Who we are
Batchproof Europe ("Batchproof", "we") provides supply chain data tooling and compliance support to businesses importing commodities into the European Union, principally in connection with the EU Deforestation Regulation.
This notice explains what we do with personal data. It is written to be readable rather than exhaustive. If something here does not answer your question, write to us and we will answer it properly.
Controller and processor
We handle personal data in two distinct capacities, and the difference matters for your rights.
As a controller
For our own website, marketing and client relationships, we decide what data we collect and why. We are the controller for that data and this notice governs it.
As a processor
When a client engages us, we handle data about their suppliers, cooperatives and — in some cases — individual producers. We handle that data on the client's instructions. The client is the controller; we are their processor, and our handling is governed by the data processing agreement we sign with them rather than by this notice.
If you are a producer or supplier and you want to know why your details are held, the company that buys from you is the right place to ask. We will help them answer, but we cannot act on your data without their instruction.
Website visitors
This site is deliberately light. It loads web fonts from Google Fonts, which means Google receives your IP address when you load a page here. Everything else on the page is served directly.
Our hosting provider keeps standard server logs — IP address, timestamp, page requested, browser type — which exist for security and reliability rather than for tracking you.
To complete before launch: name your hosting provider here, and state plainly whether you use analytics. If you add any analytics or advertising tool, this section must change and you will likely need a consent banner. If you add none, say so — it is a genuine selling point to this audience.
Prospective clients
We contact businesses that import commodities covered by the EU Deforestation Regulation. To do that we hold business contact details — name, job title, employer, work email, work phone — gathered from company websites, trade association directories, public exhibitor lists and professional networks.
We hold notes on our conversations with you, and details of any meeting you book with us.
If you would rather we did not contact you again, say so in one line and we will remove you. You do not need to give a reason.
Supply chain data
This is the sensitive part of what we do, so it is worth being precise.
Compliance work requires plot-level records: geolocation coordinates, plot areas, the identity of the producer or cooperative, and documentation on land tenure and legal compliance. Where a producer is an individual or a small family holding, coordinates tied to a named person can be personal data, and in some contexts sensitive.
We treat it accordingly:
- We collect it only on a client's instruction and only for their compliance purpose
- We do not sell it, and we do not reuse one client's supplier data for another client
- We do not use it to train machine learning models
- Access is limited to the people working on that engagement
Where we can do the work with a cooperative or company as the counterparty rather than a named individual, we do.
Lawful bases
Where we act as a controller, we rely on:
- Legitimate interests — for business-to-business outreach, for keeping notes on client relationships, and for keeping this site secure. We have considered whether this overrides your interests and concluded it does not, given that contact is limited to work contexts and to businesses with a live regulatory obligation.
- Contract — for everything necessary to deliver an engagement you have asked us to carry out.
- Legal obligation — for accounting and tax records.
Where we act as a processor, our client determines the lawful basis. For EUDR work this is typically their own legal obligation.
International transfers
Some of our service providers process data outside the European Economic Area. Where that happens we rely on an adequacy decision, or on Standard Contractual Clauses with supplementary measures where no adequacy decision applies.
Supply chain data frequently originates outside the EEA — a cooperative in Vietnam or Honduras sending us plot records. Data moving into the EEA is not a restricted transfer, but onward processing is covered by the safeguards above.
How long we keep it
- Prospect contact details — until you ask us to stop, or two years after our last meaningful contact, whichever comes first
- Client engagement records — for the engagement and six years after, for contractual and tax reasons
- Supply chain data held as processor — for as long as the client instructs. Note that operators must retain evidence supporting a due diligence statement for five years, so clients will usually instruct a five-year minimum
- Server logs — a short rolling window set by our host
When an engagement ends, we return or delete the client's data at their choice, subject to any retention they are legally required to maintain.
Security
We keep access to client data restricted to the people working on that engagement, use multi-factor authentication on the accounts that hold it, and encrypt data in transit and at rest with our providers.
No arrangement is perfect. If a breach occurs that is likely to result in a risk to people's rights, we will notify the relevant supervisory authority within 72 hours of becoming aware, and notify affected people where the risk is high. Where we hold data as a processor, we will notify the client without undue delay so they can meet their own obligations.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or provide it in a portable form. You can object to processing based on legitimate interests, and you can object to direct marketing at any time — that one is absolute and we will always honour it.
Write to shane@batchproof.eu. We will respond within one month. There is no charge.
If you are unhappy with how we have handled it, you can complain to the Irish Data Protection Commission at dataprotection.ie, or to the supervisory authority in the EU country where you live or work.
Changes
We will update this notice as the business changes. The version number and date at the top tell you which version you are reading. If a change materially affects how we handle your data, we will tell you directly rather than relying on you to check.
Contact
Anything about this notice, or about data we hold: shane@batchproof.eu.
We have not appointed a Data Protection Officer, as we are not required to. Correspondence goes to the address above and is read by a person.