These data processing terms apply when a customer uses Boma to submit, store, organize, or otherwise process farm operational data, account data, or user-generated records inside the platform.

They are intended to describe the baseline allocation of roles and responsibilities for customer data processed through Boma as part of providing the service.

The customer acts as the controller or primary decision-maker for the customer data it places into Boma. The customer determines the business purpose of that data, who should have access to it, and how long it should remain relevant inside its operations.

Boma acts as a processor or service provider for that customer data to the extent needed to host, secure, maintain, transmit, back up, and otherwise operate the platform on the customer's behalf.

Processing may include collection, storage, organization, retrieval, structuring, display, transmission, backup, deletion, and support-related review of customer data where necessary to provide the service.

The categories of data involved may include account records, farm membership data, animal profiles, health logs, breeding information, milk records, reminders, support messages, and associated operational metadata.

The customer is responsible for ensuring it has a lawful basis to collect and use the data it enters into Boma, for giving appropriate notices to its personnel where required, and for managing permissions inside its workspace in a way that reflects its internal governance needs.

The customer is also responsible for the accuracy and relevance of the information it submits and for determining whether particular records should be corrected, exported, archived, or removed.

Boma will process customer data only as needed to provide the service, support the customer relationship, maintain security, comply with law, or follow documented customer instructions that are consistent with the service and applicable agreements.

Boma will apply commercially reasonable technical and organizational measures appropriate to the nature of the platform, including access controls, tenant-aware safeguards, and administrative processes designed to reduce unauthorized access.

Boma may use subprocessors or infrastructure vendors where needed to deliver hosting, storage, authentication, support, analytics, communication, or related operational capabilities.

Boma remains responsible for managing those vendors within the ordinary course of delivering the service and selecting providers that are appropriate for the product's operational model.

Boma maintains product and operational controls intended to support confidentiality, integrity, and availability of customer data. If a customer needs additional security clarification before rollout, Boma can address that through the commercial or onboarding process.

Where appropriate and reasonably necessary, Boma will assist customers with privacy or security questions relating to the processing performed through the service.

Customer data is retained for the duration reasonably needed to provide the service and support legitimate operational, legal, and security needs. Upon termination or offboarding, data handling may be governed by the applicable commercial arrangement, retention rules, or customer instructions supported by the service.

Customers that need export, deletion, or transition support should contact Boma so the request can be handled within the correct tenant and administrative workflow.

If a customer signs a separate negotiated agreement, procurement document, or enterprise data-processing addendum with Boma, that document may supersede these baseline data processing terms to the extent of any direct conflict.