Global Privacy Policy & Data Governance Framework

1. Corporate Structure, Scope, and Covered Parties

This Global Privacy Policy and Data Governance Framework ("Policy") establishes the operational standards under which Versalytix, Inc. ("Versalytix," "we," "us," or "our") processes, stores, protects, and utilizes operational agricultural telemetry, customer identity records, and spatial information.

VersaAgro is a precision agronomic intelligence platform and proprietary product developed, hosted, and operated by Versalytix, Inc. All contractual commitments, platform services, data handling protocols, and legal liabilities set forth in this Policy are administered by Versalytix, Inc. across its product offerings, software tools, customer portals, and web interfaces (collectively, the "Platform").

This Policy applies to all individuals and entities accessing our systems, specifically categorized as:

• Growers & Platform Operators: Natural persons (individual and family farmers) and juristic legal entities (incorporated farming businesses, agricultural cooperatives, trusts, and commercial partnerships) managing agricultural land through VersaAgro.
• Bio-Credit & Carbon Auditors: Accredited independent validation bodies, environmental registries, and technical verifiers auditing biomass indices, soil organic carbon metrics, or input reduction achievements.
• Agronomic Advisors: Certified crop advisors, agricultural input retailers, agronomists, and service providers granted platform access by farm operators.
• Site Visitors & Applicants: Individuals submitting intake forms, requesting demonstrations, or applying for early platform or waitlist access.

If your country is not named in a Schedule, this Policy still applies to you, and your local law may give you additional rights.

2. Categories of Data Collected

Versalytix collects information strictly necessary to provision precision agronomy tools via VersaAgro, execute remote-sensing pipelines, model crop rotations, and disburse marketplace proceeds. Collected information is classified as follows:

3. Lawful Bases for Processing

Versalytix processes personal and operational data only where authorized under applicable data protection laws. Our processing relies on the following lawful bases:

• Performance of Contract: To provision VersaAgro platform services, execute satellite index pipelines, compute soil water balance, deliver yield forecasts, and maintain rotation ledgers as agreed under our customer agreements.
• Legitimate Commercial Interests: To improve our machine learning models, calibrate regional crop stress coefficients, protect our cloud systems from security threats, and maintain tenant isolation.
• Compliance with Legal Obligations: To fulfill mandatory tax reporting, satisfy anti-money laundering (AML) and know-your-customer (KYC) requirements for payments, and maintain statutory corporate records.
• Affirmative Opt-In Consent: To allocate de-identified operational records to the VersaAgro Data Marketplace or provide operational verifications to third-party carbon or environmental credit registries.

4. The Opt-In Data Marketplace & De-Identification Standards

Versalytix operates an optional commercial data clearinghouse through VersaAgro that enables enterprise researchers, seed developers, commodity market analysts, and reinsurers to license aggregated agricultural intelligence.

4.1 De-Identification & Spatial Privacy Controls

To ensure individual farm operations cannot be reverse-engineered or isolated by third parties, all data allocated to the Marketplace must undergo rigorous, irreversible de-identification:

• Complete Spatial Decoupling: All direct geographic tags—including latitude and longitude coordinates, polygon boundary perimeters, boundary file contents, placemark labels, parcel bounding boxes, and elevation values—are permanently decoupled and excluded.
• The k ≥ 3 Crop-to-Area Aggregation Rule: Agronomic facts (e.g., regional crop health indicators or yield metrics) are published only when aggregated within an administrative district or agricultural basin containing at least three (3) independent, non-affiliated farm operations cultivating that specific crop. If fewer than three qualifying operations exist in that area, the data is automatically suppressed or rolled into a broader regional macro-zone to prevent identifying individual growers.
• Temporal Smearing: Timestamps and remote-sensing observation dates are normalized to prevent cross-referencing against commercial satellite revisit logs.

4.2 Revenue Distribution and Encrypted Payouts

Growers who opt into the Data Marketplace receive financial distributions reflecting licensing revenues. All banking details and electronic transfer credentials (e.g., PIX, SPEI, PSE, direct deposit, or mobile money accounts) are encrypted at rest using industry-standard encryption and used solely to disburse accumulated balances.

5. Carbon and Biodiversity Credit Verification Audits

Growers utilizing VersaAgro to document environmental stewardship, biological diversity, or carbon sequestration can authorize accredited Bio-Credit Auditors to inspect operational telemetry:

• Auditor Access Scope: Auditors receive read-only access restricted strictly to verified evidence records, such as satellite-verified vegetative cover history, multi-season crop rotation schedules, water balance metrics, and input reduction records.
• Auditor Obligations: All auditors are bound by confidentiality agreements restricting data access solely to verifying credit issuance and regulatory standards.

6. Retention Schedules & Multi-Decade Modeling

Agricultural and climatological modeling requires long-term baselines. Versalytix maintains two distinct data lifecycle retention tracks:

• Waitlist records: If you join the waitlist, we keep your information for up to 12 months from the date you submit it, or until VersaAgro goes live, whichever comes first. When we go live we will let everyone on the waitlist know. You can ask us to delete your waitlist record at any time at privacy@versalytix.com. Waitlist records of people who are not selected, and who have not asked us to keep them, are deleted at the end of that period.
• Direct Identity & Account Records: Direct account identifiers (names, corporate contacts, billing transactions) are retained for the active subscription term plus statutory limitation windows (typically 5 to 7 years following contract termination) to fulfill tax, legal, and regulatory requirements.
• Multi-Decade Agronomic Telemetry: Versalytix incorporates 7 to 10 years of historical operational records at account onboarding and preserves operational, meteorological, and satellite telemetry for decades forward to calibrate long-range yield predictions and stress tolerances. Upon account termination, all field telemetry, weather metrics, and satellite observations are permanently decoupled from customer identity, stripped of parcel boundaries, and retained exclusively within an anonymized research archive.

7. Cloud Architecture, Data Residency & Service Providers

VersaAgro is designed so that your data is processed in or near your region.

• Local cloud instances: We will use a local Amazon Web Services (AWS) instance for the region where you operate, so that, for example, US data stays in the US, UK data stays in the UK, and African data stays in Africa. Where no AWS region is available, we will provide a purpose-built sovereign cloud environment for processing your data. We will give you more details about the specific instance when we onboard you.
• Waitlist and website forms: Waitlist information is stored in our CRM provided by Wix.com and may be processed outside your country (see the relevant Schedule).
• Weather & Environmental Feeds: Meteorological actuals and predictive forecasts are provisioned via secure API calls with Digital Crossing Inc. using regional coordinates or approximate field centroids.
• Analytical Warehouses: High-performance analytical services operate within secured cloud databases and cloud analytical warehouses, governed by formal Data Processing Addenda (DPAs) and access controls.

8. Information Security Controls & Governance Standards

Versalytix uses administrative, physical and technical safeguards to protect agricultural data, operational plans and financial records across VersaAgro.

• Encryption: We use industry-standard encryption to protect data at rest and in transit.
• Cloud provider assurance: Where we use AWS, AWS maintains independently audited certifications for its infrastructure, including ISO/IEC 27001 and SOC 2. Versalytix itself is not separately certified to these standards; we design our own controls with reference to them.
• Logical Tenant Isolation: Customer data is separated at the database layer, with role-based access control (RBAC) so that accounts cannot see each other's data.

9. Universal Data Subject Rights

Regardless of geographic territory, Versalytix guarantees all natural and juristic persons utilizing VersaAgro the ability to exercise fundamental data protection rights:

• Right to Access: Request confirmation of processing and obtain copies of held records.
• Right to Rectification: Request correction of inaccurate operational or personal records.
• Right to Erasure / De-Identification: Request deletion or de-identification of personal data from active systems.
• Right to Portability: Export field boundary shapes, crop logs, and yield metrics in open, standard formats (such as GeoJSON, CSV, or Shapefile).
• Right to Withdraw Consent: Revoke participation in the Data Marketplace or optional analytics tracks at any time.

To exercise these rights, submit a verifiable request to privacy@versalytix.com (or versaagro@versalytix.com).

This Schedule supplements the Master Policy for natural persons residing in the United States pursuant to applicable state privacy statutes (including the California CCPA/CPRA, Colorado CPA, Virginia VCDPA, and others).

A.1 Disclosures on "Sale" and "Sharing" of Information

Versalytix does not sell identifiable personal information under standard platform terms. Because participation in the VersaAgro Data Marketplace involves commercial licensing of aggregated and de-identified agricultural telemetry, we treat Marketplace participation under a formal opt-in framework that satisfies CCPA/CPRA statutory standards.

A.2 Notice of Financial Incentive

Growers who choose to participate in the Data Marketplace or certified bio-credit programs receive financial disbursements from dataset licensing or environmental credit sales. The incentive calculation directly reflects the market value of the licensed information. Participation is voluntary, and opting out never impairs platform functionality or subscription terms.

A.3 Exercise of Statutory Rights

United States residents may exercise their statutory rights to access, correct, delete, or limit the use of their personal information by contacting privacy@versalytix.com. Versalytix will never discriminate against any user for exercising their statutory privacy rights.

This Schedule governs the processing of personal data relating to data subjects located in the United Kingdom under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

B.1 Controller Identification & UK Contact

Versalytix, Inc. acts as the Data Controller for all data processing related to the VersaAgro platform. Contact: privacy@versalytix.com.

B.2 Data Residency & Cross-Border Transfers

For UK customer accounts, we will use a local AWS instance in the United Kingdom so that your operational data, field boundaries and customer information stay in the UK.

Waitlist information is stored in our CRM provided by Wix.com and may be processed outside the UK. Where UK personal data is accessed or processed outside the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or your explicit consent where it applies.

Versalytix has not yet appointed a UK representative. Until it does, UK privacy requests go to privacy@versalytix.com.

B.3 Supervisory Authority Recourse

UK data subjects hold the right to lodge a complaint with the Information Commissioner's Office (ICO) via ico.org.uk or telephone (+44 0303 123 1113).

B.4 Waitlist acknowledgement

B.4 Waitlist acknowledgement. UK applicants confirm this acknowledgement on the waitlist form. It does not limit your rights: you can access, correct or delete your information, withdraw your consent, or complain to the ICO at any time.

This Schedule applies to processing operations involving farm managers, growers, and agricultural records located within Brazil, Colombia, and Mexico.

C.1 Brazil — Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018)

• Appointed Encarregado (DPO): Inquiries may be directed to our Brazilian Data Protection Officer at privacy@versalytix.com.
• Legal Grounds: Processing relies on contract execution (Art. 7, V), regulatory compliance (Art. 7, II), legitimate interest (Art. 7, IX), and explicit consent (Art. 7, I) for commercial marketplace activities.
• International Transfers: Cross-border data flows are governed by Standard Contractual Clauses recognized by the National Data Protection Authority (ANPD).

C.2 Colombia — Statutory Law 1581 of 2012 & Decree 1377 of 2013

• Prior Authorization (Autorización Previa e Informada): Colombian users explicitly authorize the collection, storage, and processing of their information during platform registration.
• Financial Telemetry: Financial identifiers (e.g., PSE payment accounts) are maintained under strict confidentiality safeguards.
• Rights: Colombian users may consult, update, or revoke authorizations by contacting privacy@versalytix.com. Inquiries are handled within statutory deadlines enforced by the Superintendency of Industry and Commerce (SIC).

C.3 Mexico – Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP, 2025)

• Integral Privacy Notice (Aviso de Privacidad Integral): This section is the integral privacy notice for VersaAgro in Mexico. The controller is Versalytix, Inc.; contact privacy@versalytix.com.
• Purposes: Primary purposes are waitlist and onboarding, farm monitoring and yield modelling. The Data Marketplace (when it launches) is a secondary purpose that needs your separate consent.
• ARCO rights: You may exercise Access, Rectification, Cancellation and Opposition rights by emailing privacy@versalytix.com. The Mexican authority is the Ministry of Anti-Corruption and Good Governance (Secretaría Anticorrupción y Buen Gobierno).

This Schedule addresses processing operations conducted within South Africa, Kenya, and Nigeria.

D.1 South Africa (POPIA)

• Information Officer: Our Information Officer can be reached at privacy@versalytix.com.
• Cross-Border Conditions (Section 72): Data transfers to cloud systems abroad rely on agreements guaranteeing protections substantially similar to POPIA’s Conditions for Lawful Processing.

D.2 Kenya (Data Protection Act, 2019)

• Regulatory Alignment: Versalytix enforces data protection by design and default under Section 41 of the Kenyan DPA, supervised by the Office of the Data Protection Commissioner (ODPC).
• Transfers: Cross-border data transfers comply with the Data Protection (General) Regulations 2021, supported by documented customer opt-in consent for global analytics.

D.3 Nigeria (Nigeria Data Protection Act, 2023)

• Supervision: Operations adhere to principles of lawfulness, purpose limitation, and data minimization overseen by the Nigeria Data Protection Commission (NDPC).

10. Document Revisions and Contact Channels

Versalytix reserves the right to modify this Policy to reflect technical enhancements, architectural updates, or regulatory shifts. Material updates affecting commercial data sharing, payout terms, or spatial masking rules will be notified to registered account managers at least thirty (30) days prior to taking effect.

Corporate Inquiries:
Versalytix, Inc. Data Governance & Privacy Office
Email: privacy@versalytix.com