Data Processing Agreement

This agreement is between your organisation and FarmBind (Pty) Ltd (registration number 2026/788176/07) ("we", "us"). It forms part of the FlockTrial Terms of Use.

It applies to trial data: everything your organisation captures or uploads in FlockTrial. It does not apply to user account and login details or to our own records, which are covered by the Privacy Policy.

Under the Protection of Personal Information Act 4 of 2013 (POPIA), your organisation is the responsible party for trial data and we are its operator: we process it on your organisation's instruction, for its purposes, and for nobody else's.

1. What we process

• the trial's setup: houses, treatments, factors, feeds and nutrient values, costs and budgets, pens, birds and the layout;
• captures: egg collections and weights, feed checks, body weights, egg quality, mortality and any other fields set up for the trial, with their notes;
• the methodology, objectives, setup reviews and addenda;
• files: exports, prints, lock snapshots and statisticians' results files;
• the audit trail of every change to the above;
• information about people and organisations that appears in that data, such as the names of users, the sponsor, and anything typed into notes or text fields.

2. Why, and on whose instruction

We process trial data only to:

• store it and show it to your organisation's authorised users;
• validate entries, calculate derived figures, and produce the layouts, prints and exports your users ask for;
• keep a complete audit trail and back the data up;
• support your organisation when it reports a problem or asks us to do something;
• keep the platform working and secure.

Using FlockTrial, and anything your client administrators ask of us in writing, is your organisation's instruction to do these things. If the law requires us to do anything else with trial data, we will tell your organisation first unless the law forbids it.

3. What we will not do

• Use trial data for our own purposes.
• Sell it, or give it to anyone to market to you.
• Show it to another organisation, or to a sponsor, unless your organisation tells us to.
• Use it to train an AI model.
• Change captured data. We do not capture or correct entries in your trials.

4. People who may see it

Only people who need to:

• your organisation's users, according to the role and trials your administrators give them;
• our own staff, to administer the platform, to fix a problem, or to do what your organisation has asked. Our access through the platform is limited and logged; our direct access is only for these reasons.

Everyone with access is bound to keep trial data confidential, and that duty does not end when their access does.

5. Sub-operators

We use the suppliers listed in the Privacy Policy to host, transmit and back up data on our behalf. Each is bound by written terms that protect the data at least as well as this agreement.

If we add or change a sub-operator that processes trial data, we will tell your organisation at least 30 days in advance. If your organisation objects on reasonable grounds, we will discuss it, and your organisation may end the agreement for trials not yet started, with a refund of their fees.

6. Sending data outside South Africa

Some suppliers may store or process data outside South Africa. We do this only where POPIA (section 72) permits: where the recipient is bound by law, binding rules or an agreement giving protection comparable to POPIA. The Privacy Policy lists who and where.

7. Security

We keep trial data secure with appropriate, reasonable technical and organisational measures, as section 19 of POPIA requires, including:

• every user signs in with a password, and can add an authenticator app code as a second step; our own platform-owner account always uses it;
• all data is reached only through our server, every query is limited to the caller's organisation, and the database itself refuses writes across organisations. These limits are covered by automated tests;
• the audit trail is append-only in the database: no one, including us, can edit or delete it through the platform;
• captures are never overwritten; corrections void and re-enter;
• traffic is encrypted, and the database and its backups are encrypted at rest by our database provider.

8. If something goes wrong

If we have reasonable grounds to believe that trial data has been accessed or acquired by an unauthorised person, we will tell your organisation immediately, as section 21 of POPIA requires. We will tell you what we know, what we are doing about it, and help your organisation meet its own obligations, including notifying the Information Regulator and the people affected.

9. Your organisation's instructions

Your organisation may at any time ask us to give it a copy of its trial data, or to help it answer a request from someone whose information is in it. We will.

Captured data is corrected in FlockTrial by your users, by voiding and re-entering, so the history stays intact. We will not alter the record ourselves.

10. Retention and deletion

• A trial and its audit trail are kept while your organisation uses FlockTrial, and for one year after the trial is locked. Your organisation should download the final dataset when it locks a trial and keep it for as long as a sponsor, an ethics committee or a publication may need it.
• Your organisation may ask us in writing to remove a trial earlier. We do so only after a complete export of that trial has been downloaded since its last change. We keep a short record that it existed and was removed: its name, dates, who asked and who removed it.
• Before the retention period ends we will contact your organisation, and it can ask for a copy or for a longer period to be agreed.
• Removed data stays in encrypted backups until those copies expire, within 30 days.
• We keep what the law requires us to keep, and will tell your organisation what and why.

11. When the agreement ends

When your organisation stops using FlockTrial, it keeps the right to a copy of its trial data in a usable format (XLSX and CSV). After that, section 10 applies.

12. Audit

If your organisation needs to show an auditor, sponsor or ethics committee how trial data is handled, ask us and we will answer in writing. Each trial's own audit trail can be viewed by your organisation in the platform. We are a small team; we will be straight with you rather than send you a certificate we do not have.

13. Law

This agreement is governed by the laws of the Republic of South Africa.