Privacy Notice

This website is operated by Regenerative Commodities Ltd ("Regenerative Commodities", "we", "us"), a private company limited by shares registered in England and Wales (company number 16782895), whose registered office is at 245 Dawes Road, London, SW6 7RD, United Kingdom. We are the data controller for the personal data described here.

We are reviewing whether we are required to register with the UK Information Commissioner's Office (ICO) and pay the data protection fee, and will update this notice once that is confirmed. You can reach us about privacy at max.hobhouse@regencommodities.co.uk.

It covers personal data we handle through this website (regencommodities.co.uk), including the early-stage platform prototype. It does not yet cover a live production platform handling real grower data — that will have its own, fuller notice when it launches.

1. When you visit the website

Our host (Vercel) and DNS/email providers automatically process basic technical data — including your IP address, browser type, and pages requested — to serve the site securely and keep it running. This is standard server-log information.

2. When you contact us

If you email us (for example via our contact link), we receive your email address and whatever you put in your message, and use it solely to respond to you. Our email runs on Google Workspace.

3. The platform prototype

To use the farm-registry prototype you create an account. Your email address and an encrypted (hashed) password are stored with our backend provider, Supabase, to operate your sign-in. The demonstration data you then create — grower names and the field outlines you draw — is now also stored with Supabase against your account, so it follows your sign-in to any device (previously it was held only in your browser). You can delete individual farms and fields from inside the prototype; "Clear my data" clears the copy cached in your browser; and "Delete account" removes your sign-in and your access. Please do not enter real personal data about real people into the demonstration data.

We do notuse advertising or third-party tracking cookies. The prototype uses your browser's local storage to keep you signed in and to hold the demonstration shapes you draw — not to track you. If we add analytics in future, we will update this notice and seek consent where required.

Under UK GDPR we rely on [PLACEHOLDER: confirm — typically "legitimate interests" for running the site and responding to enquiries; consent for any future marketing or analytics]. The final wording here should be confirmed with a data-protection adviser.

We don't sell your data. We use a small number of service providers that process data on our behalf ("processors"), under contract:

• Vercel — website hosting and server logs.
• Google Workspace — our email.
• Supabase — secure account sign-in and the database behind the platform prototype (holds your account email and encrypted password).
• Copernicus / Sentinel Hub — satellite imagery for the vegetation readings on field outlines (receives field coordinates, not your personal details).
• Map and land-data services — Esri (satellite basemap), ISRIC SoilGrids (soil), Open-Meteo/ERA5 and NASA POWER (rainfall), OpenLandMap and Digital Earth Africa (land cover). These receive only field coordinates or map-tile areas, never your personal details.
• [PLACEHOLDER: add any others as the platform grows.]

Some providers may process data outside the UK. Where that happens we rely on appropriate safeguards (such as UK adequacy regulations or standard contractual clauses). [PLACEHOLDER: confirm the specific transfer mechanism per provider.]

We keep personal data only as long as we have a genuine need for it, then delete or anonymise it. Our current retention approach is:

• Enquiry & contact emails — kept while we deal with your query and for a short period afterwards (up to about 2 years), then deleted, unless they form part of a business record we must keep longer.
• Contracts, invoices & accounting records — kept for 6 years, to meet UK company-law and tax requirements.
• Grower & programme data(once the live platform operates) — kept for the duration of the grower's participation in the programme and for a defined period afterwards to meet our contractual, audit and legal obligations.
• Website server logs — kept for a short period by our hosting provider for security and operational purposes.
• Platform prototype — account — your account email and encrypted password are held by Supabase to run your sign-in, and deleted when you close your account (self-serve inside the prototype, or by asking us).
• Platform prototype — demonstration data (grower names, field outlines) — stored with Supabase against your account; you can delete it from inside the prototype, and it is retained only while your account is open.

We review what we hold periodically and delete data we no longer need. These periods are an initial schedule and will be confirmed with our data-protection adviser [to be confirmed].

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to how we use it;
• data portability, where applicable; and
• complain to the ICO (ico.org.uk) — though we'd appreciate the chance to help first.

To exercise any of these, email max.hobhouse@regencommodities.co.uk.

We may update this notice as the platform develops. We'll change the "last updated" date above when we do.