Data Processing Agreement
How RanchPad processes and protects your data.
Last updated: 1 January 2026
1. Introduction
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between RanchPad Ltd (“Processor”) and the customer (“Controller”) and governs the processing of personal data by RanchPad on behalf of the customer.
2. Definitions
- Personal Data — Any information relating to an identified or identifiable natural person.
- Processing — Any operation performed on personal data, including collection, storage, retrieval, use, disclosure, and erasure.
- Sub-processor — A third party engaged by RanchPad to process personal data on behalf of the Controller.
3. Scope of Processing
RanchPad processes personal data solely for the purpose of providing the farm management platform services, including:
- User account management (names, email addresses, roles)
- Farm operational data (animal records, paddock data, financial records)
- Compliance submissions (NAIT, NLIS, APHA identifiers)
- Usage analytics and platform performance monitoring
4. Data Security Measures
RanchPad implements appropriate technical and organisational measures to protect personal data:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Role-based access controls with least-privilege principle
- Regular security audits and penetration testing
- Automated backup with geographic redundancy
- Incident response procedures with 72-hour breach notification
5. Data Retention
Personal data is retained for the duration of the customer’s subscription plus 90 days. Upon account deletion request, all personal data is permanently erased within 30 days, except where legal retention obligations apply.
6. Sub-processors
RanchPad uses the following categories of sub-processors:
| Category | Purpose | Location |
|---|---|---|
| Cloud Infrastructure | Application hosting & data storage | AU / NZ region |
| Email Service | Transactional email delivery | US (EU data centre) |
| Payment Processing | Subscription billing | Global (PCI DSS compliant) |
| Analytics | Platform usage analytics | EU data centre |
7. Data Subject Rights
RanchPad assists the Controller in fulfilling data subject rights requests, including:
- Right of access (data export in CSV/JSON format)
- Right to rectification (self-service profile editing)
- Right to erasure (account deletion request)
- Right to data portability (full data export)
8. International Transfers
Where personal data is transferred outside the originating jurisdiction, RanchPad ensures appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and adequacy decisions where applicable.
9. Compliance Frameworks
- New Zealand Privacy Act 2020
- Australian Privacy Act 1988
- UK GDPR / Data Protection Act 2018
- EU General Data Protection Regulation (GDPR)
10. Contact
For data processing enquiries, contact our Data Protection Officer at privacy@ranchpad.co.nz.