The data we hold, and the rights you keep.
This policy explains what personal data Spatial Sustainability Hub collects through this website, why we collect it, how long we keep it, who we share it with, and the rights you can exercise over it. We sell data-protection tooling — so we hold this site to the same bar.
Last updated: July 2026
The data controller for this website.
Spatial Sustainability Hub (“we”, “us”) is the data controller for the personal data described in this policy. We operate across Ghana · Côte d'Ivoire · Indonesia · EU. For any privacy question, or to exercise a right below, email hello@spatialsusty.com or use our contact form.
This policy covers this marketing website only. Each product — Commodity, MyDataCompliance, and Verdex — carries its own data terms and, where relevant, a Data Processing Agreement; ask us and we'll share the document that applies to your engagement.
Almost nothing — and only what a purpose requires.
We do not sell personal data, we run no advertising trackers, and we build no cross-site profiles. The full list of what this website collects:
- Contact form Your name, email address, optional organisation, area of interest, and your message. You choose what to put in the message field — please don't include sensitive personal data there.
- Abuse prevention When you submit the form we record your IP address and a short request ID, used to enforce rate limits and trace abuse.
- Analytics This site currently runs no analytics or advertising trackers.
- Page tallies (first-party) Our own server keeps a running count of views per page per day, plus the bare domain of any referring site. These are totals only — we store no IP address, no browser fingerprint, and no row describing an individual visit, so nothing here identifies you.
- Reviews If you submit a review: your name, email, optional role and organisation, your rating and the review text, plus your IP and a request ID for abuse prevention. We publish the name, role, organisation, rating and text — never your email — and only after you tick the consent box and a human approves it. Email support@spatialsusty.com to have your review taken down at any time.
- Essential cookies Only what a secure form needs: a CSRF-protection token, and a session cookie for signed-in staff. No advertising or tracking cookies — see section 7.
Each purpose has a lawful basis.
Where the EU/UK GDPR (or an equivalent regime such as Ghana's Data Protection Act, 2012) applies, we rely on the following bases under Article 6:
- Replying to you To answer your enquiry and discuss a pilot, partnership, or API access. Basis: our legitimate interest in responding to people who contact us (Art. 6(1)(f)); or steps taken at your request prior to a contract (Art. 6(1)(b)).
- Security & abuse prevention To keep the site available and resist spam and abuse. Basis: our legitimate interest in protecting the service (Art. 6(1)(f)).
- First-party page tallies To see which pages people actually read and whether traffic is growing. Basis: legitimate interest (Art. 6(1)(f)). Only totals are stored, no personal data is processed, and no cookie is set — so there is nothing about you to access, correct, or erase.
Where we rely on legitimate interests, we've weighed them against your rights and freedoms and use the minimum data necessary. You can object to that processing at any time — see section 6.
A short, named list — not “partners”.
We don't sell or rent personal data. We share it only with the service providers needed to run this website, each acting as our processor under contract:
- Hosting Containerised infrastructure with a PostgreSQL database and Redis cache, served over HTTPS only. Contact-form submissions are stored here.
- Email delivery When you contact us, your message is emailed to our team so we can reply. If we use a transactional email provider, it processes that message on our behalf.
- Web fonts Google Fonts serves typefaces; your browser requests them directly, which exposes your IP address to Google for that request.
We may also disclose data where legally required, or to establish, exercise, or defend legal claims. For our current subprocessor list, ask us — we'll share it.
When data crosses a border.
We operate across Ghana · Côte d'Ivoire · Indonesia · EU, and some providers above may process data outside your country. Where personal data is transferred internationally, we rely on an appropriate safeguard — such as the European Commission's Standard Contractual Clauses, or a transfer to a country with an adequacy decision. Ask us for the specifics that apply to your data and we'll walk you through them.
Held briefly; yours to control.
- Contact submissions Automatically deleted after 90 days, and sooner on request once your enquiry is resolved.
- Abuse-prevention data IP address and request ID are kept only as long as needed to enforce rate limits and investigate abuse, then removed with the submission.
- Your rights Subject to applicable law, you can request access to your data, correction, deletion, a portable copy, restriction of processing, and you can object to processing based on legitimate interests. We don't use your data for automated decision-making or profiling.
- How to exercise them Email hello@spatialsusty.com or use the contact form. We aim to respond within one month and won't charge you for a reasonable request.
- Complaints If we haven't resolved a concern, you can complain to your local data-protection authority — for Ghana, the Data Protection Commission; in the EU/UK, your national supervisory authority.
Only the essential ones.
We set only cookies that are strictly necessary for the site to work: a CSRF token that protects form submissions, and a session cookie for signed-in staff. These require no consent banner because they're essential and not used for tracking. We set no advertising, analytics, or third-party tracking cookies.
The practical details.
- Security HTTPS/HSTS everywhere, a strict Content-Security-Policy, MFA-gated and rate-limited admin access, input sanitisation, and dependency scanning. The full posture is on our Security & Privacy page.
- Children This is a business-to-business site not directed at children, and we don't knowingly collect data from anyone under 16.
- Changes If we update this policy we'll revise the “Last updated” date above; material changes will be made prominent.