Spuitboekje.nl is an online app that farmers use to keep track of their fields, spray applications, fertilising, field operations and crop costs. This statement explains which personal data we use for this, why, who we share it with, how long we keep it and what rights you have. It has been drawn up in accordance with the General Data Protection Regulation (GDPR) and applies to all users in the European Union.
We are the controller for the data in this statement. Spuitboekje.nl is a private initiative in its test phase and is offered free of charge (for now). A data protection officer has therefore not been appointed and is not required. You can use the email address above for all privacy questions.
| Data | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Email address and password (the password only in encrypted form) | Creating an account, logging in, resetting your password, messages about your account | Performance of the contract |
| Farm name | Showing it in the app | Performance of the contract |
| Data you enter yourself: fields and their location on the map, crops, spray applications, fertilising, field operations, prices, yields and sales | Making the app work: recording, calculating overviews and costs, backups and export | Performance of the contract |
| Technical data: IP address, browser type, time of requests | Keeping the app secure and available, detecting faults and abuse | Legitimate interest (security) |
| Anonymous visitor statistics: page visited, date and time, type of device (mobile, tablet or computer), the website you came from and whether it is your first visit that day. No IP address, no cookies, not linked to your account. | Keeping track of how many people use the site and the app, in order to improve them | Legitimate interest (insight into usage) |
| Account overview for the administrator: email address, farm name, sign-up and last login date and the number of fields and records | Managing the service: supporting accounts, solving problems and preventing abuse | Legitimate interest (administration) |
The administrator does not look at the content of your records (fields, products, costs) unless you ask for it yourself, for example with a support question, or if required by law.
Providing your email address is necessary to create an account. Everything else you enter is up to you. Much of what you enter is about your farm; if your farm is a sole proprietorship or partnership, or if the location of fields can be traced back to you, we also treat that data as personal data. We do not use special categories of personal data, make no automated decisions about you and do not create profiles.
We never sell your data and do not share it for advertising. Other users cannot see your farm's data: every farm has its own, technically separated part of the database. Only people you invite to your farm yourself (via Account → Share farm) can see and edit that farm's data, with the role you give them. Members of a farm can see each other's email address and who entered a record. As the owner you can remove a member at any time. We work with these service providers (processors):
| Party | Role | Where |
|---|---|---|
| Supabase, Inc. | Database, login and sending account emails | Database in the EU (Ireland); the company is based in the US |
| Netlify, Inc. | Hosting of the app (the website itself) and technical log files | Worldwide network; the company is based in the US |
| TransIP B.V. | Email (our mailboxes and sending account emails) | The Netherlands |
We have a data processing agreement with these parties. They may only use your data on our behalf.
Maps (PDOK). Aerial photos, field boundaries (BRP) and address search come from PDOK, a service of the Dutch government (Kadaster). When you use the map, your browser requests these map images directly from PDOK; PDOK sees your IP address and which map area is requested, but no account or field data.
Maps in Germany. If your farm is in Germany, your browser requests map images from the Federal Agency for Cartography and Geodesy (basemap.de) and from the surveying authority of the federal state (aerial photos). For address search and determining the federal state, the app uses Nominatim from the OpenStreetMap Foundation (United Kingdom; covered by an adequacy decision of the European Commission). These parties see your IP address and the requested map area or search term, but no account or field data. Field blocks for Lower Saxony are retrieved by our own server, so that service does not see your IP address.
Otherwise we only pass on data if we are legally required to do so.
Your data is stored in a database in the EU. Because Supabase and Netlify are American companies, data (such as technical log files or administrative access) may be processed outside the EU. This only happens with the safeguards required by the GDPR: the EU-US Data Privacy Framework where the company is certified for it, and otherwise the standard contractual clauses adopted by the European Commission.
The site and the app do not use cookies or tracking for advertising. For the anonymous visitor statistics your browser only stores the date of your last visit, so that we can count visitors per day without recognising you. The app does store on your own device (in browser storage): your login session, so that you stay logged in; your language choice and a few display settings (such as sorting and place names on the map); and a copy of the app itself so that it starts quickly. This storage is necessary for the app to work. When you log out, your session is removed; you can clear the rest via your browser settings.
All connections are encrypted (https). Passwords are only stored in encrypted form. The database is set up so that each user can only read and change their own data. Should a data breach nevertheless occur, we will report it within 72 hours to the Dutch Data Protection Authority and, if the risk to you is high, to you as well.
You have the right to access, rectify and erase your data, to restrict processing, to object to processing based on legitimate interest, and to data portability. You can do much of this yourself in the app:
For other requests, email the address under point 1. We will respond within one month. We may ask you to confirm that the request comes from you.
If you disagree with how we handle your data, please contact us first. You can also lodge a complaint with a supervisory authority: in the Netherlands the Autoriteit Persoonsgegevens, or the supervisory authority in the EU country where you live or work.
We may change this statement, for example when the app gets new features. The date at the top shows which version applies. We will inform you of important changes in the app or by email.