We look after your data the way we look after landscapes: with purpose, transparency and clear limits. This Policy explains what data we use, why, who we share it with and how to exercise your rights. It follows UK data protection law and the data protection law of each national Coordinator's country, for example Peruvian law for people in Peru.
On this page
1. Who is responsible#
| Organisation | Responsible for |
|---|---|
| Nature Services Ltd, company 14971480, Ittington Manor, London Road, Battle, TN33 0LS, East Sussex, United Kingdom | The Platform: your account, how you use the Platform, the AI assistant and our communications with you |
| The national Coordinator of the country where you work with the network, listed in Regenera National Coordinators at regenera.earth/en/coordinators | Its work with you: Letters of Interest, verification, role agreements, invoicing, payments to beneficiaries and field data |
| Nature Services, Inc. (United States) | Collecting card payments on the national Coordinator's behalf, acting on its instructions |
One contact covers all three: privacy@regenera.earth. Whichever organisation receives your request makes sure it reaches the right one.
2. What data we use#
| Type of data | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, language, encrypted password, role | You |
| Organisation | Legal name, tax ID, sector, representatives, permissions | You or public registries |
| Letter of Interest and verification | Title deed or right of use, land registry extract, assembly minutes, management plans | The Guardian or their Landscape Partner |
| Land and landscape | Location and boundaries of the landholding, hectares, field evidence | The Guardian, the Landscape Partner or the national Coordinator |
| Footprint | Sales, consumption, product data and indicators | You (Partners) |
| Payments received | Plan or service, amounts, card payment details handled by Stripe, invoices | You and Stripe |
| Payments to beneficiaries | Bank account and tax documents issued by Guardians, Landscape Partners and Service Partners | Whoever receives the payment |
| Images and testimonies | Photos, video, voice | You, only with permission from whoever appears |
| Technical use | IP address, device, browser, cookies, activity and error logs | Automatic |
| AI conversations | Questions and answers with the assistant | You |
Sensitive data. Belonging to an Indigenous or native people reveals ethnic origin, which is sensitive data. We use it only when needed to verify a Collective Guardian, and only with explicit written consent.
3. Why we use it, and on what basis#
| Purpose | Legal basis |
|---|---|
| Create and manage your account | Performing our contract with you (the Terms) |
| Sell Plans and services, take payment and issue invoices | Performing the contract, and legal obligations (tax and accounting) |
| Assess a Letter of Interest and verify documents | Steps you ask us to take before an agreement, then the agreement |
| Manage Landscapes, measure footprints and distribute contributions | Performing your Plan or role agreement |
| Protect the Platform, fix errors and prevent fraud | Our legitimate interest in a secure service, and legal obligations |
| Show your Public Profile, photos or testimonies | Your consent, which you can withdraw at any time |
| Send you newsletters and news | Your consent, separate and optional |
| Improve the network with aggregated analysis | Our legitimate interest, using aggregated and anonymised data |
| Analytics cookies, if we add them | Your consent (see the Cookie Policy) |
Where a national Coordinator's country requires a different basis, that basis applies: in Peru, for example, your consent or the exceptions Peruvian law allows, such as performing a contract or meeting a legal obligation. We do not sell your data or use it for third-party advertising.
4. Who we share it with#
Within the network. Each person sees only what their role and permissions allow. The national Coordinator sees what it needs to verify and oversee. Your Landscape Partner sees information about its Landscape. Partners see the results of the Landscape they support, at the level of detail Guardians allow, and Guardians see which Partners contribute to their Landscape.
Within the Nature Services group, between Nature Services Ltd, the national Coordinator and Nature Services, Inc., only as needed for the purposes above.
Service providers who process data on our behalf, solely to deliver their service:
| Service | Provider | Where |
|---|---|---|
| Database and sign-in | Supabase | Ireland (EU) |
| Web hosting | Vercel | United States and global network |
| Card processing | Stripe | United States |
| Payments to beneficiaries | The national Coordinator's bank (in Peru, BBVA) | That country |
| Error monitoring | Sentry | United States |
| Email and documents | United States | |
| Newsletters | Mailchimp (Intuit) | United States |
| AI assistant | Anthropic | United States |
| Traceability records | LACNet | Nodes in Latin America, no personal data |
Authorities, only when the law requires it; for example, tax authorities receive the data on each invoice.
5. International transfers#
Your data may be processed in the United Kingdom, the European Union, the United States and the countries of the national Coordinators. When data leaves the UK, we rely on UK adequacy decisions (for example for the EU), the UK Extension to the EU-US Data Privacy Framework for certified US providers, or the UK International Data Transfer Agreement or Addendum. Transfers from a national Coordinator's country follow the safeguards its law requires. You can ask us for a copy of the relevant safeguards.
6. Artificial intelligence#
The AI assistant sees only the data your role allows. We contract AI providers whose terms do not allow your data to be used to train their models. No decision with legal or similarly significant effects on you, such as approving a role or calculating a payment, is made by automated means alone: a person makes or reviews it. We do not use a community's data to train AI models without its express consent.
7. Blockchain#
We do not record personal data on blockchain, only codes that allow a contribution to a Landscape to be verified. Those records cannot be deleted, but without our database they do not identify you. If you delete your account, we break that link.
8. How long we keep it#
- Account: while it is active; after closure, deleted or anonymised within 12 months.
- Invoices and payment records: for as long as tax and accounting law requires.
- Letter of Interest not approved: 12 months, so you can pick it up again.
- Traceability and audit: kept to protect the integrity of the network; when you close your account, your personal data in them is pseudonymised.
- Newsletters: until you withdraw consent.
9. Security#
We encrypt data in transit, limit access by role and log sensitive actions in a record that cannot be altered. If a breach affects your data, we notify the competent authority within the legal deadlines and tell you without undue delay where the law requires it.
10. Your rights#
You can ask to access your data, correct it, delete it, restrict or object to its use, receive it in a reusable format, and withdraw your consent at any time. You can also ask a person to review any automated decision. Write to privacy@regenera.earth; we may ask you to confirm your identity, and we reply within the legal deadline (one month in the UK).
If you are not satisfied, you can complain to the UK Information Commissioner's Office (ico.org.uk), to the data protection authority of the national Coordinator's country (in Peru, the National Personal Data Protection Authority), or to the authority where you live. Requests about a community's data are channelled through its authorities.
11. Children#
The Platform is not intended for anyone under 18. If minors appear in a field activity, we use their image only with permission from their parents or guardians and authorisation from the community.
12. Cookies#
See our Cookie Policy.
13. Changes#
If we change this Policy significantly, we tell you in advance and, where required, ask for your consent again. Previous versions remain available on the Platform.