Privacy
Privacy notice
This site sets no cookies, shows no advertising and loads nothing from third parties. It stores personal data only when you subscribe to the newsletter, choose to save an assessment result, or send a vendor claim or correction. A shared result link stores scores only.
Controller
SUSTAINABLE AGROFORESTRY PRECISION SOLUTIONS S.L.
CIF B75719369
Carrer de Tort 10, Bajos 3, 08014 Barcelona, España
Email: hello@ctee.org
Hosting
The site, the newsletter system, the statistics and the assessment database all run on one virtual server operated by the controller at Akamai Connected Cloud (Linode) in Frankfurt am Main, Germany.
Server logs
The web server records each request: IP address, time, URL, user agent and referrer. The logs are used to operate and secure the site and are deleted after 14 days. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
Audience measurement
Page views are counted with a self-hosted Plausible Analytics instance on our own server in the EU. It uses no cookies, no cross-site tracking and no persistent identifier. It counts page views, the referrer, the browser and screen-size category, the country, and clicks on site features such as the newsletter form and the assessment. The figures are not shared with anyone. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
Cookies and third parties
The site sets no cookies. There are no advertising cookies, no third-party trackers and no embedded third-party fonts or scripts; the fonts are served from this server.
Newsletter
The "Exposure Brief" newsletter runs on a self-hosted Listmonk instance at news.ctee.org, on the same server. It stores your email address, your name if you give one (if you leave it blank, the part of your email address before the @ is used as a display name), your subscription status and the related timestamps. Subscription is by double opt-in: you are added only after you confirm by email. Every email contains an unsubscribe link.
Emails are delivered through Postmark (ActiveCampaign, LLC, USA), which acts as a processor. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time.
Self-assessment
The maturity self-assessment runs entirely in your browser. Nothing is sent to the server unless you choose "Save my result". If you do, your email address, your name if you give one, your scores and your individual answers are stored in a database on the same server. This lets you compare results later and lets us publish anonymised, aggregated benchmarks: aggregates only, never individual results. Your IP address and user agent are not stored with a saved result. Subscribing to the newsletter is a separate choice that is not ticked by default. Legal basis: your consent, Art. 6(1)(a) GDPR.
The shareable results link contains your individual answers in the URL. It is created only in your browser. Anyone who receives the link can see those answers.
The quick check keeps its five answers in your browser's session storage (this tab only, cleared when the tab closes) so the full assessment can start from them. They are not sent to the server unless you choose "Share result" (see below). This is not a cookie and is not used for tracking.
Shared result links
If you choose "Share result" on the quick check or the assessment, your answers are sent to the server once so the score can be calculated there; they are not stored. We store the score, maturity level and stage scores of that result, a day-level creation date and an expiry date, under a random link token (only its hash is kept). We do not store your answers, name, email address, IP address or browser details with it. The record is deleted automatically 90 days after it is created. Anyone with the link can see the score, level and stage scores until then. Legal basis: your consent, Art. 6(1)(a) GDPR.
Vendor claims and corrections
A vendor can send a claim or correction about its entry with the form on the corrections page. We store the name, work email address, claim text and source link you send, the time of receipt and our decision, to review the claim and reply. Your IP address and user agent are not stored with it. Claims are reviewed by the controller and are not published automatically; internal notifications carry only the vendor name. Legal basis: legitimate interest in keeping the vendor information accurate, Art. 6(1)(f) GDPR. Retention: deleted automatically 24 months after the decision, or 24 months after receipt if no decision was made.
Optional follow-up emails
When you save an assessment result you can tick a separate box (not ticked by default) to receive three short follow-up emails about your result, on day 0, day 3 and day 7. If you tick it, your email address, your name if you give one, your overall score, level and stage scores, the time of your consent and the time each email was sent are stored in the Listmonk instance described above, on a private list that is separate from the newsletter. The emails are written in English and are delivered through Postmark. Each email contains an unsubscribe link. Legal basis: your consent, Art. 6(1)(a) GDPR; you can withdraw it at any time. Retention: you are removed from the list, and this data is deleted, when you unsubscribe, or 30 days after the third email, whichever is earlier.
Email sent to @ctee.org addresses is forwarded by Porkbun LLC (USA) to a mailbox at Google (Gmail).
Recipients and transfers outside the EU
Personal data goes only to the providers named here: Akamai (hosting), Postmark (newsletter delivery), Porkbun and Google (email). Postmark, Porkbun and Google are in the United States. Transfers to the US rely on the EU-US Data Privacy Framework or on standard contractual clauses. Data is not sold.
Retention
- Newsletter data: until you unsubscribe.
- Follow-up emails: until you unsubscribe, or 30 days after the third email.
- Saved assessments: until you ask for deletion, or 24 months after the last save, whichever is earlier.
- Shared result links: 90 days after creation.
- Vendor claims: 24 months after the decision, or 24 months after receipt if undecided.
- Server logs: 14 days.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and you can withdraw consent at any time. Write to hello@ctee.org; requests are answered within one month.
Complaints
You can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), www.aepd.es, or to the data protection authority where you live.
Automated decisions and children
There is no automated decision-making and no profiling. The site is not directed at children.