How we handle your data.

Last updated · 25 April 2026

This policy explains what personal data Pastorix Group BV, together with its parent company and other affiliated entities (together, the “Pastorix Group”, “Pastorix”, “we”, “our”) collects when you visit pastorix.com, contact us, submit a form, or otherwise engage with us as a business, why we collect it, who we share it with, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR) and the Dutch Uitvoeringswet AVG (UAVG).

1. Who we are

Data controller: Pastorix Group BV
Address: Lekstraat 66-3, 1079 ET Amsterdam, Netherlands
Chamber of Commerce (KvK) number: 99907615
VAT number: NL869182481B01
Privacy contact: [email protected]

2. Applicable data protection laws

We process personal data in accordance with the GDPR and the Dutch UAVG. Where we process personal data of individuals located in Paraguay, we additionally observe Paraguayan Law 1682/2001 (Protection of Personal Information), as amended by Law 1969/2002, and any successor legislation.

3. What we collect and why

3.1 Forms and business inquiries

When you submit a form on the Site or otherwise contact us as a business — for example, by joining the pilot waitlist, requesting information, or engaging with us about products and services — we typically collect:

Full name
Email address
Ranch or company name
Location
Approximate herd size and land area, where you choose to share them
Any other information you choose to include in your message

We use this information to evaluate fit, prepare proposals, respond to your enquiry, and take steps to enter into or perform a contract with your business. The legal basis is Article 6(1)(b) GDPR (steps taken at your request prior to or in performance of a contract), Article 6(1)(f) GDPR (our legitimate interest in responding to commercial enquiries), and, where applicable, Article 6(1)(a) GDPR (your consent).

3.2 Technical data

When you load any page we automatically receive technical information such as IP address, user agent, the page you requested, and the time of the request. This data is used to serve the Site, prevent abuse, and diagnose errors. It is processed under Article 6(1)(f) GDPR (legitimate interest in operating a secure and reliable website).

3.3 Analytics

We use Cloudflare Web Analytics to count page views and measure performance. Cloudflare Web Analytics does not use cookies and does not track individual visitors across sites. No personally identifying information is stored.

3.4 Bot protection

Forms on the Site are protected by Cloudflare Turnstile, a privacy-respecting CAPTCHA alternative that uses signals from your browser to distinguish humans from automated traffic.

3.5 Categories of data subjects

Beyond website visitors and form submitters, we may receive personal data about ranch staff, veterinarians, contractors, and other individuals named in pilot proposals, contracts, or commercial communications. Where you provide such data, you confirm that you are entitled to share it with us and that you have informed those individuals of this policy.

3.6 Special-category data

We do not knowingly collect special categories of personal data within the meaning of Article 9 GDPR (such as health data, biometric data, or data revealing racial or ethnic origin). Please do not submit such data through the Site.

3.7 Children

The Site is not directed at children under 16, and we do not knowingly collect their personal data.

4. Who processes your data on our behalf

We use a small number of service providers (“processors”) who process personal data strictly on our instructions under data-processing agreements:

Cloudflare, Inc. (United States) — hosts pastorix.com, provides the /api/waitlist and other form endpoints, and serves bot protection (Turnstile) and analytics.
Attio Technologies Ltd. (United Kingdom) — our customer relationship management system. Form submissions and business contact data are stored in our Attio workspace so our team can review and respond.

Transfers outside the European Economic Area rely on the European Commission’s adequacy decisions where available and on Standard Contractual Clauses (Article 46 GDPR) otherwise.

Personal data of pilot participants and ranch contacts may also be accessed by Pastorix Group personnel and contractors located in Paraguay for purposes of pilot delivery, sales, and customer support. Such transfers are made under Standard Contractual Clauses (Article 46 GDPR) and supplementary contractual safeguards.

5. How long we keep your data

We keep form submissions and business contact data for up to 24 months after your last interaction with us, after which they are deleted or anonymised. If a commercial relationship is established, we retain contract-related records for the statutory 7-year period required under Dutch tax law (Article 52 AWR). You can request earlier deletion at any time.

6. Marketing communications and opt-out

If we send you operational, pilot-related, or other commercial updates, you may opt out at any time via the unsubscribe link in any such message or by emailing [email protected].

7. Automated decision-making

We do not use your personal data for automated decision-making or profiling within the meaning of Article 22 GDPR.

8. Your rights

Under GDPR you have the right to:

Access the personal data we hold about you;
Have inaccurate data corrected;
Ask us to delete your data;
Restrict or object to processing;
Receive your data in a portable format;
Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email [email protected]. We will respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Pilot participants and other data subjects in Paraguay may also raise concerns with the relevant Paraguayan supervisory authority once designated under national data-protection law.

9. Cookies and local storage

pastorix.com does not set marketing or tracking cookies. Cloudflare Turnstile may set short-lived security cookies strictly necessary for its bot-detection challenge; these are exempt from consent under the ePrivacy Directive as strictly necessary. The cookies that may be set are:

cf_chl_* (e.g. cf_chl_rc_v, cf_chl_rc_i, cf_chl_rc_m, cf_chl_rc_ni) — set only during a Turnstile challenge to coordinate the challenge response. Lifetime: typically a few minutes; cleared shortly after the challenge completes.
__cf_bm — Cloudflare bot-management cookie used to distinguish humans from automated traffic. Lifetime: 30 minutes from the last request.
cf_clearance — set if you successfully complete a managed challenge, so you do not have to repeat it on every page. Lifetime: up to 30 days.

10. Security

Data is transmitted over HTTPS and access to Attio is restricted to authorised Pastorix Group team members using multi-factor authentication. API credentials are stored as encrypted environment secrets and rotated periodically. No system is perfectly secure; please contact us if you suspect any issue.

11. Security incident notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Dutch Data Protection Authority within 72 hours and, where required, affected individuals without undue delay.

12. Changes to this policy

If we update this policy, the “Last updated” date at the top of the page will change. For material changes we will make a reasonable effort to notify affected contacts by email where we have one.