- Clear and timely information on what is collected and how it is used
- Access, in portable format, to Users’ personal information when requested
- Rights to Object (to our use), Rectify (incorrect information), and Delete (including to request restriction of certain uses)
- Limited, Lawful, and Low-Risk:
- Users’ information collected by Bushel Plus is limited to that needed to offer and carry out the Purposes, as agreed to between each User and Bushel Plus, and for meeting the legitimate interests of Bushel Plus and the Users in offering, providing, and receiving Bushel Plus services,
- Users’ information that is collected relates primarily to Users’ farm/business information, information about the Bushel Plus product used by the User, and the (non-personal) data it collects, all of which is not sensitive data1 and therefore is of very low risk to implicate the rights and freedoms of any User
- Bushel Plus does not:
- use any new technologies are used for informational analysis of any personal information
- do any automated decision-making that impacts any legal rights of any User and any decision-making is strictly required to carry out the Purposes
- Monitor Users in any way
- Transfer data to any third party, other than those referred to below, all of which we obtain consent in advance and are necessary for the Purposes
- Bushel Plus uses a given User’s personal data only occasionally, that is when a request for information is made, or a non-routine communication is made
- Security and Breaches:
- Bushel Plus shall provide a reasonably secure means in which to store data, as well as to transfer data to Bushel Plus via the BP App
- Bushel Plus shall notify the User and the relevant Authority in the EU in the event of any breach of security, or other unauthorized processing of any User’s personal information, that is likely to result in risk to that User’s rights and freedoms.
How We Collect User Information
The Type of Information We May Collect
Bushel Plus collects the following personal information directly from Users upon registering for the BP App:
- User Name
- User’s Farm or Business Address [not the app]
- Serial # and purchase location of the Bushel Plus Product used by the User
- Email address of the User
- Phone number
How We Use and Disclose Information
- Use by Bushel Plus in the Performance of Bushel Plus Services. On occasion, we may use specific personal information to fulfil the Purposes when, for example, we receive a request from a User to access information regarding their grain (or other agricultural product). Occasionally, we will also use this information to improve the quality of our products and services.
- System Updates. Time-to-time send information regarding product updates or issues and to ensure contact information is up-to-date
- Investigations and Protection. Bushel Plus may release User information when we believe it is appropriate or required in order to comply with the law; to investigate, prevent, or take action regarding illegal activities; to detect or investigate suspected fraud; in situations involving potential threats to the physical safety of any person or other similar exigent circumstances; to investigate or prevent violations of Bushel Plus’s Customer Agreements or non-payment, including applicable Bushel Plus Terms and Conditions, or to enforce provisions thereof; to comply with any other agreement that we may have entered into with you; or to protect the rights, property or safety of Bushel Plus and others. Bushel Plus may cooperate with and disclose information to any authority, government official or third party, without giving any notice, in connection with any investigation, proceeding or claim arising from an asserted illegal action or infringement.
- Third-Party Service Providers. Bushel Plus engages other companies to perform the tasks indicated below on our behalf and may need to share some of your information with them to provide products and services to you. This is limited to storage and analysis of data through Google Cloud, and, if applicable, processing credit card payments.
Bushel Plus owns the databases and all rights to our applications and software, and reserves the right to aggregate and analyze anonymized data for its own purposes.
How We Keep User Information Secure
The security of User personal information is important to us. We implement reasonable security measures to protect the security of your information both online and offline, and we are committed to the protection of User personal information. Only those individuals at Bushel Plus that have an obligation to maintain confidentiality may access User personal information.
When we handle User information on the Internet we encrypt the transmission of that information using secure socket layer technology (“SSL”). User information is encrypted for transmission and storage. Bushel Plus has redundant and distributed systems, and other system measures, that provide for ongoing confidentiality, integrity, availability and resilience.
However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect User information, we cannot guarantee that unauthorized access, hacking, data loss or other breaches will never occur.
We will notify any User from whom we obtain information in the event of an unauthorized access or disclosure of such information that we believe will likely give rise to a risk to their rights and freedoms.
If you have any questions about how we strive to keep information secure, you can contact us at firstname.lastname@example.org.
Storage and Transfer of Your Information
We may transfer, store and process Users’ personal information to or on computers or computer storage systems located in the United States, Europe, or Canada. In particular, we are a Canadian company and, accordingly, we may access that information therefrom, and we also use third-party cloud storage facilities for data storage. Accordingly, such information may be subject to the laws of those countries.
Canada was recognized as ensuring adequate level of protection for personal data. as See https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en.
Bushel Plus’s technical infrastructure relies on data centers and cloud service providers that are located outside of Europe, hosted in Google Cloud. The European Commission has concluded that the EU-U.S. Privacy Shield Framework provides an adequate mechanism to allow EU companies to comply with requirements under EU Data Protection Legislation in connection with the transfer of personal data from the European Union to the United States. Google LLC is certified under both the EU-U.S. and Swiss-U.S. Privacy Shield frameworks and our certifications can be viewed on the Privacy Shield list.
While there is no fixed period for storage of User’s data, we will remove User data upon any of the following:
- A request for deletion from the User to our DPO
- An objection from a User to our DPO in respect of which we believe deletion will be the sole option for resolution
- Bushel Plus learns that any User data has been collected unlawfully
- A request for deletion from any supervisory authority or legal authority (e.g. police, third-party having applicable court order) having sufficient legal authorization
- Bushel Plus is made aware that User data should be deleted to ensure compliance with an applicable legal obligation.
Bushel Plus supports Users’ rights in the following ways:
- Right to Access and Communication: Upon written request to our DPO having sufficient information to assist Bushel Plus in identifying the requested data, Users are entitled to a portable copy of the personal data stored by Bushel Plus relating to that user, the specific purposes for which it was collected and processed (if any), unless Bushel Plus is unable to fulfill the request, in which case it will provide a clear indication regarding such inability.
- Right to Deletion, Rectification, and Restriction: Upon receipt of a written request of a User for any of deletion, rectification, or restriction to Bushel Plus via the DPO, provided such request includes sufficient information to assist Bushel Plus in identifying the data to which the request applies, as determined in Bushel Plus’s reasonable discretion, Bushel Plus will delete, rectify, or, to the extent possible, restrict specific uses of that requesting User’s personal information. Where restriction is not possible, the requesting User will have the option to request deletion of such User data.
- Right to Object to Automated Decision Making and Profiling: On occasion, Bushel Plus may identify Users that share certain characteristics (such as location in a particular jurisdiction, use of a particular type of Bushel Plus product, similar grain analysis results, or other characteristics) to, for example, contact regarding the Bushel Plus services or other services or information that may be of interest to Users having the shared characteristic. Bushel Plus deems these uses to be necessary to carry out the services associated with the Purposes, and in respect of which Bushel Plus has agreed to provide. Users may object to this type of decision-making upon making a written request to the Bushel Plus DPO, provided such request includes sufficient information to assist Bushel Plus in identifying the data to which the request applies, as determined in Bushel Plus’s reasonable discretion.
- Notification of Breaches. Bushel Plus shall notify the User in the event of any breach or unauthorized access to User data that results in risk to the User’s rights or freedoms. Bushel Plus will provide the following information: the existence and nature of such breach, our DPO, possible likely consequences, measures taken to address or, where possible, mitigate the breach.
Data Protection Officer (or “DPO”)
Bushel Plus encourages Users to contact the Bushel Plus Data Protection Officer (dpo@bushelplus) for issues, information, or policies relating to User personal information that is collected or processed by Bushel Plus. Furthermore, the User has the right to lodge a complaint about Bushel Plus’s data protection with an applicable supervisory authority with jurisdiction to receive such a complaint. We note that for European Users, there is no requirement for Bushel Plus to have a European representative (as Bushel Plus will only engage in occasional use of any specific User’s information, it does not collect any sensitive data as defined by Articles 9(1) of the European GDPR), however, the DPO will respond to all inquiries from European or other Users.
Questions and Concerns
1 Bushel Plus does not collect any personal information described as a “special category” of data as referred to by Article 9(1) of the GDPR (European Data Protection Regulations). That is, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.