Privacy policy

The controller for account, usage and website data is:

Farmer and plot data is different. When an operator (a cooperative, trader or exporter) uploads plot geometries, supplier records or farmer identifiers, that operator decides why and how the data is used and is the controller for it; Spatial Sustainability Hub processes it only on the operator's instructions as a processor (GDPR Art. 28; Act 843 s.30). We are controller only for platform security, account administration and our own compliance records. Operators must have a lawful basis to share the data, should upload it pseudonymised — plot and supplier codes, not farmer names — and must not upload more than the EUDR requires. Our data-processing terms form part of the Terms of service; a signed Data Processing Agreement is available from privacy@spatialsusty.com.

Sensitive and children's data are not accepted. If a file contains them we quarantine it, tell the operator the same day and do not process it further.

We do not sell personal data, do not build advertising profiles, do not send direct marketing without your prior consent, and do not use your plot data to train models for other customers.

Risk verdicts are decision support. A Verdex result must not be used as the sole automated basis for a decision that significantly affects a farmer, cooperative member, worker or supplier — a human must review it and there must be a route to correction. Operators accept this in the Terms; affected people may ask for human review through the operator or through us.

• Application database and processing: a virtual machine operated by the provider named in the Legal notice.
• Uploaded files, evidence packets and backups: Google Cloud Storage, region europe-west3 (Frankfurt, Germany).
• Reference satellite data (public, no personal data) is stored separately from operator data with separate access controls.

Personal data may therefore be processed outside your country. Transfers out of the EU/EEA rely on an adequacy decision or the EU Standard Contractual Clauses with a transfer risk assessment; Ghana-origin data is transferred only under the safeguards Act 843 requires and the operator's data-processing agreement. Every vendor and country is recorded in our vendor and transfer register before any data moves.

• Google Cloud — object storage and, where enabled, Earth Engine analysis (Google Ireland Ltd / Google LLC).
• E-mail delivery provider for transactional and support mail.
• Plausible Analytics (Plausible Insights OÜ, Estonia) — only if analytics is enabled on this deployment and you consent; receives no cookies and no identifiers.
• Your own identity provider, if your organisation uses SSO.

Professional advisers, and regulators, courts or authorities where the law requires, may also receive data. Authorities receive nothing from us about your plots directly: operators submit their own Due Diligence Statements. We give 30 days' notice before adding a sub-processor.

Retention is also capped by plan (Free 30 days, Starter 1 year, Growth and Enterprise the full period). Operators may agree shorter periods or earlier return/deletion by contract; on termination we return or delete within 30 days except evidence under the 5-year rule. Backups expire on their normal rotation.

You can ask for access to, a copy of, correction of, or erasure of your personal data; restriction of or objection to processing; and portability. Where processing rests on consent you may withdraw it at any time (analytics: use “Cookie settings” in the footer). You may also object to direct marketing and ask for human review of a decision based on an automated risk verdict. Write to privacy@spatialsusty.com (or support@spatialsusty.com); we may need to verify your identity, ask only for what that requires, and answer within one month (extendable for complex requests, with notice). Operators can also export or erase their whole account through the API (POST /v1/operators/{id}/data-export, DELETE /v1/operators/{id}); erasure archives the tamper-evident audit trail before deleting, because the law requires us to be able to show what happened.

If you are a farmer whose plot was uploaded by a cooperative or buyer, that organisation is the controller: make your request to it, or to us and we will route it to them without delay. You may complain to us first, and to your supervisory authority — in Ghana the Data Protection Commission, in the EU the authority of your member state.

Transport encryption everywhere; passwords hashed; tenant isolation enforced at the application, database-row and object-store layers; per-tenant provisioning tokens; append-only audit chain; least-privilege containers; encrypted, verified, off-site backups. No system is perfect. If we learn of a breach affecting personal data we assess it immediately; where we are processor we notify the operator without undue delay, where the GDPR applies we notify the supervisory authority within 72 hours and affected people where the risk is high, and under Act 843 we notify the Ghana Data Protection Commission and affected people as soon as reasonably practicable.

The service is for businesses and their staff. We do not knowingly collect data from anyone under 18.

We do not send direct marketing to individuals without prior consent (Act 843 s.40) and never reuse plot, supplier or analysis data for marketing. Any product-update e-mail has a one-click unsubscribe.

We will post changes here with a new version date and, for material changes, tell account holders by e-mail before they take effect.