Privacy Policy

1. Introduction

GreenTrust Engineering Consulting ("GreenTrust", "we", "us", "our") is committed to protecting your personal data in compliance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the GreenTrust EUDR platform ("Platform").

2. Data Controller

The data controller for this Platform is:

3. Data We Collect

3.1 Account Data

• Email address
• Full name / Company name
• Password (managed by Auth0, which stores only a hash of it; see Section 9)
• Role (Operator/Supplier)

3.2 Business Data

• Company address, city, region, country, VAT number
• Approximate business location for the supply-chain map, derived from your city, region and country (see Section 3.4)
• Due diligence form submissions
• Plot of land data (coordinates, size, products)
• Product information and HS codes
• GeoJSON polygon data for plots
• Shipment data (batch numbers, quantities, shipping dates, countries of production and trade, and the plots each shipment came from)

3.3 Technical Data

• IP address (for security and audit logging)
• Browser user agent
• Authentication session tokens — issued by Auth0 and stored in HttpOnly, Secure cookies on your browser (the refresh-token cookie is SameSite=Strict). JavaScript running on the platform cannot read these cookies. See Section 11 for the cookie inventory.
• Session timestamps

3.4 Approximate Business Location (Supply-Chain Map)

If you are a supplier, your business is shown at an approximate position on the supply-chain maps of the operators you are linked to. If you are an operator, your headquarters is shown on your own supply-chain map. Both also appear on the administrator map (see Section 6). We work out this position ourselves from the city, region and country in your company profile:

• Source: the city, region and country you entered, matched against an offline copy of the GeoNames geographical database (geonames.org, licensed under CC BY 4.0) held on our own servers. Your street address is never used, and your address, city or region is not sent to any external geocoding service to work out this position.
• Precision: the position is never more precise than the reference point of a city or town. We use city level only when the place name you entered matches the reference data (exactly, or as a known spelling variant) and the match is unambiguous: the name is unique in your region or in your country, or it is the best match for a major town (a capital, the seat of a region or district, or a town of at least 15,000 inhabitants). If you leave the region empty, or we cannot recognise what you entered there, we are stricter: unless the name is unique in your country, we then use city level only for a capital, a regional seat or a town of at least 100,000 inhabitants. In every other case we use a reference point for your region or, failing that, your country (its capital city); the map popup states the precision of every pin. A smaller place that shares its name with a major town may therefore be shown at that town; entering your region reduces this risk, your profile page shows the place we used, and you can ask us to correct it (see Section 8).
• What we store: the latitude and longitude of that reference point, the place name from the reference dataset, the precision level (city, region or country), the dataset version, a keyed fingerprint of the city, region and country used (so that we can detect changes), whether a restriction applies (see Section 8), and when the position was calculated.
• When it is calculated: once for existing profiles when this feature is introduced, whenever your city, region or country changes, and again when we update the reference dataset (normally every 6–12 months).
• Shown back to you: your profile page shows how your business appears on the map (place name and precision level).
• Use: the position is used only to display the maps. It is not used as plot geolocation, in due diligence statements (DDS), in risk assessments, or for any automated decision-making within the meaning of Art. 22 GDPR.

3.5 Documents You Upload

Suppliers upload the documents that show their production is legal (Art. 2(40) EUDR): for example land titles and leases, permits, certificates, audit reports, tax and company registration documents, and labour or community-consent records. These documents can contain personal data of the people named in them (for example a landowner, a signatory or a worker). We store each document with its kind, legal area, issue and expiry dates, the plots it covers and GreenTrust's review of it. Labour documents are accepted only redacted or in aggregate form, without data about individual workers. Upload only documents you are entitled to share for this purpose.

3.6 Risk Assessments and Reviews

For every plot we keep the results of the automated risk checks (see Section 5.1), the risk verdict and its history, and, where a GreenTrust reviewer looked at the plot, the reviewer's scores, notes and decision. For a supplier we also keep the scores GreenTrust gives once to its documents (supply-chain and legal-compliance indicators), with the reviewer's notes, and the supplier's overall risk level. Reviewers are identified by their account id, not by name.

3.7 Support Tickets

When you open a support ticket we store your e-mail address (encrypted), your role, the category, subject and message you write, its status (open or closed) and the dates it was opened and closed. GreenTrust's support staff read your tickets to answer them, and you get an e-mail when a ticket is closed.

4. Legal Basis for Processing

We process your data under one of the following legal bases (GDPR Article 6). The basis depends on the data category, not on a blanket choice across the platform:

5. How We Use Your Data

• Providing the EUDR due diligence compliance platform
• User authentication and role-based access control
• Operator-supplier relationship management
• Showing suppliers and operator headquarters at approximate positions on supply-chain maps (see Section 3.4)
• Generating compliance reports and analytics
• Assessing the risk of each plot and supplier (Section 5.1), and reviewing the documents suppliers upload
• Preparing due diligence statements and, where an operator has given GreenTrust a mandate, submitting them to the EU Information System on its behalf
• Security monitoring and audit logging
• Responding to your support requests

5.1 Automated Risk Assessment (Art. 22 GDPR)

When a supplier adds a plot, the Platform checks it automatically: the plot's outline against satellite forest-loss and deforestation-alert data and maps of indigenous and community lands (Global Forest Watch and LandMark, World Resources Institute); the country's risk under the EU benchmarking (Implementing Regulation (EU) 2025/1093), the World Bank's governance indicators and public labour-rights indices (ITUC Global Rights Index, US Department of Labor child-labour findings); the completeness and consistency of the data; and the supplier's documents, scored once by a GreenTrust reviewer where available. From these the Platform computes a risk verdict for the plot: pass, mitigation needed or fail.

The verdict decides whether the plot can be declared in a due diligence statement, so it can affect whether an operator buys from a supplier. Most suppliers are companies; where a supplier is a natural person (for example a sole trader or smallholder), this is an automated decision that significantly affects them. Plots whose checks are incomplete, or that show possible deforestation or an overlap with indigenous or community lands, always go to a GreenTrust reviewer, and any verdict is reviewed by a person on request: operators can ask for a review on the plot's page, and suppliers and operators can contest a verdict and give their point of view by writing to privacy@greentrust.eu (Art. 22(3) GDPR). A reviewer's decision replaces the automated one.

6. Data Sharing

We do not sell your personal data. We share data only with:

• Auth0 (Okta): Authentication provider — processes email, name, and password for login purposes.
• Linked Operators/Suppliers: When you are linked to an operator or supplier, relevant business data is shared as necessary for EUDR compliance.
• Supply-chain map (Section 3.4): If you are a supplier, operators with an active link to you see your approximate position, its place name and precision level, and your company name, city, region and country on their supply-chain map; your street address is not shown on the map. If you are an operator, your headquarters position is shown on your own map. Platform administrators can see both on the administrator map.
• Esri (map imagery): When you open a map on the Platform, your browser loads satellite imagery tiles directly from Esri's ArcGIS Online service (server.arcgisonline.com), operated by Environmental Systems Research Institute, Inc. (Esri, United States). As with any web request, Esri receives your IP address, your browser user agent, the address of our website, and the coordinates of the tiles requested, which reveal the map area and zoom level you are viewing (for example, the area around the pins on your map). We do not send Esri the pins, names or any other data about you or your business partners. See Section 10.
• AI assistant (currently Google LLC, Gemini API): When you use the assistant in your dashboard, the text you type and up to ten previous messages of the same conversation are sent from our servers to the AI provider to generate the answer. Please do not type personal data about yourself or other people into the assistant.
• E-mail delivery (Sendinblue SAS, Brevo, France): Our notification e-mails (for example plot requests, reviews, DDS and support notifications, and supplier invitations) are delivered through Brevo, which receives the recipient address and the content of the message. When an operator enters a supplier's e-mail address to send an invitation, the address is used only to send that e-mail and is not stored on the Platform.
• Geospatial risk analysis (World Resources Institute, United States): To assess deforestation risk, our servers send the outline (polygon) of a plot, a buffer around it and date ranges to the Global Forest Watch Data API and the LandMark service. No names, e-mail addresses or other account data are sent with these queries.
• Other map tiles: The “Streets” basemap of the plot map in the supplier form is loaded by your browser from the OpenStreetMap Foundation (tile.openstreetmap.org, United Kingdom). The assessment map, which only GreenTrust administrators open, also offers that basemap and adds two overlays, which the administrator's browser loads: the deforestation-alert overlay (GLAD/RADD integrated alerts) from Global Forest Watch (tiles.globalforestwatch.org, World Resources Institute, United States) and the ESA WorldCover land-cover overlay from VITO’s Terrascope service (services.terrascope.be, Belgium). As for Esri, these services receive the viewer's IP address, browser user agent, the address of our website and the map area viewed.
• EU Information System (European Commission, TRACES): A due diligence statement filed by an operator, or by GreenTrust under the operator's mandate, carries the operator's name, address and EORI number, the products, quantities and countries of production, and the geolocation of the plots. Producer names are not sent unless the operator chooses to. Direct filing from the Platform is not switched on yet.
• GreenTrust reviewers: GreenTrust staff review plots, documents and support tickets as described in Sections 3.5–3.7 and 5.1. They are bound by confidentiality.
• EU Authorities: When required by EUDR regulation for compliance verification.

Approximate map positions are calculated on our own servers using an offline copy of the GeoNames dataset. No address, city name or other information about you is sent to an external geocoding service for this purpose, and no additional sub-processor is involved.

For a complete list of sub-processors and their roles, see our Sub-processor List. A Data Processing Agreement (DPA) template is also available.

7. Data Retention

• Account data: Retained while your account is active. When we carry out an erasure request, which we answer within 30 days (Section 8), your account record is anonymised and your sign-in identities at Auth0 are deleted, subject to the EUDR carve-out below. Copies in the daily backups are deleted by our backup rotation after 30 days (at most 60 days while recent backups are incomplete).
• Submission data (DDS, supplier forms, plot geolocation, supporting documents): Retained for at least 5 years from the date of submission, as required by Article 12(4) of EU Reg. 2023/1115. This obligation overrides erasure requests for the duration of the retention period — see GDPR Art. 17(3)(b)+(e).
• Audit logs: Retained for 5 years to align with the EUDR evidence-trail retention obligation under Article 12(4) of Reg. 2023/1115 and to meet GDPR accountability requirements.
• Approximate map position (Section 3.4): Kept while your company profile exists and recalculated whenever your city, region or country changes or we update the reference dataset. Deleted when your data is erased or your account is deleted; backup copies are deleted by our backup rotation after 30 days (at most 60 days while recent backups are incomplete). It is not due-diligence evidence and is therefore not subject to the EUDR carve-out below.
• Risk assessments and reviews (Section 3.6): Kept with the plot's due-diligence record, at least 5 years after the last verdict (Article 12 of Reg. 2023/1115); a supplier's document scores are kept 5 years after their last change.
• Support tickets: Kept until you delete them (you can delete your own tickets at any time from the support panel) or your account data is erased.
• Session cookies: Access tokens expire with the token (currently up to 24 hours); refresh tokens are invalidated on logout, on Auth0 token rotation, or after 30 days, whichever comes first. Independently of the tokens, our server ends a session after at most 2 hours of inactivity (30 minutes for administrators) and at most 12 hours after sign-in (8 hours for administrators), and ends every session of an account at once when you log out or when we remove the account's access.

Deletion by an operator. An operator can delete its shipments, products and due diligence statements at any time. Data that no submitted due diligence statement relies on is deleted at once. Data that a submitted statement relies on is removed from the operator's and supplier's screens at once and kept, out of sight, for the rest of the 5-year EUDR retention period; it is then erased automatically.

EUDR carve-out from erasure. If you exercise your Right to Erasure (Art. 17 GDPR) on data that we are required to keep under EUDR Art. 12(4), we will: (a) anonymise your identifying fields where doing so does not break the audit log; (b) retain the underlying due-diligence record for the remainder of its 5-year retention window; and (c) delete the record fully once the retention period ends. We will tell you which data was retained on this basis when we respond to your request.

8. Your Rights (GDPR Articles 15-22)

You have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing (Art. 18): Request limitation of how we use your data.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Rights on automated decisions (Art. 22): Obtain a review of an automated risk verdict by a person, express your point of view and contest the verdict (see Section 5.1).
• Right to withdraw consent (Art. 7(3)): Withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Your map position (Section 3.4). Your profile page shows how your business appears on the supply-chain map, and the position is included in the copy of your data you can request under Art. 15. To correct it (Art. 16), update the city, region or country in your profile; the position is recalculated automatically. If your profile details are correct but the position is still wrong, contact us at privacy@greentrust.eu. To object to this processing (Art. 21), email privacy@greentrust.eu; from then on your business will be shown on the maps at country level only.

9. Data Security

• Data is encrypted in transit with TLS 1.2 or TLS 1.3 between your browser and the Platform, and between the Platform and the services listed in Section 6 (e-mails are handed to Brevo over SMTP with STARTTLS).
• Selected personal-data fields are encrypted by the Platform before they are stored, with Fernet (AES‑128‑CBC + HMAC‑SHA256): account email addresses; the company names, addresses, VAT and EORI numbers, phone numbers and contact names of operators and suppliers; the email addresses in audit-log and support records; and notification messages. Account email lookup uses an HMAC‑SHA256 blind index so the plaintext email is never required at the database boundary.
• Other stored data, such as plot geolocation, due diligence statement content, and the IP addresses and user agents in the audit log, is not encrypted by the Platform itself. The database and the uploaded files are held by Appwrite Cloud. Our storage buckets are set to encrypt files, but Appwrite applies that encryption only to files of up to 20 MB, and the Platform accepts documents of up to 25 MB. Whether Appwrite also encrypts the database at rest is still to be confirmed with Appwrite.
• Every uploaded file (documents, plot geometry files and signed mandates) is scanned for malware with ClamAV on our own server before it is stored; a file in which the scan finds malware, or that cannot be scanned, is refused.
• The daily backup archives are encrypted (AES‑256‑GCM) and kept on our application server; an encrypted copy outside that server is not in place yet. The keys that decrypt the archives and the fields listed above are held on the same server.
• Sign-in is handled by Auth0 (OpenID Connect, Backend-for-Frontend pattern). When you sign in with a password, our server passes it to Auth0 over TLS and never stores it; sign-in on Auth0's login page or with Google uses the authorization-code flow with PKCE S256. Access tokens are issued by Auth0 and stored in HttpOnly, Secure cookies (__Host-eudr_access, __Host-eudr_id, __Host-eudr_refresh, __Host-eudr_auth_at) — JavaScript on the platform cannot read them. Logging out ends every session of the account on our server and revokes the refresh token at Auth0.
• JWT signatures are validated with RS256 against Auth0's JWKS on every request.
• Role-based access control (RBAC) is enforced on every API endpoint.
• Sign-in supports a second factor (an authenticator app or a one-time code sent by email) when Auth0 asks for one. The Platform does not yet itself check that administrators signed in with one.
• Same-origin enforcement on every state-changing request defends against cross-site request forgery.

10. International Transfers

The platform's primary data-processing infrastructure (application hosting at Hetzner in the EU, application database at Appwrite Cloud Frankfurt) operates within the European Economic Area (EEA).

Our identity provider, Auth0, is hosted in the EU (Frankfurt) but is owned by Okta, Inc., a US-headquartered company. To address the residual risk that US authorities could compel disclosure under the CLOUD Act, we rely on the European Commission's EU 2021/914 Standard Contractual Clauses (SCCs) contained in our Auth0 Data Processing Addendum and supplementary technical measures — encryption-at-rest and minimisation of the identity attributes shared with Auth0 (email, name, password and MFA factors). A Transfer Impact Assessment summarising the residual risk is available on request.

Geospatial analysis. For the risk assessment of a plot, our servers send the plot's outline, a buffer around it and date ranges to the World Resources Institute (Global Forest Watch Data API and LandMark, United States). No names, e-mail addresses or account data accompany these queries. The deforestation-alert overlay (GLAD/RADD integrated alerts) of the assessment map, which only GreenTrust administrators open, is loaded by the administrator's browser from tiles.globalforestwatch.org; those requests carry the administrator's IP address, browser user agent, the address of our website and the tile coordinates of the area viewed. The safeguard under Chapter V GDPR for these transfers is still to be confirmed.

AI assistant. Messages you type into the assistant are sent to the AI provider, currently Google LLC (United States), to generate the answer. The safeguard under Chapter V GDPR for this transfer is still to be confirmed.

Streets map. The OpenStreetMap Foundation is based in the United Kingdom, for which the European Commission has adopted an adequacy decision.

Approximate map positions (Section 3.4) are calculated and stored on our EEA infrastructure; no personal data is transferred outside the EEA for that purpose. The satellite imagery shown on the Platform's maps, however, is loaded by your browser directly from Esri (server.arcgisonline.com), which is based in the United States. Those requests carry your IP address, browser user agent, the address of our website and the map area you are viewing (see Section 6), and Esri may process them outside the EEA. Esri states that it is certified under the EU–U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (GDPR Art. 45).

11. Cookies

We set only strictly-necessary cookies required for the platform to function:

• __Host-eudr_access — access token issued by Auth0; SameSite=Lax; expires with the token (currently 24 hours).
• __Host-eudr_id — OIDC ID token issued by Auth0; SameSite=Lax; same lifetime as the access token.
• __Host-eudr_refresh — refresh token; SameSite=Strict; 30 days, renewed at each token rotation, revoked at Auth0 and deleted at logout.
• __Host-eudr_auth_at — your session record, signed by our server: your user id, the time and method of your last sign-in, a random session version, and when the session started and was last active (used for the inactivity and maximum session limits, to end sessions on logout, for re-authentication checks and to bind the refresh token to your account); SameSite=Lax; 12 hours, deleted at logout and when the session ends.
• __Host-eudr_login_bounce — a redirect-loop guard on the sign-in page; contains no personal data; SameSite=Lax; 15 seconds.
• __Host-session — Flask CSRF/session cookie; SameSite=Lax.

All of these cookies are HttpOnly and Secure, use Path=/ and carry no Domain attribute. Cookies with the former names (__eudr_access, __eudr_id, __eudr_refresh) are deleted whenever a browser still sends them. The platform also stores these items in your browser (not cookies). None of them contains a token.

In localStorage (kept until you clear it):

• eudr_theme, eudr_lang, eudr_cookie_consent — your dark/light mode, language choice and cookie-notice acknowledgement. UI preferences only.
• eudr_last_activity, eudr_expires_at, eudr_last_refresh_ok, eudr_logout, eudr_logout_pending — timestamps that let your open tabs share the inactivity sign-out and the session renewal. They contain no personal data.

In sessionStorage (this tab only, deleted when the tab closes):

• eudr_login_next, eudr_login_notice, eudr_login_autoredirects, eudr_session_time — where to return after signing in, a one-time notice, a redirect-loop guard and the session start time.
• oidc_state, oidc_code_verifier, oidc_redirect_uri — one-time values of a Google or Microsoft sign-in in progress (security of the redirect).
• eudr_pending_signup_role, eudr_pending_gdpr_consent, eudr_pending_privacy_accepted, eudr_pending_access_code — your choices on the sign-up page while you sign up with Google or Microsoft.
• eudr_login_email — your e-mail address, handed from the “verify your e-mail” page to the sign-in form so you do not retype it; read and deleted when the sign-in page opens.
• eudr_current_step — the step of the form you were on.
• eudr_risk_autostart — administrators only: the id of the plot whose risk assessment restarts when they come back from a supplier's card.

We do not set analytics or advertising cookies and we do not embed third-party trackers. Strictly-necessary cookies are exempt from prior-consent requirements under EDPB Guidelines 05/2020.

12. Children's Privacy

This Platform is not intended for individuals under 16 years of age. We do not knowingly collect data from children.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of significant changes via email or an in-app notification. The "Last updated" date at the top indicates when this policy was last revised.

Change history

• Version 1.4 (October 5, 2026): Described the encryption, backup, multi-factor and sign-in measures as they are (Sections 3.1 and 9), the erasure and the backup rotation (Section 7), which browsers load each map overlay and that direct filing in the EU Information System is not switched on yet (Section 6), and the open safeguards of the transfers to the World Resources Institute and the AI provider (Section 10); the server-side sessions, which end at once on logout and after a period of inactivity, the encrypted backups and the malware scan of every uploaded file (Section 9).
• Version 1.3 (October 5, 2026): Described the shipment data, the documents suppliers upload, the risk assessments and reviews, the supplier document scores and the support tickets (Sections 3.2 and 3.5–3.7) with their legal bases (Section 4) and retention (Section 7); added the automated risk assessment and the right to a human review (Sections 5.1 and 8); named the EU Information System and GreenTrust's reviewers as recipients (Section 6).
• Version 1.2 (September 30, 2026): Disclosed the AI assistant provider (Google), e-mail delivery (Brevo) including supplier invitations, the geospatial analysis queries to the World Resources Institute, and the OpenStreetMap, Global Forest Watch and Terrascope map tiles (Sections 6 and 10); described what an operator's deletion does to evidence a submitted statement relies on (Section 7); rights are exercised by e-mail (Section 8); completed the list of items kept in browser storage (Section 11).
• Version 1.1 (September 17, 2026): Named GreenTrust Engineering Consulting (Greece) as data controller; added approximate business locations on supply-chain maps (Sections 3.4, 4, 5, 6, 7, 8 and 10); disclosed that map imagery is loaded from Esri; named the Hellenic Data Protection Authority as lead supervisory authority (Section 14).
• Version 1.0 (March 4, 2026): Initial version.

14. Contact & Complaints

If you have questions about this Privacy Policy or wish to exercise your data rights:

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). Our lead supervisory authority is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, www.dpa.gr). You may also complain to the data protection authority of any EU/EEA Member State, in particular the one where you live or work or where the alleged infringement took place.