Privacy policy
What data TracaTerre processes, why, for how long, and how to exercise your rights.
Version of 8 October 2026 · This English translation is provided for information; only the French version is legally binding.
Who we are
TracaTerre is compliance software for Regulation (EU) 2023/1115 on deforestation, published by BIONATURA, established in Lomé (Togo). For any question about your data:
…
Applicable law
- Togolese Law No. 2019-014 of 29 October 2019 on the protection of personal data, BIONATURA being established in Togo.
- Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), for data of clients and persons located in the European Union.
Two different roles
- For data our clients record in TracaTerre (producers, plots, lots, statements), the client is the controller: data subjects contact the client. BIONATURA processes this data on its behalf, as a processor, under the data processing agreement concluded with it.
- For user accounts, platform security, access requests and invoicing, BIONATURA is the controller.
What we process, why and for how long
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Your name, e-mail, role, password hash | Signing you in, managing your rights | Contract | Term of your organisation's contract |
| Two-factor authentication: encrypted secret, hashes of backup codes | Protecting your account | Contract; security (legitimate interest) | While enabled; used or revoked codes: term of the contract |
| Your sign-in attempts (e-mail entered, IP address, date) | Blocking password guessing | Security (legitimate interest) | 12 months |
| Your actions in the software (audit log) | Proving who did what, as compliance requires | Client's compliance obligation; legitimate interest | As long as the data concerned (at least 5 years) |
| Acceptance of the terms of use (version, date, author) | Proving the client's agreement | Contract | Term of the contract, then the limitation period |
| Your access request (organisation, country, name, e-mail, phone, products, message, IP address, date, version of the terms accepted) | Reviewing the request, opening the workspace, limiting abuse | Pre-contractual steps | Accepted: term of the contract; refused: 12 months |
| Your organisation's showcase, if it chooses to appear in the registry | Making your organisation known to other members and the public | Organisation's choice (contract) | As long as the organisation chooses |
| Producer and plot data entered by our clients (name, village, phone, plot location and area, declared legality, certifications, deliveries) | Traceability and due diligence | On behalf of the client (processing) | At least 5 years after placing on the market or export |
| Plots shared by a producer, lot files transferred to a buyer (never producers' names in those files) | Proving the origin of products; only the two organisations see them | On behalf of the client (processing) | At least 5 years after placing on the market or export |
| Field app records (location, photos), before they are sent | Working offline | On behalf of the client (processing) | On the agent's device, until sent |
| Files submitted by a data partner, indicators shared with an authority or association (aggregated and anonymous) | Completing the evidence file; sector statistics | On behalf of the client (processing) | At least 5 years for evidence; while sharing is granted |
| Relations, offers, purchase requests and messages between organisations | Starting the business relationship; only the two parties see them | Contract | Term of your organisation's contract |
| Billing details, subscription, invoices and payments | Invoicing the service, keeping accounts | Contract; legal obligation | Legal retention period for accounting records |
| Your help requests to the office | Answering you | Contract | Term of your organisation's contract |
| E-mails we send you (address, subject, delivery status) | Opening your access, resetting your password, sending answers and invoices; never a password by e-mail | Contract | 12 months |
We sell no data, run no advertising and do no audience measurement. No decision with legal effects is taken by the machine: automatic checks give indications that people verify.
Who receives the data
- Authorised users of the client organisation, and the organisations it chooses to share with.
- The European Commission (TRACES information system), when the client submits a statement: plot geolocation, and producers' names only if the client so chooses.
- Competent authorities of the Member States, through the evidence file the client gives them.
- Our hosts and service providers (see the legal notice). When you display a map, your browser loads base maps from Esri and OpenStreetMap and the European Commission's forest layer.
- The BIONATURA office, for support, operation and invoicing of the service.
Where the data is
The database is hosted in Frankfurt (Germany) and files in the European Union; the application runs through Cloudflare's global network. Some providers are established in the United States: transfers are covered by the safeguards provided by the GDPR (standard contractual clauses, EU–US Data Privacy Framework).
BIONATURA, established in Togo, accesses the data to provide the service: these transfers outside the Union are covered by the standard contractual clauses of the data processing agreement concluded with each client. Transfers from Togo to our hosts take place under the conditions of Law No. 2019-014.
Security
Encrypted exchanges (HTTPS), protected passwords (Argon2) and limited attempts, two-factor authentication, strict separation between clients checked automatically, encrypted TRACES access keys, document fingerprints, a log of all actions, software libraries checked every week, encrypted backups with tested restoration, database in the European Union.
Your rights
You may request access to your data, its rectification or erasure, the restriction of processing, object to it, or request data portability. Erasure may be limited by the five-year retention obligation of Regulation (EU) 2023/1115. We reply within one month.
For data entered by a client organisation (producers, plots), contact that organisation; we will help it answer you. For your user account, write to the address at the top of this page.
You may lodge a complaint with the competent supervisory authority: in Togo, the Instance de protection des données à caractère personnel (IPDCP); in the European Union, the authority of your Member State.
For cooperatives and exporters: informing producers
Notice template to hand out (and to read, in their language, to those who do not read):
“Your cooperative [name] records your name, village, phone number, the location and area of your plots, and the quantities you deliver. It needs them to prove to European buyers that your production does not come from land deforested after 2020 (European deforestation regulation). This information is kept for at least 5 years in the TracaTerre software (BIONATURA). The location of your plots may be sent to the European Commission; your name is sent only if the cooperative decides so. To see or correct your information, contact [cooperative contact].”
Updates
This policy may change with the service; each version is dated. TracaTerre is intended for professionals and not for children.