Privacy Policy

1. Introduction

CropRec Ltd ("we", "us", "our") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the CropRec platform. We are a UK-based company and handle data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

CropRec Ltd is the data controller for personal data collected through the CropRec platform. For questions about data processing, contact us at support@croprec.com.

3. Data We Collect

We collect the following categories of personal data:

• Account information: name, email address, and password (hashed).
• Organisation information: company name, address, and farm details.
• Usage data: event logs, batch records, compliance data, and reports you generate.
• Technical data: IP address, browser type, device information, and access logs.
• Communication data: emails, support tickets, and feedback you send us.

4. How We Use Your Data

We use your personal data for the following purposes:

• Providing and maintaining the CropRec platform.
• Authenticating your identity and managing your account.
• Generating compliance reports and traceability records.
• Providing customer support.
• Sending service-related communications (e.g., maintenance notices, security alerts).
• Improving the platform based on usage patterns (anonymised and aggregated).

We do not sell your personal data to third parties. We do not use your agricultural data for marketing purposes.

5. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contract: processing necessary to provide the CropRec service you signed up for.
• Legitimate interest: platform improvement, security monitoring, and fraud prevention.
• Consent: marketing communications (optional, and you can withdraw consent at any time).
• Legal obligation: where required by law (e.g., tax records, regulatory requests).

6. Data Sharing & Sub-Processors

We share your data only with the following categories of recipients:

• Supabase (EU) — Database, authentication, and file storage.
• Vercel (Global) — Frontend hosting.
• Railway (US) — API hosting.
• Stripe (US) — Billing and payment processing.
• Resend (US) — Transactional email delivery.
• Zoho (EU) — Email inbox and aliases.
• Legal authorities: where required by law or court order.

All third-party processors are bound by data processing agreements and are required to handle your data in accordance with applicable data protection law. A full sub-processors table is available on our Security page.

7. Cookies

CropRec uses the following categories of cookies:

• Essential cookies: required for authentication and session management. These cannot be disabled.
• Analytics cookies: used to understand platform usage patterns (anonymised). You can opt out of these.

We do not use advertising or tracking cookies.

8. Data Retention & Deletion

We retain different categories of data for different periods:

Account Closure

On account closure, you are given the opportunity to export all your data as PDF and Excel files. Your farm data is then deleted from our production systems within 90 days. Anonymised, aggregated data may be retained indefinitely for statistical purposes.

9. Your Rights

Under UK GDPR, you have the following rights:

• Access: request a copy of your personal data.
• Rectification: request correction of inaccurate data.
• Erasure: request deletion of your data (subject to legal obligations — see below).
• Portability: receive your data in a structured, machine-readable format.
• Restriction: request that we limit processing of your data.
• Objection: object to processing based on legitimate interest.

Right to Erasure — Important Note

Personal data (name, email, contact details) can be deleted or anonymised on request. However, compliance records forming part of a legal audit trail cannot be deleted, as they may be required for regulatory purposes. Where erasure is not possible, personal data within those records can be anonymised so that individuals are no longer identifiable.

Audit logs are retained permanently and cannot be deleted, as they may be required for regulatory investigations.

How to Submit a Data Request

To exercise any of these rights, contact support@croprec.com with the subject line "Data Request — [Farm Name]". We will respond within 30 days.

10. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, multi-tenant data isolation via Row Level Security, and automated vulnerability scanning.

Full details of our security measures are available on our Security page.

11. International Transfers

Your data is primarily stored within the European Economic Area. Where data is transferred outside the EEA (e.g., to infrastructure providers in the US), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to all registered users. The "last updated" date at the top of this page reflects the most recent version.

13. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.