletion was carried out (Art. 6(1)(f)).
  • Profile tips: after you register, we send up to three emails on using the platform (on days 1, 5 and 12). Legal basis: our legitimate interest in helping members use the service they signed up for (Art. 6(1)(f)). Every email has a one-click unsubscribe link, and the same emails can be switched off in Settings (“Profile tips”). The record of which emails were sent to you is kept until your account is erased and is included in your data export.
  • Marketing communications: sent only with your explicit consent (Art. 6(1)(a)).

Where we rely on legitimate interest, you may object (see section 6).

4. Recipients and processors

We share personal data only with the following processors, each bound by a data processing agreement, and only for the purpose named:

  • Vercel (hosting): our application servers run in the EU (Stockholm); pages are delivered through Vercel's global network.
  • Supabase (database, sign-in and file storage): our project is hosted in the EU (Frankfurt).
  • Resend (sending email).
  • Google, Gemini API (AI assistant, writing aids and translation): receives the text and files you submit to these features, only when you use them.
  • Scaleway (France, EU): turns published profile, package and article texts and search queries into vector representations for search. Contact details are not part of these texts.
  • GlitchTip (error monitoring), self-hosted by UAB „Silotech“ on Fly.io infrastructure. Error reports exclude cookies and authorization headers.
  • Cloudflare: Turnstile checks that a person, not a bot, signs in or registers; Cloudflare Stream stores and plays profile and package videos.
  • OpenStreetMap Foundation: your browser loads map tiles directly from OpenStreetMap, which therefore receives your IP address. Address search is sent from our server and does not identify you.

Other recipients: signed-in members see published profiles including their contact details; the owner of a profile or package receives the enquiries sent to it; trusted partner platforms (in particular the SMART ERA Data Platform) receive published organization records through an authenticated interface; coordinators and administrators of the platform see what their role requires.

Some of these providers are established, or may process data, outside the EU/EEA, in particular in the United States. Such transfers take place on the basis of the European Commission's standard contractual clauses or an adequacy decision (including the EU-US Data Privacy Framework), as applicable. You can ask for information about these safeguards at support@agrotour.eu.

5. Retention and deletion

  • Account and profile: kept while the account exists. When you schedule deletion in Settings, a 14-day window starts in which you can sign in and cancel. After it, an automatic daily job deletes the account, the profile, your content and your stored files. We then keep only a minimal record (a one-way hash of your email address, the former account identifier, role and date) as proof that the deletion was carried out.
  • Enquiries: permanently deleted 12 months after we receive them. To have yours removed sooner, write to support@agrotour.eu.
  • API access requests: deleted 180 days after we have handled them.
  • AI conversations and attachments: kept until you delete the conversation or your account. Files you attach but never send are removed after one day.
  • Staff sign-in codes: valid for 10 minutes and replaced by the next code.
  • Coordinator connections: expired codes and tokens are removed daily, revoked connections 14 days after revocation, and connection registrations that were never used after 7 days.
  • Page view counts: deleted after 400 days.
  • Data exports: one export per 24 hours; we keep a record of the request to apply this limit.
  • Logs and error reports: kept for a limited period for security and fault-finding, then deleted automatically by the hosting and monitoring services.

6. Your rights

  • Access (Art. 15) and portability (Art. 20): download a JSON export of your data from Settings.
  • Rectification (Art. 16): edit your profile data directly in the dashboard.
  • Erasure (Art. 17): schedule deletion in Settings; it is carried out after the 14-day cancellation window.
  • Restriction (Art. 18) and objection (Art. 21): write to support@agrotour.eu.
  • Withdrawing consent: you can withdraw any consent at any time, for example by switching off email notifications in Settings or by writing to us. Withdrawal does not affect processing carried out before it.
  • Automated decisions: you are not subject to decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22). Profile verification and moderation are decided by people.

For anything you cannot do in Settings, write to support@agrotour.eu. We reply within one month and may ask you to confirm your identity.

7. Complaints

You can lodge a complaint with a supervisory authority. Because the controller is established in Lithuania, the lead authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt). Your right to lodge a complaint with the Personal Data Protection Agency of Bosnia and Herzegovina (azlp.ba), or with the supervisory authority in the EU country where you live or work, remains preserved.

8. Cookies

We use only essential cookies and browser storage for sign-in, security and language preferences. See the Cookie policy for the full list.