Processing of personal data

1Controller

The controller within the meaning of Article 4(7) GDPR is Ishan Mahatara, trading as geodatafix (“we”), established outside the European Union. All requests concerning this notice or your personal data: hello@geodatafix.com.

2Categories and sources of data

Business contact data

Name, job title, employer and business email address. Source: publicly accessible business information, in particular the website of the company you work for (Article 14(2)(f) GDPR).

Enquiry data

The email address, company name and message you enter in the contact form. Source: you.

Correspondence data

The content, date and time of emails exchanged with us.

We do not process special categories of personal data (Article 9 GDPR). This website sets no cookies and uses no analytics, profiling or tracking technology.

3Purposes and legal bases

• Business-to-business communication about services relevant to your professional role: Article 6(1)(f) GDPR (legitimate interests, see section 4).
• Responding to enquiries and steps taken at your request before a contract is concluded: Article 6(1)(b) GDPR.
• Performance of a contract with you or your organisation: Article 6(1)(b) GDPR.
• Compliance with legal obligations: Article 6(1)(c) GDPR.
• Establishment, exercise or defence of legal claims: Article 6(1)(f) GDPR.

You are under no statutory or contractual obligation to provide personal data. Without an email address, we cannot answer an enquiry. No automated decision-making or profiling within the meaning of Article 22 GDPR takes place.

4Legitimate interests

Our legitimate interest is to offer a business service to the companies it concerns: operators and traders placing timber and other commodities on the EU market, who must provide plot geolocation data under Regulation (EU) 2023/1115. Recital 47 GDPR recognises processing for direct marketing purposes as capable of serving a legitimate interest.

We have balanced this interest against your rights. The data processed is limited to business contact details that your employer has made public for business contact. The communication concerns your professional role only, is limited in number, and ends on request. You can reasonably expect such contact in that role. We therefore consider that your interests do not override ours.

5Recipients

Personal data is disclosed only to the following processors, bound by data processing terms under Article 28 GDPR and acting solely on our instructions:

• Google (Google Workspace), for email;
• Netlify, Inc., United States, for hosting this website and receiving contact form submissions.

Beyond these, we disclose personal data only where a law requires it, or where it is necessary to establish, exercise or defend a legal claim. We do not sell personal data.

6Place of processing

We are established outside the European Union and collect your data directly. This is not a transfer within the meaning of Chapter V GDPR (EDPB Guidelines 05/2021); our processing is subject to the GDPR under Article 3(2). Your data is processed outside the European Union, by us and by the processors named in section 5. We apply the protection required by the GDPR to all processing, wherever it takes place.

7Retention

• Business contact data of persons who do not respond: erased 6 months after our last message.
• Contact form submissions: erased from the form service within 30 days of receipt. The resulting correspondence is retained as stated below.
• Correspondence and contract data: retained for the duration of the business relationship, and afterwards only for as long as statutory retention obligations or limitation periods require.
• Objections: if you object to further contact, your email address is retained on a suppression list for the sole purpose of honouring your objection permanently.

8Rights of the data subject

Under the conditions set out in the GDPR, you have the right to:

• obtain confirmation of whether we process your data, and a copy of it (access, Article 15);
• have inaccurate data corrected (rectification, Article 16);
• have your data erased (Article 17);
• have its use restricted (Article 18);
• receive data you provided in a portable format (Article 20);
• object to processing based on Article 6(1)(f) on grounds relating to your particular situation, and object at any time to direct marketing (Article 21).

Send requests to hello@geodatafix.com. We answer within one month of receipt (Article 12(3) GDPR). To protect your data, we verify the identity of the person making a request before disclosing anything.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).

9Scope and amendments

This notice covers the personal data of our business contacts and enquirers. Personal data contained in files that clients submit for conversion is governed exclusively by the data processing agreement concluded with the client before any file is sent.

We amend this notice when our processing or the law changes. Material changes are published here with a new effective date before they take effect.