Courtesy translation. In the event of any discrepancy, the Spanish version prevails and is the only binding one.

Version 1.0 · Last updated: July 24, 2026

Privacy and Data Protection Policy — BotanikTrace

Last updated: 24 July 2026 Version: 1.0 (draft for legal review prior to publication)

⚠️ Note on this document. This draft was prepared following the usual standards of the GDPR (EEA/EU and United Kingdom), the CCPA/CPRA (California), the LGPD (Brazil), Law 25.326 (Argentina) and equivalent regulations in other Spanish- and Portuguese-speaking jurisdictions. Before publishing it, complete the fields in brackets [ ], formally appoint (where applicable) a Data Protection Officer (DPO) or EU/UK representative, and validate with local legal counsel in every country where BotanikTrace has users — particularly because the data relates to a regulated activity (cannabis cultivation).

This Privacy Policy ("Policy") describes how [FULL LEGAL NAME] ("BotanikTrace", "the Company", "we"), with address at [REGISTERED ADDRESS], collects, uses, shares and protects the personal data of those who use our website, panel (panel.botaniktrace.com), applications, APIs and associated devices (together, the "Service"). It forms an integral part of the Terms and Conditions.

Table of contents

1. Scope and controller
2. Data we collect
3. Purposes and legal bases for processing
4. IoT device and sensor data
5. Photographic evidence and geolocation
6. Public passports and data exposed without authentication
7. Who we share data with
8. International data transfers
9. Data retention
10. Security measures
11. Cookies and similar technologies
12. Your rights over your data
13. Specific rights — European Union / EEA / United Kingdom (GDPR)
14. Specific rights — California (CCPA/CPRA)
15. Specific rights — Brazil (LGPD)
16. Specific rights — Argentina (Law 25.326) and other Latin American jurisdictions
17. Minors
18. Security incident notification
19. Changes to this Policy
20. Contact and Data Protection Officer

1. Scope and controller

1.1. This Policy applies to personal data processed through the Service, including the marketing site (botaniktrace.com), the application panel (panel.botaniktrace.com), the APIs (/api/*), the devices and gateways that connect to the Service, and the associated communications (email, Telegram, Discord).

1.2. BotanikTrace acts as controller of account personal data (for example, your registration, billing and platform usage data). With respect to the Cultivation Data that an Organisation uploads about third parties (for example, the name of a witness to a destruction, or the contact details of a recipient in a distribution document), BotanikTrace acts as processor on behalf of the Organisation, which is the controller of that data vis-à-vis those third parties. If you administer an Organisation containing third-party data, you are responsible for having your own legal basis to process it and for meeting your own information obligations towards those people.

1.3. If you act on behalf of an Organisation (company, cooperative, association), this Policy applies without prejudice to any data processing agreements (DPA) that may additionally be entered into between the Organisation and the Company where the applicable regulation (for example, the GDPR) so requires.

2. Data we collect

2.1. Data you provide directly

• Account and profile data: name, email address, password (stored with a bcrypt hash, never in plain text), organisation, time zone, preferred language, units of measurement.
• Verification and security data: email verification status, 2FA (TOTP) secret/status, session history and access attempts (for anti-fraud rate limiting).
• Billing data: contracted plan, billing cycle, payment history and transaction identifiers provided by the payment gateway (MercadoPago/Stripe). We do not store full credit/debit card numbers; that data is processed directly by the payment gateway.
• Messaging links: Telegram and/or Discord account identifiers, only if you choose to link them.
• Cultivation Data: information about plants, batches, rooms, harvests, laboratory analyses, licences, automation rules, photographic evidence and destruction records that you upload to the Platform.
• Communications: the content of support tickets, emails or messages you send us.

2.2. Data we collect automatically

• Technical and usage data: IP address, device and browser type, operating system, pages visited, timestamps, session identifiers, and audit logs of actions within the Platform.
• IoT device data: sensor readings (temperature, humidity, CO₂, VPD, EC, N-P-K, etc.), hardware identifiers, connectivity status (last_seen) and metadata of the HMAC-signed requests. See Section 4.
• Cookies and local storage: see Section 11.

2.3. Data we receive from third parties

• Payment confirmations and subscription status from MercadoPago and/or Stripe (via signature-validated webhooks).
• Linking information from Telegram and/or Discord when you connect your account (chat/user identifier), in accordance with those platforms' authorisation flows.

2.4. Special categories of data

2.4.1. In principle, the Service is not designed to collect special categories of personal data (for example, health data, ethnic origin, political opinions or trade union membership) from Users. However, we note that:

a) the geolocation data associated with photographic evidence of a cultivation site (Section 5) may be considered sensitive for security reasons, since it reveals the location of a regulated activity; and

b) in jurisdictions where the cultivation, possession or use of cannabis is linked to a medical condition or a patient register (for example, medical cannabis programmes), the data a User chooses to upload could constitute health-related data under the GDPR, the LGPD or other applicable regulations, and will be processed with the enhanced safeguards that such regulations require (specific legal basis, minimisation, additional access controls).

2.4.2. We ask Users not to upload special categories of third-party data (for example, a third party's health data) unless there is a specific legal basis and a strict need for the traceability purpose pursued.

3. Purposes and legal bases for processing

Where the legal basis is consent, you may withdraw it at any time without affecting the lawfulness of prior processing, through your account settings or by contacting us (Section 20).

4. IoT device and sensor data

4.1. Devices (sensors, RS-485 gateways, Raspberry Pi) transmit HMAC-signed measurements, together with their hardware identifier and a timestamp, to our ingestion endpoints (/api/metrics/ingest.php). This data is validated (signature, plausible range, rate limit) before being stored.

4.2. This environmental data, on its own, generally does not constitute personal data. However, when combined with the identity of the User/Organisation that owns the Device and with geolocation data (Section 5), it may become indirectly identifiable, and in that case it is processed with the same safeguards as the rest of the Cultivation Data.

4.3. The User is responsible for the physical security of their Devices and their credentials (device_secret, API-Key); the Company cannot protect data leaked through the loss or compromise of credentials outside our systems.

5. Photographic evidence and geolocation

5.1. When you upload photographic evidence with geolocation coordinates (latitude/longitude), we treat those coordinates as potentially sensitive personal data (they reveal the location of a regulated activity) and store them with the same access controls as the rest of the Cultivation Data (multi-tenant isolation, roles and permissions).

5.2. We do not use geolocation coordinates for advertising and do not share them with third parties, except: (a) where you choose to include them in a public passport (Section 6) or in a report you export; (b) where necessary to comply with a legal obligation; or (c) where you expressly authorise it.

5.3. You may choose not to include geolocation when uploading evidence; this does not affect any other functionality of the Service.

6. Public passports and data exposed without authentication

6.1. As detailed in Section 13 of the Terms and Conditions, the Platform allows public passports to be generated that are accessible without logging in. Any personal data you choose to include in a public passport (for example, the name of a person in charge, or location coordinates) will become publicly accessible on the internet.

6.2. It is your responsibility, as a User or Organisation, to assess what information you include in a public passport, minimising third-party personal data that is not strictly necessary to disclose. The Company does not control subsequent third-party access to a public link once generated and shared.

7. Who we share data with

We share personal data only in the following circumstances:

• Infrastructure providers and sub-processors: hosting/cloud, database, transactional email (SMTP) and file storage providers, under contractual agreements requiring adequate levels of security and confidentiality. [To complete: list the specific providers, e.g. hosting/cloud provider, transactional email provider].
• Payment gateways: MercadoPago and/or Stripe, to process subscriptions and payments, in accordance with their own privacy policies.
• Messaging services: Telegram and/or Discord, only if you link your account, and only the information necessary to deliver notifications.
• Other members of your Organisation: according to the role and permissions your Organisation's administrator assigns to you.
• Public or regulatory authorities: where a valid legal obligation exists (court order, legally grounded request), or where necessary to protect the rights, property or safety of the Company, Users or third parties. We will notify you of such requests unless prohibited by law.
• In the context of a corporate transaction: merger, acquisition, reorganisation or sale of assets, subject to the acquirer assuming equivalent data protection commitments.

We do not sell personal data to third parties for advertising purposes, nor do we share Cultivation Data for commercial purposes unrelated to providing the Service, except in aggregated/anonymised form in accordance with Section 10.3 of the Terms and Conditions.

8. International data transfers

8.1. Our infrastructure and providers may be located in countries other than yours, including transfers outside the European Economic Area (EEA) or the United Kingdom.

8.2. When we transfer personal data of EEA/UK users to countries that do not benefit from a European Commission adequacy decision, we implement appropriate safeguards under the GDPR, such as the Standard Contractual Clauses (SCC) approved by the European Commission, and transfer impact assessments where applicable.

8.3. You may request further information about the specific safeguards applied to your case by contacting us (Section 20).

9. Data retention

9.1. We retain personal data for as long as necessary to fulfil the purposes described in this Policy, and then delete or anonymise it, unless the law requires a different period.

9.2. Indicative periods (to be completed/adjusted according to the final internal policy):

9.3. As explained in Section 12 of the Terms and Conditions, certain regulatory traceability records may be retained beyond a deletion request, to the extent permitted by the exceptions to the right of erasure provided for in Art. 17(3) GDPR, the CCPA/CPRA, Law 25.326 and equivalent regulations, because they constitute information subject to a legal retention obligation.

10. Security measures

We implement technical and organisational measures that are reasonable and proportionate to the risk, including:

• Password hashing with bcrypt (never plain text).
• Optional two-factor authentication (2FA/TOTP) for Users.
• Secure session cookies (HttpOnly, SameSite) and token expiry.
• CSRF protection on data-modifying operations.
• Logical multi-tenant isolation: one Organisation cannot access another's data.
• Hash-chained audit log, which makes unauthorised alterations of the history detectable.
• HMAC signing on sensor data ingestion and signature validation on payment webhooks.
• HTTP security headers and Content Security Policy (CSP) on the server.
• Access attempt limits (rate limiting) to mitigate brute-force attacks.
• Access controls based on roles and granular permissions, with an option for dual approval on sensitive operations.

These measures are described for information purposes and do not constitute a guarantee of absolute security. No system is completely invulnerable; see also Section 18 on incident notification.

11. Cookies and similar technologies

11.1. We use cookies and similar technologies (localStorage, session tokens) to: (a) keep you signed in; (b) remember preferences (language, units); (c) protect against CSRF; and, where enabled, (d) aggregated usage analytics.

11.2. Strictly necessary cookies (session, security/CSRF) are set without requiring prior consent, as they are indispensable for the operation of the Service, as permitted by the applicable cookie regulations (for example, the ePrivacy Directive in the EU).

11.3. Non-essential cookies (analytics, non-functional preferences), if any, will be set only with your prior consent, manageable through a cookie preferences panel. [To complete according to the analytics/marketing tools actually used, if any, and to enable a cookie consent banner compliant with the GDPR/ePrivacy for EEA/UK users, and with the LGPD for users in Brazil].

11.4. You can manage or block cookies from your browser settings, although this may affect the operation of the Service.

12. Your rights over your data

Regardless of your location, and to the extent that local regulations grant them to you, you may exercise the following rights over your personal data:

• Access: obtain confirmation of whether we process your data and a copy of it.
• Rectification: correct inaccurate or incomplete data.
• Erasure / deletion: request the deletion or anonymisation of your data, subject to the legal exceptions described in Section 9.3.
• Portability: receive your data in a structured, commonly used and machine-readable format (JSON), and transmit it to another controller where technically feasible.
• Objection: object to the processing of your data based on legitimate interest or for direct marketing purposes.
• Restriction of processing: request that we restrict processing in certain circumstances.
• Withdraw consent, where processing is based on it, without retroactive effect.
• Not to be subject to decisions based solely on automated processing producing significant legal effects on you. (BotanikTrace does not currently use automated profiling with legal or similarly significant effects on Users; alerts and automations operate on rules configured by the User themselves.)

How to exercise them. From the panel, under Settings → Privacy (/privacy), you can export your data and request the deletion/anonymisation of your account on a self-service basis. For any other right, or if you prefer to handle it by email, write to the contacts in Section 20. We will respond within the deadlines required by the applicable regulations (for example, one month under the GDPR, extendable; the specific deadlines under the CCPA/CPRA, LGPD and Law 25.326 are detailed in Sections 13 to 16).

You also have the right to lodge a complaint with the data protection supervisory authority of your country of residence (see examples in the following sections).

13. Specific rights — European Union / EEA / United Kingdom (GDPR)

13.1. If you reside in the EEA, the United Kingdom or Switzerland, in addition to the general rights in Section 12, you have the right to lodge a complaint with your national supervisory authority (for example, the AEPD in Spain, the CNIL in France, or the ICO in the United Kingdom).

13.2. Legal basis for international transfers: see Section 8.

13.3. Data Protection Officer / EU Representative: if the Company is required to appoint one under Art. 27 or 37 GDPR, their contact details will be published in Section 20.

13.4. We do not carry out automated processing with significant legal effects without human intervention, in accordance with Art. 22 GDPR.

14. Specific rights — California (CCPA/CPRA)

14.1. If you are a California resident, you have the right to: know which categories of personal information we collect, use, disclose and (where applicable) "sell" or "share" (in the broad sense of the CPRA); request access to and portability of your data; request its deletion; request correction of inaccurate information; limit the use and disclosure of sensitive personal information; and not to be discriminated against for exercising these rights.

14.2. Statement on the sale/"sharing" of data: BotanikTrace does not sell personal information as defined by the CCPA/CPRA. [Confirm/adjust if third-party advertising or analytics tools are incorporated that may constitute "sharing" under the CPRA; in that case, enable a "Do Not Sell or Share My Personal Information" opt-out mechanism and honour Global Privacy Control (GPC) signals].

14.3. You can exercise your CCPA/CPRA rights through the Privacy panel or by writing to the contacts in Section 20. We will verify your identity before processing the request, as required by law.

15. Specific rights — Brazil (LGPD)

15.1. If you are located in Brazil, the Lei Geral de Proteção de Dados (Law No. 13.709/2018) grants the rights to confirmation of the existence of processing, access, correction, anonymisation, blocking or deletion, portability, erasure, information about the public/private entities with which we share data, information about the possibility of refusing consent and its consequences, and withdrawal of consent.

15.2. You may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

15.3. [To complete]: identify the Encarregado de Dados (DPO) appointed under Art. 41 LGPD, whose contact details will be published in Section 20.

16. Specific rights — Argentina (Law 25.326) and other Latin American jurisdictions

16.1. Argentina. Under Law 25.326 on the Protection of Personal Data and its implementing rules, you have the right of access, rectification, updating and deletion of your personal data, as well as to withdraw the consent granted. The Agencia de Acceso a la Información Pública (AAIP), in its capacity as supervisory authority, is empowered to handle complaints and claims brought by those whose rights are affected by non-compliance with the rules in force on the protection of personal data.

16.2. The personal data processed in the context of the Service is incorporated into a database owned by the Company, and may be transferred only as provided for in Law 25.326 and in this Policy.

16.3. Other Latin American jurisdictions. If you reside in a country with specific personal data protection legislation (by way of example: Law No. 19.628 and Law No. 21.719 in Chile; Law 1581 of 2012 in Colombia; the Federal Law on the Protection of Personal Data Held by Private Parties in Mexico; Law No. 18.331 in Uruguay; the Personal Data Protection Law in Peru), we grant you the rights of access, rectification, cancellation/erasure, objection and portability that such regulations confer on you, and you may exercise them through the contacts in Section 20. If you have any doubt about the specific framework applicable to your country, contact us and we will guide you on the relevant procedure.

17. Minors

The Service is not directed at minors (see Section 2.4 of the Terms and Conditions) and we do not knowingly collect data from minors. If you are a parent or guardian and believe that a minor in your care has provided us with personal data, contact us to request its deletion.

18. Security incident notification

18.1. We have internal procedures to detect, assess and respond to security incidents that may affect personal data.

18.2. In the event of a personal data security breach posing a risk to your rights and freedoms, we will notify you without undue delay, and will notify the competent supervisory authority within the deadlines required by the applicable regulations (for example, 72 hours under Art. 33 GDPR from the moment we become aware of the incident, or other deadlines under the law of your jurisdiction), indicating the nature of the incident, the categories and approximate volume of data affected, the likely consequences and the measures taken or proposed.

19. Changes to this Policy

We may update this Policy from time to time. In the event of substantial changes, we will notify you by email and/or through a prominent notice on the Platform before they take effect, indicating the new "Last updated" date. We recommend that you review this page periodically.

20. Contact and Data Protection Officer

To exercise your rights, ask questions about this Policy or report a security incident:

• Data protection / DPO / Data officer: [[email protected]]
• General support: [[email protected]]
• Registered address: [FULL REGISTERED ADDRESS]
• EU/EEA representative (if applicable under Art. 27 GDPR): [TO BE APPOINTED]
• Reference supervisory authority (Argentina): Agencia de Acceso a la Información Pública (AAIP) — www.argentina.gob.ar/aaip

Related document: Terms and Conditions of Use.