← Back to the website

Data Processing Agreement

Data Processing Agreement (DPA) for the Ortu Agro Platform

Version 1.0 · Last updated: May 14, 2026 · Effective: from the date of acceptance of the Terms of Use

This Personal Data Processing Agreement ("DPA" or "Agreement") is entered into between the parties identified below. It forms part of and supplements the Terms of Use of the Ortu Agro Platform, which prevail over any oral agreement, exchange of emails or prior representation of the parties. In the event of a conflict between any instrument and this Agreement, the document most favorable to Ortu Agro always prevails. The Customer's acceptance of the Terms of Use constitutes full and irrevocable acceptance of this DPA, without the need for any additional signature.

1. Identification of the Parties

1.1. Ortu Agro LTDA, registered with the CNPJ (Brazilian company registration number) under No. 66.273.065/0001-19, headquartered at Avenida Paulista, 302, CEP 01310-000, São Paulo/SP, hereinafter referred to as "Ortu Agro".

1.2. Customer: an individual or legal entity identified in the Customer Registration of the Platform, hereinafter referred to as "Customer" or "Controller". The Customer declares that it has full legal capacity to enter into this Agreement and to bind the organization it represents.

2. Operating Model: Self-Service SaaS Platform

2.1. Ortu Agro provides a livestock management platform under the Software as a Service (SaaS) model with self-service access. The Customer accesses, configures and enters its own data autonomously, without Ortu Agro receiving, interpreting or executing individualized data processing instructions from each Customer.

2.2. The processing of data by Ortu Agro takes place in an automated and uniform manner within the functional limits of the Platform. The Customer's use of the Platform itself constitutes the processing instruction; there is no processing under specific orders from each Customer.

2.3. Ortu Agro is the controller of the registration, authentication and payment data; and the processor of the farm operational data entered by the Customer. The roles are exercised according to each category of data, regardless of the Customer's classification.

2.4. Data relating to animals (identification, health, reproduction, weight, genealogy) is not personal data under the LGPD (Brazil's General Data Protection Law), since animals are not natural persons. The processing of such data is outside the scope of this Agreement and of the LGPD, and is governed exclusively by the Terms of Use.

2.5. Ortu Agro does not guarantee, and is not responsible for ensuring, that the Customer's use of the Platform places the Customer in compliance with the LGPD, with regulations of MAPA (Brazil's Ministry of Agriculture and Livestock), SISBOV (Brazil's official bovine traceability system) or any other sector-specific rule. The Customer's regulatory compliance is its exclusive obligation.

3. Data Categories and Roles

Category	Role of Ortu Agro	Legal Basis
Registration and access (name, email, CPF [Brazilian individual taxpayer number]/CNPJ, hashed password)	Controller	Performance of a contract (Article 7, V)
Payment (billing data; card tokenized by Stripe; Ortu Agro does not store the card number)	Controller	Performance of a contract (Article 7, V)
Farm operational data entered by the Customer (herd, reproduction, health, financial, nutrition)	Processor	Defined and guaranteed by the Customer
Third-party data entered by the Customer (employees, veterinarians, other workers)	Processor	Exclusive responsibility of the Customer
Usage and browsing data (IP, device, logs)	Controller	Legitimate interest (Article 7, IX)

4. Exclusive Responsibilities of the Customer

4.1. The Customer is solely and fully responsible for:

• ensuring an adequate legal basis for all data entered into the Platform, including data of employees, veterinarians and any third parties;
• informing and obtaining any consents from the data subjects whose data is entered, including employees and other workers, fully assuming any liability for omission;
• all acts and omissions of its users, employees and third parties who access the Platform with the Customer's credentials, as if they were acts of the Customer itself;
• safeguarding and keeping confidential the access credentials (login and password), being fully responsible for any access made with its credentials, whether authorized or not;
• entering only data obtained lawfully and for legitimate purposes;
• complying with all obligations that the LGPD and other applicable rules impose on the data controller;
• notifying Ortu Agro immediately upon becoming aware of a compromise of credentials or a breach related to Platform data.

4.2. INDEMNIFICATION: The Customer will indemnify, defend and hold harmless Ortu Agro, its quotaholders, managers, employees and service providers from any losses, damages, administrative fines (including those imposed by the ANPD, Brazil's National Data Protection Authority), penalties, court costs and out-of-court costs, and reasonable attorneys' fees arising from:

• entry of personal data without an adequate legal basis;
• data of employees or third parties entered without the knowledge or consent of the data subjects;
• non-compliance with any legal obligation of the Customer as a data controller;
• improper use of the Platform by the Customer or its users;
• breach by the Customer of any provision of this Agreement or of the Terms of Use;
• claims by data subjects whose data was entered by the Customer.

4.3. The obligation to indemnify provided for in clause 4.2 is independent of exclusive fault, concurrent fault or fault of third parties, and applies even to situations in which Ortu Agro is pursued as jointly and severally liable by data subjects or authorities because of acts of the Customer.

5. Obligations of Ortu Agro

5.1. With regard to the farm operational data (role of Processor), Ortu Agro undertakes to:

• process the data exclusively for the operation, maintenance and improvement of the Platform and for the provision of the contracted services;
• use anonymized, pseudonymized and aggregated data freely and without restriction for improvement of the Platform, industry benchmarking, product development and statistical analyses; data in this form is outside the scope of the LGPD and of this Agreement;
• adopt technical and organizational measures proportionate to the risk, in accordance with Section 8;
• notify the Customer of confirmed security incidents under the terms of Section 9.

5.2. Ortu Agro does not verify, validate or assume any liability for the lawfulness, accuracy, completeness or origin of the data entered by the Customer.

6. Artificial Intelligence: Specific Disclaimer

6.1. The Platform provides the artificial intelligence assistant "Peão Zé", which generates analyses, alerts, suggestions and automated responses based on the data entered by the Customer.

6.2. The results generated by the AI are strictly informational and suggestive in nature. They do not under any circumstances constitute veterinary, animal science, agronomic, financial, legal or any other regulated professional advice.

6.3. Ortu Agro is not liable for decisions made by the Customer based on AI outputs, for errors, inaccuracies or hallucinations of the model, or for losses of any kind arising from the use of, or reliance placed on, the assistant's responses.

6.4. For the AI to function, data entered by the Customer may be transmitted to third-party providers of language models. By using the assistant, the Customer expressly consents to this sharing, being aware that such providers are listed at ortuagro.com/en/subprocessadores.

7. Subprocessors

7.1. Ortu Agro engages and instructs subprocessors exclusively to operate its own platform infrastructure. These subprocessors are accountable to Ortu Agro, not to the Customer, and have no direct contractual relationship with the Customer.

7.2. The complete and up-to-date list of active subprocessors is available at ortuagro.com/en/subprocessadores. Keeping that page up to date constitutes, in itself, sufficient notice to the Customer of any changes, dispensing with individualized communication.

7.3. Ortu Agro may replace, add or remove subprocessors at its sole discretion. The Customer has no right of veto over the technical infrastructure choices of Ortu Agro. The Customer's disagreement with any change gives rise only to the right to cancel the service under the Terms of Use, without any right to compensation.

7.4. Ortu Agro is liable to the Customer exclusively for the instructions it formally transmits to the subprocessors. It is not liable for autonomous acts of the subprocessors outside that scope.

8. Data Security

8.1. Ortu Agro adopts technical and organizational measures proportionate to the risk, including:

• encryption in transit (TLS) and at rest;
• role-based access control following the principle of least privilege;
• data isolation by farm (multi-tenancy with farmId extracted from the authentication token);
• access monitoring and audit logs;
• regular backups with recovery procedures;
• internal information security policies.

8.2. The security measures are defined exclusively by Ortu Agro. Their application does not imply a guarantee that no breach will occur. Ortu Agro will not be held liable for incidents resulting from: (a) actions of malicious third parties beyond its reasonable control; (b) vulnerabilities in third-party systems; (c) compromise of the Customer's credentials; (d) force majeure; (e) acts or omissions of the Customer itself or its users.

9. Security Incidents

9.1. In the event of a confirmed security incident with a significant impact on the Customer's data, Ortu Agro will notify the Customer within 5 (five) business days after internal confirmation, and may do so progressively as new information is established.

9.2. Ortu Agro is not required to notify the Customer of: unsuccessful attempts at unauthorized access; low-impact incidents without actual access to data; or vulnerabilities detected and fixed before any exploitation.

9.3. Notification to the ANPD, to data subjects and to any authorities is the exclusive responsibility of the Customer. Ortu Agro will cooperate by providing the technically available information, without taking charge of regulatory proceedings or assuming any liability for administrative fines or penalties imposed on the Customer.

9.4. Incident notification by Ortu Agro does not imply acknowledgment of fault, negligence or liability for the resulting damages.

10. Rights of Data Subjects

10.1. The Customer is responsible for handling data subject rights requests (Article 18, LGPD) relating to the data that the Customer itself entered into the Platform.

10.2. If Ortu Agro directly receives requests from data subjects that are the Customer's responsibility, it will forward them to the Customer within 10 (ten) business days, without any obligation to assess, verify or respond to the request. The operational cost of handling is entirely the Customer's.

10.3. Ortu Agro directly handles only requests relating to data for which it is the controller (registration, authentication, payment, access logs).

11. International Data Transfer

11.1. By accepting this Agreement, the Customer gives its express and informed consent to the international transfer of its personal data to the countries where the subprocessors of Ortu Agro operate, acknowledging that such transfer is technically necessary for the provision of the contracted services.

11.2. Ortu Agro adopts contractual safeguards with its international subprocessors. The format, level and sufficiency of these safeguards are determined exclusively by Ortu Agro, and it is not for the Customer to question or challenge them within the scope of this Agreement.

12. Audit and Compliance

12.1. CENTRALIZED REPORT: Ortu Agro fulfills its obligation of transparency and accountability (Article 39, LGPD) through the periodic publication of a centralized Compliance Report, prepared by the means that Ortu Agro deems appropriate: its own report, a standardized questionnaire or certification by a third party chosen by it. A single Report in force simultaneously satisfies the audit obligation toward all Customers, without the need for any additional action on the part of Ortu Agro.

12.2. NO INDIVIDUAL AUDIT: The centralized Report is the only audit mechanism provided for in this Agreement. The Customer has no right to an individual audit, whether on-site or remote, of the facilities, systems, processes or internal documentation of Ortu Agro. Any individual audit will take place only if Ortu Agro, at its sole discretion, so agrees in writing, with all operational costs being the Customer's full responsibility, without reimbursement under any circumstances.

12.3. LIMITS: Any audit under this clause must not interfere with the normal operation of the Platform or with the provision of services to other customers. Ortu Agro is not required to respond to requests from Customers who are in default or whose contract has been terminated.

13. Term, Suspension, Termination and Post-Termination Data

13.1. This Agreement takes effect on the date of acceptance of the Terms of Use and remains in force for as long as the contractual relationship subsists.

13.2. Ortu Agro may, at its sole discretion, immediately suspend the Customer's access to the Platform, without prejudice to any subsequent termination, in the event of: (a) breach of the obligations in Section 4; (b) well-founded suspicion of improper or fraudulent use; (c) risk to the security of the Platform or of other users. Suspension does not give rise to a right to a refund of amounts already paid.

13.3. Ortu Agro may terminate this Agreement immediately and without penalty in the same cases provided for in clause 13.2.

13.4. After the account is closed, the Customer's operational data will be retained for up to 30 (thirty) days for export purposes, after which it will be deleted from the active systems. Data present in automated backups may remain for up to 90 (ninety) additional days before being purged, a period necessary for the technical retention cycle and which does not constitute a breach of this Agreement or of the LGPD.

13.5. Confidentiality obligations remain in force for 2 (two) years after the termination of this Agreement.

14. Force Majeure

14.1. Ortu Agro will not be liable for non-performance of any obligation under this Agreement resulting, directly or indirectly, from events beyond its reasonable control, including, without limitation: failures or interruptions in third-party infrastructure (cloud, internet, power); cyberattacks, ransomware or denial-of-service attacks; pandemics, natural disasters or public calamities; acts of government, regulatory changes or court decisions; and strikes or widespread disturbances.

14.2. In the event of force majeure, Ortu Agro will notify the Customer as soon as it is reasonably possible and will use commercially reasonable efforts to resume normal operation.

15. Limitation of Liability

15.1. The total and cumulative liability of Ortu Agro to the Customer, for any cause and regardless of the form of action, is limited to the lesser of: (a) the total actually paid by the Customer in the 6 (six) months preceding the event; or (b) the amount equivalent to 1 (one) annual fee of the subscribed plan.

15.2. Ortu Agro will under no circumstances be liable for: indirect damages, lost profits, loss of data, business interruption, moral (non-pecuniary) damages, punitive or exemplary damages, even if previously advised of their possibility.

15.3. Ortu Agro is not liable for: (a) acts or omissions of the Customer or its users; (b) data entered without a legal basis; (c) decisions made based on AI outputs; (d) autonomous acts of subprocessors; (e) force majeure; (f) administrative fines or penalties imposed on the Customer by the ANPD or any other authority.

15.4. No action or claim against Ortu Agro may be initiated after 12 (twelve) months have elapsed from the event that gave rise to the damage, regardless of the moment at which the Customer became aware of it.

16. General Provisions

16.1. ENTIRE AGREEMENT: This DPA, together with the Terms of Use and the Privacy Notice, constitutes the entire agreement between the parties regarding the processing of personal data, superseding all prior agreements, negotiations, representations or understandings, oral or written, on the same subject matter.

16.2. ASSIGNMENT: Ortu Agro may assign or transfer this Agreement, in whole or in part, to any successor, acquirer or entity resulting from a merger, spin-off or corporate reorganization, without the need for the Customer's consent. The Customer may not assign this Agreement without the prior and express consent of Ortu Agro.

16.3. MODIFICATIONS: Ortu Agro may modify this Agreement upon at least 30 days' notice. Continued use of the Platform after that period constitutes irrevocable acceptance of the changes. If the Customer does not agree, its sole remedy is cancellation under the Terms of Use.

16.4. WAIVER: Ortu Agro's forbearance in respect of non-compliance with any clause does not imply waiver, novation or tacit modification of the Agreement.

16.5. SEVERABILITY: If any provision is declared invalid or unenforceable, the remaining provisions remain in full force and effect.

16.6. GOVERNING LAW: This Agreement is governed by the laws of the Federative Republic of Brazil, in particular by the LGPD (Law No. 13,709/2018) and the Código Civil (Brazil's Civil Code).

16.7. VENUE: The courts of the judicial district of São Paulo/SP are chosen as the venue, to the exclusion of any other, however privileged, to settle any disputes arising out of this Agreement, without prejudice to the right of the user who qualifies as a consumer to opt for the courts of their domicile, pursuant to Article 101, I, of the CDC (Brazil's Consumer Protection Code).

Questions about this Agreement: dpo@ortuagro.com. General support: contato@ortuagro.com.