The data we hold, and the rights you keep.
This policy explains what personal data Spatial Sustainability Hub collects through this website, why we collect it, how long we keep it, who we share it with, and the rights you can exercise over it. We sell data-protection tooling — so we hold this site to the same bar.
Last updated: September 2026
The data controller for this website.
SpatialSustainabilityHub LTD (“we”, “us”) is the data controller for the personal data described in this policy. We work globally, starting from Africa. Ghana's Data Protection Act, 2012 (Act 843) is our primary framework; where the GDPR or another data-protection law applies to you, we meet that too. For any privacy question, or to exercise a right below, email privacy@spatialsusty.com or use our contact form.
Data protection contact: Jedidiah Tetteh Madjanor, Data Protection Lead — privacy@spatialsusty.com.
- Registered addressHouse Number H404/12, Itomatoes Street
Near Daras School, Teshie, Ledzokuku
Greater Accra, Ghana
Digital address GZ-029-3324 · P.O. Box TNE 3, Teshie - RegistrationCS156200726 (Ghana Office of the Registrar of Companies)
This policy covers this marketing website only. Each tool — Commodity, MyDataCompliance, Verdex, AgriTrace, and Carbon (dMRV, in beta) — carries its own data terms, and a verification engagement is governed by its engagement letter and a Data Processing Agreement; ask us and we'll share the document that applies to you.
Almost nothing — and only what a purpose requires.
We do not sell personal data, we run no advertising trackers, and we build no cross-site profiles. The full list of what this website collects:
- Contact form Your name, email address, optional organisation, area of interest, and your message. You choose what to put in the message field — please don't include sensitive personal data there.
- Abuse prevention When you submit the form we record your IP address and a short request ID, used to enforce rate limits and trace abuse.
- Sensitive data Please don't send us sensitive personal data — about health, beliefs, finances, or similar — unless we have specifically asked for it and explained why. If it arrives anyway, we review and delete it.
- Analytics This site currently runs no analytics or advertising trackers.
- Page tallies (first-party) Our own server keeps a running count of views per page per day, plus the bare domain of any referring site. These are totals only — we store no IP address, no browser fingerprint, and no row describing an individual visit, so nothing here identifies you.
- Reviews If you submit a review: your name, email, optional role and organisation, your rating and the review text, plus your IP and a request ID for abuse prevention. We publish the name, role, organisation, rating and text — never your email — and only after you tick the consent box and a human approves it. Reviews we do not publish are deleted automatically after 90 days. Email support@spatialsusty.com to have a published review taken down at any time.
- Essential cookies Only what a secure form needs: a CSRF-protection token, and a session cookie for signed-in staff. No advertising or tracking cookies — see section 7.
Each purpose has a lawful basis.
Where the EU/UK GDPR (or an equivalent regime such as Ghana's Data Protection Act, 2012) applies, we rely on the following bases under Article 6:
- Replying to you To answer your enquiry and discuss a pilot, partnership, or API access. Basis: our legitimate interest in responding to people who contact us (Art. 6(1)(f)); or steps taken at your request prior to a contract (Art. 6(1)(b)).
- Security & abuse prevention To keep the site available and resist spam and abuse. Basis: our legitimate interest in protecting the service (Art. 6(1)(f)).
- First-party page tallies To see which pages people actually read and whether traffic is growing. Basis: legitimate interest (Art. 6(1)(f)). Only totals are stored, no personal data is processed, and no cookie is set — so there is nothing about you to access, correct, or erase.
Where we rely on legitimate interests, we've weighed them against your rights and freedoms and use the minimum data necessary. You can object to that processing at any time — see section 6.
A short, named list — not “partners”.
We don't sell or rent personal data. We share it only with the service providers needed to run this website, each acting as our processor under contract:
- Hosting Containerised infrastructure with a PostgreSQL database and Redis cache, served over HTTPS only. Contact-form submissions are stored here.
- Email delivery When you contact us, your message is emailed to our team so we can reply. If we use a transactional email provider, it processes that message on our behalf.
- Web fonts Served from our own domain. Your browser makes no request to a font provider, so no third party sees your IP address for the page's typefaces.
We may also disclose data where legally required, or to establish, exercise, or defend legal claims. For our current subprocessor list, ask us — we'll share it.
When data crosses a border.
We work globally, starting from Africa, and some providers above may process data outside your country. Where personal data is transferred internationally, we rely on an appropriate safeguard — such as the European Commission's Standard Contractual Clauses, or a transfer to a country with an adequacy decision. Ask us for the specifics that apply to your data and we'll walk you through them.
Held briefly; yours to control.
- Contact submissions The copy held by this website is deleted automatically after 90 days. The email copy we reply from is kept for up to 24 months after our last exchange, in line with our retention schedule, then deleted — sooner on request once your enquiry is resolved. We never add you to a marketing list without asking.
- Abuse-prevention data IP address and request ID are removed with the submission. Security logs are kept for up to 12 months and application logs for 30–90 days, with access restricted, so we can investigate abuse or an incident.
- Your rights Subject to applicable law, you can request access to your data, correction, deletion, a portable copy, restriction of processing, and you can object to processing based on legitimate interests. We don't use your data for automated decision-making or profiling.
- How to exercise them Email privacy@spatialsusty.com or use the contact form. We aim to respond within 30 days and won't charge you for a reasonable request. To object to our first-party visit counting you don't need to write at all — there is a switch on the cookies page.
- Complaints If we haven't resolved a concern, you can complain to your data-protection authority — in Ghana, the Data Protection Commission; in the EU or UK, your national supervisory authority; elsewhere, the authority where you live, such as Kenya's Office of the Data Protection Commissioner or the Nigeria Data Protection Commission.
Only the essential ones.
We set only cookies that are strictly necessary for the site to work: a CSRF token that protects form submissions, and a session cookie for signed-in staff. These require no consent because they're essential and not used for tracking. The full table — every cookie, its purpose and lifetime, plus the opt-out switch for visit counting — is on our Cookie Policy page. We set no advertising, analytics, or third-party tracking cookies.
The practical details.
- Security HTTPS/HSTS everywhere, a strict Content-Security-Policy, MFA-gated and rate-limited admin access, input sanitisation, and dependency scanning. The full posture is on our Security & Privacy page.
- Children This is a business-to-business site not directed at children, and we don't knowingly collect data from anyone under 16.
- Changes If we update this policy we'll revise the “Last updated” date above; material changes will be made prominent.