1. Who we are and what this policy covers

This Privacy Policy explains how Tunen Germany GmbH („Tunen“, „we“) processes personal data when you visit tunen.ai, use our web and mobile applications (including Tunen Agronomy) and related services (together the „Services“), or communicate with us. It applies to the personal data of our business customers' personnel, prospects, website visitors and contact persons.

2. Two roles: when we are controller and when we are processor

Tunen processes personal data in two distinct roles:

• As controller for: your account and registration data, billing, our website, communication with you, and our own marketing. For these processing activities, this Privacy Policy applies in full.
• As processor on behalf of our customers (the farm business) for: farm and operational data, activity records, location and working-time data of the customer's personnel, and other data processed inside the customer's workspace. Here, the customer is the controller and Tunen processes the data on the customer's documented instructions under a data processing agreement (Art. 28 GDPR). If you are an employee or contractor of a Tunen customer, please contact your employer for information on this processing; Section 11 explains what we do with requests we receive directly from you.
• Sole proprietors: where you are a natural person using the Services for your own farm business and no personal data of other persons (e.g. employees or co-workers) are processed in your workspace, we process your personal data as controller in order to perform our contract with you (Art. 6(1)(b) GDPR); a data processing agreement is not required in this constellation.

3. What personal data we process

3.1 Account and contact data (controller)

Name, email address, phone number, company and role, username, password (hashed), language and notification preferences; correspondence with us (support, sales, events).

3.2 Billing data (controller)

Billing address, VAT ID, subscription and order history. Payment card and bank details are collected and processed directly by our payment provider Stripe; Tunen does not store full payment instrument numbers. Stripe's privacy notice applies to its processing.

3.3 Location and motion data (mostly processor)

Where activity detection, live location or working-time features are used, the mobile application processes device location (GPS and comparable signals) and motion/sensor data while recording is active. Recording is started and stopped by the user (e.g. clock-in/clock-out); no location tracking takes place outside activated recording. Where the user works for one of our customers, this processing takes place on behalf of, and under the responsibility of, the customer as employer (see Sections 2 and 11); activation by the user supports transparency, but does not replace the employer's duties (information, legal basis, involvement of employee representative bodies where required). Device permissions can be changed in the device settings; deactivating location access limits the corresponding features.

3.4 Voice, image and document data (mostly processor)

The AI Co-Pilot accepts voice input, photos and documents (e.g. invoices, delivery notes) to create records and extract data. Voice recordings are transcribed. Uploaded documents may contain personal data of third parties (e.g. supplier contacts); responsibility for the lawfulness of such uploads lies with the customer (see our Terms of Service).

3.5 Technical and usage data (controller)

IP address, device and browser information, operating system, app version, log files, crash reports, and usage events (features used, timestamps). We use this data to operate, secure and improve the Services.

3.6 Data received from distribution partners (controller)

Where you obtain access to the Services through an authorised partner (e.g. an OEM platform), the partner provides us with the data needed to set up and manage your access, typically: name, company, email address and licence status. The partner informs you about its own processing; we use the received data to create your account and administer your licence.

We do not process special categories of personal data (Art. 9 GDPR) and do not knowingly collect data from persons under 18.

4. Purposes and legal bases

For each purpose, the legal basis under Art. 6(1) GDPR is stated.

• Providing the Services (account, core functions, support): performance of a contract, lit. b; where our contract is with your employer, our legitimate interest in providing the Services to our customers, lit. f.
• Billing and order management: performance of a contract, lit. b; statutory retention duties, lit. c.
• Operating, securing and troubleshooting the Services (logs, crash reports): legitimate interest in a secure, stable service, lit. f.
• Product analytics to improve the Services: consent, lit. a, where cookies or comparable technologies requiring consent are used (§ 25 TDDDG); otherwise legitimate interest, lit. f.
• Direct marketing to existing customers (product news by email): legitimate interest, lit. f, within the limits of § 7 (3) UWG; otherwise consent, lit. a. You can object or unsubscribe at any time.
• Communicating changes to terms or this policy: performance of a contract and legal obligation, lit. b and c.
• Establishing, exercising or defending legal claims; fraud prevention: legitimate interest, lit. f.
• Compliance with legal obligations (e.g. tax and commercial law): legal obligation, lit. c.

5. AI features and AI training

The Services include AI features (automatic activity detection, an AI assistant based on large language models, data extraction, predictive analytics). Inputs you provide to these features are processed to generate the requested output. We use Google Cloud as processor for parts of this processing; Google acts on our instructions and may not use the data for its own purposes.

For training, validating and testing our AI systems, we use customer data only in aggregated or pseudonymised form. You (or the customer, for data processed on its behalf) can object to this use at any time via privacy@tunen.ai.

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). AI outputs in the Services are decision-support only.

6. Recipients

We share personal data only as follows:

• Processors that support us in operating the Services: hosting and cloud infrastructure on Google Cloud in Germany and Belgium (EU regions), payment processing (Stripe), AI services (Section 5), communication and support tools. All processors are bound by data processing agreements under Art. 28 GDPR.
• Map services: where you use map features, request data are processed by the map provider (e.g. Google Maps Platform) to display maps and locations.
• Distribution partners: where your access is managed through a partner, we share licence and usage-status information needed for the partner relationship (e.g. active licences), not the content of your farm records.
• Authorities and courts: where we are legally obliged or entitled to do so.
• Corporate transactions: in the context of a merger, financing or acquisition, under confidentiality safeguards.

We do not sell personal data and do not share identifying customer data with third parties for their own advertising purposes.

7. International transfers

Our servers are located in Germany and Belgium (Google Cloud EU regions). Where a service provider processes personal data outside the EU/EEA, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for providers certified under it) or on the EU Standard Contractual Clauses, supplemented by additional safeguards where required.

8. Retention

• Account and contract data: for the duration of the contract, then per statutory retention duties (up to 10 years under HGB/AO for accounting-relevant records).
• Farm and operational data processed on the customer's behalf: for the duration of the contract; export available on request during the term and for 30 days after termination; deletion thereafter, subject to statutory duties (see also our Terms of Service).
• Voice recordings: Extracted records are retained like other farm data.
• Log and technical data: up to 12 months, unless needed longer for security incidents.
• Marketing contact data: until you object or withdraw consent.

When data are no longer required, we delete or anonymise them; where deletion is temporarily impossible (e.g. backup archives), we isolate the data until deletion.

9. Your rights

Under the GDPR you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and withdrawal of any consent with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation; we will then stop the processing unless we demonstrate compelling legitimate grounds. Where we process your data for direct marketing, you may object at any time without stating reasons.

To exercise your rights, contact privacy@tunen.ai. You also have the right to lodge a complaint with a supervisory authority, in particular with the authority competent for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover – or with any other EU supervisory authority.

10. Cookies and analytics

Our website and applications use technically necessary cookies and storage to provide the Services (§ 25 (2) TDDDG). On our website we use Google Analytics to measure traffic and usage. This is done only with your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR), which you can give and withdraw at any time via the consent banner. Information collected via Google Analytics may be transferred to Google LLC in the United States; this transfer is safeguarded under the EU-US Data Privacy Framework.

11. Employees and contractors of our customers

If your employer or principal uses Tunen, your personal data (e.g. account data, activity records, location and working-time data) are processed by Tunen as processor on your employer's behalf. Your employer is the controller and is responsible for informing you (Art. 13/14 GDPR), for the legal basis, and for involving employee representative bodies where required. If you send a data subject request directly to us, we will forward it to your employer without undue delay and support the response as required by Art. 28 GDPR.

12. Security

We apply appropriate technical and organisational measures (encryption in transit, access controls, logging, regular backups) appropriate to the risk. No system is absolutely secure; in the event of a personal data breach we will act in accordance with Arts. 33 and 34 GDPR.

13. Changes to this policy

We will update this policy when our processing changes and indicate the current version by the date above. In case of material changes we will inform you in the Services or by email.

14. Contact

Tunen Germany GmbH, Wechtern 3, 21732 Krummendeich, Germany · privacy@tunen.ai.

15. Language versions

This Privacy Policy is provided in German and English. For users in Germany and Austria, the German version prevails; for all other users, the English version prevails. Translations are provided for convenience only.