Terms of Service

1. Definitions

• "Platform" means the GreenTrust® EUDR web application, APIs, and related services operated by GreenTrust Engineering Consulting, established in Greece ("GreenTrust", "we", "us").
• "User" means any individual or legal entity that accesses the Platform, including Operators, Suppliers, and Administrators.
• "Operator" means an entity that places or makes available relevant commodities or products on the EU market, or exports them, under Regulation (EU) 2023/1115 (EUDR), and uses the Platform for its due diligence.
• "Supplier" means a producer or trader who supplies commodities or products to an Operator and is invited by it to the Platform.
• "Content" means all data, documents, forms, geolocation data, and other materials uploaded or submitted to the Platform.
• "Risk Verdict" means the outcome of the risk assessment of a plot (pass, mitigation needed or fail), computed by the Platform or decided by a GreenTrust reviewer.

2. Eligibility and Account Registration

• You must be at least 18 years old and have legal authority to bind your organization.
• You must provide accurate, complete information during registration and keep it up to date.
• You are responsible for all activity under your account and for maintaining the confidentiality of your credentials.
• Each account is for a single organization. Sharing credentials across organizations is prohibited.
• Operator accounts are activated after GreenTrust approves the registration. Suppliers join with the invitation an Operator sends them.

3. Permitted Use

The Platform is provided solely for the purpose of:

• Managing EUDR due diligence compliance obligations;
• Collecting, storing, and exchanging supplier declarations, shipments, documents and geolocation data;
• Preparing due diligence statements for the EU Information System (direct submission from the Platform is not switched on yet);
• Risk assessment and risk mitigation for regulated supply chains.

You may not use the Platform for any unlawful purpose or in any manner that could damage, disable, or impair the Platform.

4. User Obligations

• Data Accuracy: You are solely responsible for the accuracy, completeness, and legality of all Content you submit.
• Compliance: You must comply with all applicable laws, including EUDR (Regulation (EU) 2023/1115), GDPR, and national implementing legislation.
• No Misrepresentation: You must not submit false, misleading, or fraudulent declarations, documents or geolocation data.
• Documents: Upload only documents you are entitled to share for EUDR due diligence. Where a document names other people (for example landowners, signatories or workers), you must be allowed to share their data for this purpose. Labour documents must be redacted or aggregated so that they identify no individual worker.
• Sharing between linked users: A Supplier's company profile, plots, answers to shipment requests and documents are shared with the Operators linked to it, as far as their due diligence requires. An Operator may delete its own records at any time (Section 10).
• Security: You must not attempt to gain unauthorized access, reverse-engineer, or interfere with the Platform's security controls.
• Confidentiality: You must treat invitation tokens, access codes, and linked supplier data as confidential.

5. Risk Assessments and Reviews

• The Platform assesses the risk of each plot automatically, from the plot's geolocation, public datasets (among them Global Forest Watch, LandMark, the EU country benchmarking, World Bank governance indicators and public labour-rights indices) and the evidence in the Platform, including the Supplier's documents. GreenTrust reviewers look at plots the automated checks cannot decide and at any plot on request, and score each Supplier's documents.
• Risk Verdicts support the Operator's own risk assessment under Articles 10 and 11 of the EUDR; they do not replace it. Third-party datasets can be incomplete, delayed or wrong, and a verdict is only as good as the data and documents provided. The Operator decides whether and how to place products on the market and remains responsible for its due diligence statements (Article 4 EUDR).
• Operators may ask GreenTrust to review a verdict in the Platform, and Suppliers and Operators may contest a verdict by e-mail (see the Privacy Policy, Section 5.1). A reviewer's decision replaces the automated verdict.

6. Representation in the EU Information System

• An Operator may file its due diligence statements in the EU Information System itself, or may authorise GreenTrust to file them on its behalf by signing GreenTrust's written mandate (Article 6 EUDR). GreenTrust files a statement only under an active mandate and only after the Operator has confirmed the statement in the Platform. Direct filing from the Platform is not switched on yet.
• Filing by GreenTrust does not transfer the Operator's obligations: the Operator remains responsible for the compliance of the relevant products and for the content of its statements. The Operator may revoke the mandate at any time.

7. Support and the AI Assistant

• You can open support tickets from the support panel of the Platform. GreenTrust answers them by e-mail and closes them when they are resolved; you are told by e-mail when a ticket is closed, and you can delete your own tickets.
• The AI assistant in the dashboards gives general guidance generated by an AI model. Its answers can be wrong or incomplete, are not legal advice and do not change any data in the Platform. Do not type personal data into the assistant.

8. Intellectual Property

• The Platform, including its software, design, logos, and documentation, is the intellectual property of GreenTrust Engineering Consulting and is protected by copyright and trademark laws.
• You retain ownership of your Content. By submitting Content, you grant GreenTrust a non-exclusive, worldwide license to store, process, and display it solely for the purpose of providing the Platform's services.
• The GreenTrust® name and logo are registered trademarks and may not be used without written permission.

9. Data Processing and Privacy

• We process personal data in accordance with our Privacy Policy and the EU General Data Protection Regulation (GDPR).
• The Privacy Policy explains which personal data is processed, on which legal basis and for how long, and how to exercise your rights. It is not a request for consent: where the GDPR requires consent, we will ask for it separately.
• For Operators acting as data controllers: a Data Processing Agreement (DPA) is available. See also our Sub-processor List.

10. Data Retention

• EUDR Evidence: Due diligence records, supplier declarations, documents, risk assessments and geolocation data are retained for a minimum of 5 years from the date of submission, as required by Article 12 of Regulation (EU) 2023/1115.
• Audit Logs: Activity logs are retained for 5 years to align with the EUDR evidence-trail retention obligation under Article 12 of Regulation (EU) 2023/1115 and to meet GDPR accountability requirements.
• Account Data: Retained for the duration of your account. After the account is deleted or erased, copies remain in the daily backups until the backup rotation removes them, after 30 days (at most 60 days while recent backups are incomplete), except where longer retention is required by law.
• Deleting your data: An Operator can delete its shipments, products and due diligence statements at any time. Data that a submitted due diligence statement relies on is removed from your screens at once and kept out of sight for the rest of the 5-year EUDR retention period, then erased automatically; other data is deleted at once.

11. Service Availability

• We aim for 99.5% uptime but do not guarantee uninterrupted access.
• Planned maintenance will be communicated at least 48 hours in advance when possible.
• We are not liable for outages caused by force majeure, third-party services (e.g., Auth0, cloud providers, the EU Information System or the public datasets of the risk checks), or circumstances beyond our reasonable control.

12. Limitation of Liability

• The Platform is provided "as is" and "as available" without warranties of any kind, express or implied.
• GreenTrust does not warrant that the Platform will ensure regulatory compliance — ultimate responsibility for EUDR obligations rests with the Operator (see Sections 5 and 6).
• To the maximum extent permitted by law, GreenTrust's total liability is limited to the fees paid by you in the 12 months preceding the claim.
• GreenTrust is not liable for indirect, incidental, consequential, or punitive damages.
• Nothing in these Terms limits liability that cannot be limited by law, in particular for intent or gross negligence.

13. Termination

• You may close your account at any time by contacting support@greentrust.eu.
• We may suspend or terminate your account for breach of these Terms, non-payment, or suspected fraudulent activity, with reasonable notice where possible.
• Upon termination, you may request an export of your data in accordance with GDPR Article 20 (right to data portability).
• Data subject to the 5-year EUDR retention requirement will be retained even after account closure.

14. Sub-Processors

We use the following sub-processors to deliver the Platform:

• Auth0 (Okta, Inc.): Authentication and identity management — EU region (Frankfurt, Germany).
• Hetzner Online GmbH: Cloud infrastructure hosting — EU (EU-owned, not subject to US CLOUD Act).
• Appwrite Cloud: Database and storage — EU-hosted cloud backend service.
• Google LLC (Gemini API): AI assistant in the dashboards — United States / global.
• Sendinblue SAS (Brevo): Transactional e-mail — France (EU).
• World Resources Institute (Global Forest Watch Data API, LandMark): Geospatial risk checks of plot outlines, without names or account data — United States.

Map tiles (Esri, OpenStreetMap, Global Forest Watch, VITO Terrascope) are loaded by your browser directly from those services. See the Sub-processor List and our Privacy Policy (Sections 6 and 10) for details. The Data Processing Agreement (DPA) template is published as well; questions go to dpo@greentrust.eu.

15. Governing Law and Disputes

• These Terms are governed by the laws of Greece.
• Any disputes shall be submitted to the exclusive jurisdiction of the courts of Athens, Greece.
• Before initiating legal proceedings, the parties agree to attempt resolution through good-faith negotiation for a period of 30 days.

16. Changes to These Terms

We may update these Terms to reflect changes in our services or legal requirements. Material changes will be communicated via the Platform or email at least 30 days before taking effect. Continued use after the effective date constitutes acceptance.

Change history

• Version 1.2 (October 5, 2026): Direct filing in the EU Information System is not switched on yet (Sections 3 and 6); account data in the backups (Section 10); the hosting location (Section 14).
• Version 1.1 (October 5, 2026): Named GreenTrust Engineering Consulting (Greece) as the provider and Greek law and the courts of Athens for disputes; added the risk assessments and reviews (Section 5), the representation in the EU Information System (Section 6), support tickets and the AI assistant (Section 7), the rules for uploaded documents and for sharing between linked users (Section 4), and the World Resources Institute as sub-processor (Section 14).
• Version 1.0 (September 30, 2026): Previous version.

17. Contact

For questions about these Terms:

• Email: legal@greentrust.eu
• Data Protection Officer: dpo@greentrust.eu