Before we start: two different roles
Sourevo processes personal data in two roles, and it helps to keep them apart because rights are exercised before whoever is responsible:
- As controller we process the data of website visitors, users of customer accounts and suppliers who create their own account in the portal. That is what this policy covers.
- As processor we process the data each customer organisation (importer, operator or forwarder) uploads or uses in its workspace: its suppliers, plots and evidence, the operator details for TRACES NT and the content of the statements it submits. There, that organisation is the controller and we only follow its instructions, under the data processing agreement.
When a supplier chooses to share a plot with a customer, that customer then uses it for its own due diligence and, for that use, it is the controller.
If you are a supplier or producer and a Sourevo customer has uploaded your data, that customer is the one who must handle your request. If you do not know which one, write to us and we will help you reach them.
1. Data controller
- Controller: Juan Cantón Rodríguez, self-employed professional trading as «Francodesystems».
- Tax ID (NIF): 45492167F
- Address: Carrer de Pau Casals 19, 4º 2ª, 08213 Polinyà (Barcelona), España
- Email: juan.canton@sourevo.com
We have not appointed a Data Protection Officer, as the activity does not fall within article 37 GDPR or article 34 LOPDGDD. For any privacy question, use the email above.
2. Data we process as controller
- Users of customer accounts: name, email, password (stored only as an argon2id hash, never in clear text), the organisation they belong to (company name and tax or VAT number) and their role in it.
- Suppliers with their own portal account: name, email, password (hash only), preferred language, email verification, declared tax identification (type, number and country), the result of its validation and the resulting trust level.
- Data the supplier declares in its portal: supplier details (name, country, email, phone), its plots (name, country, area and geolocation as point or polygon), the evidence it attaches and which customers it chooses to share each plot with. A smallholder’s plot geolocation may be personal data.
- Security and traceability: an audit log of actions (what was done, to what, when and by which type of user), one-time codes to verify email or reset passwords (we only store their hash), the IP address used in memory for a few minutes to limit login attempts (not stored in the database) and server technical logs.
- Support and contact: whatever you tell us by email or WhatsApp.
We do not ask for special categories of data (art. 9 GDPR). We use no analytics, advertising or third-party trackers.
Where the data comes from. You give us almost all of it. There are three exceptions: if your organisation’s administrator invites you, they give us your name and email; if a customer invites you as a supplier, it gives us your name and email to send you the invitation (there we act as its processor), and the result of validating your tax ID comes from the public registry queried (VIES or CNPJ).
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create and maintain your account, identify you and provide the service purchased or requested | Customer or supplier account, organisation | Performance of a contract (art. 6(1)(b) GDPR). If you use the account as an employee of a customer company, legitimate interest in maintaining the relationship with it (art. 6(1)(f) GDPR and art. 19 LOPDGDD) |
| Make the plots you declare as a supplier available to the customers you choose | Supplier details, plots, evidence | Performance of the contract with the supplier (art. 6(1)(b) GDPR) |
| Validate the supplier’s tax ID against public registries and compute its trust level | Tax ID and validation result | Legitimate interest in the reliability of supply chain information, which the supplier itself seeks when declaring it (art. 6(1)(f) GDPR) |
| Send service emails: verification, invitations, password reset, account notices | Name, email, language | Performance of a contract (art. 6(1)(b) GDPR) |
| Security, abuse prevention and audit log | Audit and technical logs, in-memory IP | Legitimate interest in protecting the service and being able to show who made each change (art. 6(1)(f) GDPR) |
| Comply with legal obligations: tax and accounting once there is invoicing, and requests from authorities | Billing data and whatever is required | Legal obligation (art. 6(1)(c) GDPR) |
| Answer enquiries and provide support | Whatever you tell us | Performance of a contract or pre-contractual steps (art. 6(1)(b) GDPR) and, for general enquiries, legitimate interest (art. 6(1)(f) GDPR) |
You may object to processing based on legitimate interest (see section 8). We currently send no newsletters or marketing communications. The supplier trust level is an indicator based on objective checks; it is not an automated decision with legal effects on you (art. 22 GDPR): each customer decides whether to work with a supplier.
Fields marked as mandatory in forms are needed to provide the service; without them we cannot create the account or carry out the operation.
Preparing, submitting, amending or withdrawing statements in TRACES NT is not in this table because we do it as processor, on the customer organisation’s instruction: the purpose and legal basis are decided by that organisation.
4. Who receives the data
- European Commission (TRACES NT): when a customer organisation, or its authorised representative, instructs the submission of a DDS, the statement data (operator, products, quantities, plot geolocation and references) is sent to the EUDR information system operated by the European Commission. We do this as that customer’s processor. From there the data is accessible to the competent authorities of the Member States and to customs. The Commission processes it under its own data protection rules (Regulation (EU) 2018/1725).
- Public tax registries: to validate a supplier’s tax ID we query the European Commission’s VIES service (EU VAT numbers) or Brazil’s public CNPJ registry. We only send the number and country.
- Sourevo customers: the plots and details a supplier chooses to share with a specific customer, and only with that customer. That customer uses them as controller for its own due diligence.
- Service providers (processors): those listed in section 5, under a data processing agreement pursuant to article 28 GDPR.
- Authorities and courts, when the law requires it.
We do not sell or share data for commercial purposes.
5. Providers that help us run the service
- Hetzner Online GmbH (Germany): hosting of the server, located in its data centre in Finland (European Union), with the database and files. The deployment platform (Coolify) is self-hosted by us on that server; it is not a third party.
- Resend, Inc. (United States): delivery of service emails. It receives the recipient address, name and email content, and stores them in the United States.
- Google Cloud EMEA Limited (Ireland), with Google Workspace: the mailbox for juan.canton@sourevo.com. It receives whatever you write to us by email.
- Cloudflare, Inc. (United States): DNS resolution of the sourevo.com domain only. Website traffic does not go through Cloudflare (no proxy), so it does not receive the content of your visits or your data.
If you write to us on WhatsApp, that service is provided by WhatsApp Ireland Limited under its own terms and privacy policy. Do not use it to send us third parties’ data; use email for that.
6. International transfers
Service data is hosted in the European Union. Data is transferred outside the European Economic Area in these cases:
- Resend, Inc. (USA): based on the European Commission’s standard contractual clauses included in its data processing agreement and, additionally, on the adequacy decision for the EU-U.S. Data Privacy Framework, under which Resend is certified.
- Google (Workspace): the contract is with an Irish company, but Google may process data in other countries, including the USA. Those transfers are based on the standard contractual clauses in its data processing agreement and on the EU-U.S. Data Privacy Framework.
- Cloudflare, Inc. (USA): limited to technical DNS resolution data, based on the same Data Privacy Framework and standard contractual clauses.
- Brazil’s CNPJ registry: a Brazilian company identification number is queried, in order to validate the identity the supplier itself has declared.
You can ask us for more information about these safeguards at juan.canton@sourevo.com.
7. How long we keep it
- Account: while it is active. After closure, data is blocked (art. 32 LOPDGDD) for as long as liability claims may arise (generally 5 years for contractual claims and up to 6 years for accounting and tax records), and then deleted.
- Statements (DDS) and data uploaded by a customer: we keep them as processor, following the customer’s instructions and the data processing agreement. By default, the archive of statements is kept blocked for 5 years from each submission, the minimum period the EUDR imposes on the operator.
- Audit log: while the data it refers to exists and, at most, 5 years.
- One-time codes: until they expire or are used.
- IP for rate limiting: in memory only, for the control window (minutes).
- Server technical logs: only as long as needed for security and troubleshooting and, at most, 30 days.
- Trial accounts that do not convert: deleted within a reasonable time after the trial ends, with prior notice.
- Support enquiries: while the enquiry lasts and up to one year after.
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and not to be subject to decisions based solely on automated processing, by writing to juan.canton@sourevo.com. We will only ask you to prove your identity if we have reasonable doubts. We reply within one month, extendable by two further months for complex cases (we would tell you).
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es) or with the supervisory authority of the country where you live or work.
If your data was uploaded by a Sourevo customer, contact that customer; if your request reaches us, we will forward it to them.
9. Security
We apply technical and organisational measures appropriate to the risk: encrypted connections (HTTPS), argon2id password hashing, TRACES NT credentials encrypted with AES-256-GCM, signed HttpOnly and Secure session cookies, isolation of each organisation’s data in every query, plot visibility controlled by the supplier, append-only statement history, login attempt limiting and least-privilege access. We also commit to keeping backups of the database within the European Union.
No system is infallible. If we suffer a security breach affecting your data, we will notify the AEPD in the cases and within the time limits of article 33 GDPR and tell you if it is likely to result in a high risk to you (art. 34 GDPR).
10. Minors
Sourevo is a professional service and is not aimed at people under 18. We do not knowingly collect minors’ data; if we find that a minor has created an account, we will delete it.
11. Changes to this policy
If we change this policy materially (for example a new provider or a new purpose), we will let you know by email or in the application before it applies. The date of the last update is shown above.