Legal
Privacy Policy
1. Who we are
Ecological Intelligence Ltd (“EcoIntel”, “we”, “us”, “our”) is a company registered in England and Wales.
- Company number: 16866497
- Registered office: Brimbles, Ashburton, Newton Abbot, England, TQ13 7HU
- VAT number: GB506945280
- ICO registration: ZC144577
- Website: https://www.ecointel.io
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller for the personal data we collect through this website and the EcoIntel platform.
This Privacy Policy describes how we use personal data as a controller. As a business customer, the personal data we hold about you and your authorised users (such as account, contact and correspondence details) is data for which we are the controller, and this policy applies to it. Where the data you provide includes personal data about other individuals (for example named landowners, farmers or land managers), we act as your processor, and that processing is governed by our Data Processing Addendum rather than this policy.
EU/EEA users
Because we offer the Service to businesses in the EU/EEA and process the personal data of individuals located there (including data our business customers submit about named landowners, farmers and land managers), the EU GDPR applies to that processing under Article 3(2). Where it applies, the equivalent rights described in section 8 apply, and references below to the UK GDPR and the ICO should be read as also referring to the EU GDPR and to your local supervisory authority (see sections 8 and 9).
Data protection contact
We do not currently have a formally appointed Data Protection Officer (the criteria in Article 37 are not met). Day-to-day responsibility for data-protection matters sits with Mark Drewell, Founder, CEO & Chairman, who is the named contact for any privacy enquiry, subject-access request or complaint.
For data-protection enquiries, email .
EU representative
As we are established in the UK with no establishment in the EU/EEA, we are required under Article 27 of the EU GDPR to appoint a representative in the EU/EEA to act as a point of contact for EU/EEA data subjects and supervisory authorities on matters relating to our processing of personal data. We have appointed Data Protection Representative Limited (trading as DataRep), a company registered in the Republic of Ireland (registration no. 616588), 77 Camden Street Lower, Dublin, D02 XE80, Ireland, as our representative.
If you are in the EU/EEA, you can raise a question or exercise your data-protection rights via DataRep by:
- emailing DataRep at datarequest@datarep.com, quoting “EcoIntel” in the subject line;
- using DataRep’s online webform at www.datarep.com/data-request; or
- writing to DataRep at any of their contact locations across the 27 EU countries, Norway and Iceland (the full address list is available via the webform page above, or from us on request). Please address postal correspondence to “DataRep”, not to EcoIntel, or it may not reach them.
Please use these routes for data-protection matters only; for questions about EcoIntel’s services, contact us directly using the email above.
Important notice: alpha release
EcoIntel is currently in alpha development. The platform, website, and all associated services are under active development and testing. Access is provided exclusively to participants in our Founding Members programme, who acknowledge that the system is in an early stage of development, may contain bugs, and has not yet been fully calibrated. All information, data, and outputs provided through EcoIntel at this stage are subject to the Terms of Service and Disclaimer.
2. What information we collect
Information you provide directly
- Contact form submissions: name, email address, organisation (if provided), and the content of your message.
- Email correspondence: any personal data you include when contacting us.
- Account sign-up: when you create an account on the EcoIntel platform, we collect your name, email address, and the property data you upload or enter (including parcel geometry, intake-form responses, and any optional Rural Payments Agency identifiers you choose to share).
- Disclosure evidence: files and notes you upload or enter to support your nature and sustainability disclosures (for example photographs, management records or certificates). These are held in a private, access-controlled store (see sections 5 and 7) and are used only to produce and evidence your disclosures.
Information collected automatically
- Aggregate analytics: we use Cloudflare Web Analytics, which is cookieless and privacy-first. It reports anonymous, aggregate information (such as pages visited and the sites people arrive from) and does not use cookies or identify you individually.
- Cookies: the site sets only strictly necessary cookies. See our Cookie Policy for full details.
3. When you create an account: acknowledgements and consents
When you create an EcoIntel account, the platform records the basis on which we process your data against the following items. Some are necessary to provide the Service you are buying; others are genuinely optional and can be changed later in account settings.
Necessary to provide the Service (contract)
- EcoIntel ReportBuilder Pipeline Access. Processing of your property’s data (parcel geometry, satellite imagery, intake-form responses) to produce the analytics reports you have purchased. This is necessary to perform our contract with you (Article 6(1)(b)); without it we cannot produce reports for your property, so it is a requirement of using the paid Service rather than an optional consent.
- Terms of Service and Privacy Policy. Acceptance of the Terms of Service and acknowledgement that you have read this Privacy Policy.
Optional (consent)
- Marketing Emails. Opt-in to receive occasional product updates, new feature announcements, and newsletters from EcoIntel. This consent is separate from transactional emails (account confirmations, report-ready notifications, billing receipts), which are sent regardless. You can withdraw this consent at any time via the Account Settings page or via the unsubscribe link in any marketing email.
- RPA Data Sharing. Consent for the UK Rural Payments Agency to share your farm-business data (including Single Business Identifier (SBI), parcel boundaries, and rural-payment scheme participation history) with EcoIntel for the purposes of land-health analytics, baseline assessment and report generation. This is optional; withdrawal does not affect analyses or reports already produced.
The following three permissions are managed on your Profile page and can be changed at any time. Each is recorded as a dated, versioned consent record.
- EcoIntel support access. Consent for our support team to open your account and property data to help you when you ask us to. This is off by default; every access is logged, and you can switch it off again at any time. Lawful basis: consent (Article 6(1)(a)). Withdrawing it stops future support access and does not affect anything done while it was enabled.
- Help improve the platform. Consent for us to use data derived from your account in anonymised form to improve the Service, including after you close your account. Anonymisation is irreversible and does not identify you, your business or your land (see section 7). Lawful basis: consent (Article 6(1)(a)) for the processing that produces the anonymised data; once anonymised, the data is no longer personal data and falls outside data-protection law. Withdrawing this permission stops us using your data for improvement and creating new anonymised copies; anonymised data already produced cannot be re-identified or withdrawn.
- AI assistance for disclosure. Consent for EcoIntel’s AI service (Anthropic’s Claude API) to help draft and structure the evidence you enter for nature and sustainability disclosures. You always attest the final wording yourself, and AI-generated text is never treated as evidence. The AI provider does not use your data to train its models and retains it only briefly for abuse-monitoring before deletion (see section 5 and the Data Processing Addendum). Lawful basis: consent (Article 6(1)(a)).
We retain the record (item, version, timestamp, IP address at the time) for as long as the account is active and for two years after closure, so that we can demonstrate the lawful basis for processing.
4. How we use your information
| Purpose | Lawful basis (UK GDPR / EU GDPR) |
|---|---|
| Responding to your enquiries | Legitimate interest. Art. 6(1)(f) |
| Operating your EcoIntel account and producing the reports you’ve purchased | Contract. Art. 6(1)(b) |
| Improving the platform using anonymised data, where you enable it | Consent. Art. 6(1)(a) for the processing that anonymises the data; anonymised output falls outside scope |
| Aggregate website analytics (cookieless) | Legitimate interest. Art. 6(1)(f) |
| Marketing communications | Consent. Art. 6(1)(a), via the in-app opt-in |
| RPA data integration | Consent. Art. 6(1)(a), via the in-app opt-in |
| EcoIntel support-team access to your account, where you enable it | Consent. Art. 6(1)(a), via the Profile toggle |
| AI assistance for drafting disclosure evidence, where you enable it | Consent. Art. 6(1)(a), via the Profile toggle |
| Complying with legal obligations | Legal obligation. Art. 6(1)(c) |
5. Who we share your data with
We do not sell your personal data. We share data only with the categories of recipient listed here.
- Hosting, database and satellite processing. Google Cloud Platform (including Firestore and Earth Engine), with the primary database in the UK.
- Disclosure-evidence storage. The evidence files you upload for disclosures are held in a private Google Cloud Platform storage bucket located in the EU, reachable only through short-lived, owner-scoped links (see section 7).
- AI report generation and disclosure assistance. Anthropic (the Claude API), which generates land-health reports from the data you provide and, where you enable “AI assistance for disclosure”, helps draft and structure your disclosure evidence. Anthropic does not use your data to train its models and retains it only briefly (currently up to around 30 days) for abuse-monitoring before deletion.
- Encrypted backups. Backblaze.
- Payment processing. Stripe, when you subscribe to a paid plan. EcoIntel does not store your card details directly.
- Authentication, email and business operations. Microsoft Azure (sign-in), Google Workspace, and FreeAgent (accounting).
- Transactional email. Resend, for sending service emails such as account confirmations, report-ready notifications and billing receipts.
- Website delivery and analytics. Cloudflare (CDN, security, and cookieless analytics).
- Development and marketing partner. Vu Digital.
- Professional advisers (lawyers, accountants, auditors) and law enforcement or regulators, only where necessary or required by law.
Every sub-processor is bound by a data-processing agreement and handles your data in accordance with the applicable data-protection law. The full, current list of our sub-processors, with their locations and the transfer safeguard that applies to each, is published on our Trust page and in Annex 3 of our Data Processing Addendum.
6. International transfers
Where data is transferred outside the UK or EEA (for example, to providers based in the US), we put in place an appropriate safeguard for the direction of transfer:
- For transfers from the UK: the UK International Data Transfer Agreement (IDTA); the EU Standard Contractual Clauses with the UK Addendum; the UK-US data bridge (for providers certified under the UK Extension to the EU-US Data Privacy Framework); or UK adequacy where the destination is covered (for example, the EEA).
- For transfers of EU/EEA-origin data: the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), or the EU-US Data Privacy Framework where the provider is certified.
The transfer safeguard that applies to each sub-processor is listed on our Trust page and in Annex 3 of the DPA.
7. How long we keep your data
| Data type | Retention period |
|---|---|
| Active account data (property, parcels, reports) | For the life of the subscription |
| Disclosure evidence (uploaded files) | For the life of the subscription; deleted when the property or account is deleted |
| Account data after closure | 2 years, then deleted or anonymised |
| Anonymised improvement data (if you enable “Help improve the platform”) | Retained indefinitely in anonymised form only; contains no personal data |
| Contact form submissions | 2 years from last contact |
| Email correspondence | 3 years from last contact |
| Analytics (Cloudflare Web Analytics) | Aggregate and anonymous only; no personal data retained |
| Consent records | Life of the account + 2 years |
| Billing records | 6 years (UK HMRC requirement) |
Where we use the Anthropic Claude API to generate your reports, the data sent to that service is retained by the provider only for a short period (currently up to around 30 days) for abuse-monitoring and then deleted; it is not used to train or improve the provider’s models. See Annex 3 of the DPA for the transfer safeguard that applies. The same applies where you enable AI assistance for disclosure.
Anonymisation and platform improvement. If you enable “Help improve the platform”, we may retain data derived from your account in anonymised form to improve the Service, including after your account closes. Anonymisation is irreversible: identifiers (your name and contact details, business identifiers such as SBI, and precise parcel boundaries and location) are removed or aggregated so that the result cannot be linked back to you, your business or your specific land. Anonymised data is no longer personal data and is outside the scope of this policy. If you disable this permission, we stop using your data for improvement and do not create new anonymised copies; anonymised data already produced cannot be re-identified or withdrawn.
Disclosure evidence. Files you upload as disclosure evidence are stored in a private, EU-located Google Cloud Platform storage bucket and are reachable only by you (and, where you have enabled support access, our support team) through short-lived, owner-scoped links. They are deleted when you delete the property or close your account, subject to the retention periods above.
8. Your rights
Under the UK GDPR (and, where it applies, the EU GDPR), you have the right to:
- Access your personal data (subject access request)
- Rectify inaccurate data
- Erase your data (“right to be forgotten”), subject to legal retention requirements
- Restrict processing
- Data portability. Receive your data in a structured, commonly used format
- Object to processing based on legitimate interests
- Withdraw consent at any time (where processing is based on consent)
To exercise any of these rights, email . We will respond within one month of your request. There is no fee for making a request, unless it is manifestly unfounded or excessive.
9. Complaints
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with a supervisory authority.
- UK residents may complain to the Information Commissioner’s Office (ICO): https://ico.org.uk; helpline 0303 123 1113. EcoIntel ICO registration: ZC144577.
- EU/EEA residents may complain to the supervisory authority in their country of residence, place of work, or where the alleged infringement took place. A list is available at edpb.europa.eu.
We would ask you to contact us first so that we can try to resolve the issue.
10. Changes to this policy
We may update this policy from time to time. Any changes will be posted on this page with an updated “Last updated” date at the top. Please review periodically.
11. Contact us
Ecological Intelligence Ltd Brimbles, Ashburton, Newton Abbot, England, TQ13 7HU Company No. 16866497 · VAT GB506945280 · ICO ZC144577 Email: