Privacy Policy

1. Controller

The controller for personal data processed through TOSK Global Digital Agro Hub is TOSK GLOBAL VENTURES LIMITED, company number 664094, of BASE Enterprise Centre, Damastown Road, Mulhuddart, Dublin 15, D15 EPP4, Ireland. Our privacy contact is legal@toskglobal.com. We have not appointed a statutory Data Protection Officer; privacy enquiries and rights requests are handled through that address.

2. Data we collect

• Account data: email address, password (stored hashed by our authentication provider), and, where you use Google sign-in, the basic profile released by Google.
• Profile data: full name, country, phone number, preferred language, avatar, onboarding status.
• Organisation data: legal and trading names, organisation type, country, region, address, website, contact email and phone, tax and registration numbers, verification documents and verification status.
• Farm and listing data: farm details and location, commodity, quantity, pricing, certifications, and uploaded images or video.
• Order data: orders, order items, destination country and address, notes, status history and attached documents.
• Operational records: notifications, notification preferences, role requests, and audit logs of changes to profiles, organisations, farms, listings, orders and role grants (sensitive fields such as phone, email, tax number, registration number and addresses are recorded as “changed” only, not with their values).
• AI interaction data: prompts, responses, selected work context, consent choices and media you deliberately submit for preliminary visual screening. Audio used for browser-supported dictation is not intentionally retained as an audio recording by the Platform.
• Newsletter data: your email address, optional name, selected topics and regions, confirmation and consent records, delivery results, and unsubscribe or suppression status. Authorised marketing staff use these records to send the updates you requested.
• Technical data: data necessarily processed to deliver the service, such as request metadata and error diagnostics.

3. Why we use it and legal bases

• Contract: to create and operate your account, publish listings, process orders and provide support.
• Legitimate interests: to keep the Platform secure, prevent fraud and abuse, maintain audit trails, and improve reliability.
• Legal obligation: to comply with applicable law, including trade, tax and record-keeping requirements.
• Consent: where you opt in to specific notification categories, which you can change at any time in notification settings. Newsletter subscriptions require email confirmation. You can change newsletter interests or unsubscribe through the link in any newsletter.

4. What other users can see

Marketplace listings and approved non-sensitive business information may be visible to anyone browsing the Platform. Personal names, direct contact details, tax and registration numbers, detailed addresses and order documents are not public. Protected business contact details are available only to authorised signed-in users with the required active membership or transaction relationship, members of the relevant organisation with the appropriate role, and authorised platform personnel. These restrictions are enforced by row-level security in the database, not only in the user interface.

5. Processors and hosting

We use Supabase (including services managed through Lovable Cloud) for authentication, database and file storage; Lovable for application hosting and deployment; Resend for transactional email and requested newsletters; Google where you choose Google sign-in; and the configured AI service provider when you use Agro AI. Each provider processes only the information needed to provide its service and may use infrastructure in the European Economic Area, the United Kingdom or other countries. Where personal data is transferred outside the EEA, we rely on an adequacy decision, approved Standard Contractual Clauses or another lawful transfer safeguard, as applicable. An up-to-date provider and transfer summary is available on request from legal@toskglobal.com.

6. Retention

We apply the following standard periods unless law, an active investigation, a dispute or a valid preservation request requires longer retention: account, profile, organisation and marketplace records are kept while the account is active and for up to six years after closure or the last relevant transaction; order, verification, laboratory, logistics and transaction records are kept for up to six years after the end of the relevant relationship or financial year; security, access and privileged audit records are kept for up to seven years; support communications and routine notification records are kept for up to two years; and incomplete or rejected verification applications with no continuing relationship are normally deleted or anonymised after 12 months. Provider backups are overwritten according to the applicable provider’s protected backup cycle and are not used for ordinary business access. Data is deleted or anonymised when the applicable period expires unless it must be retained for a lawful reason.

Newsletter subscription, delivery and opt-out records are retained to manage your choices and prevent unwanted messages. Unsubscribing stops future newsletters; it does not close your AgroHub account. You can request deletion using the privacy contact above.

7. Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, to data portability, and to withdraw consent. You can edit much of your profile and organisation data directly in the Platform. For other requests contact legal@toskglobal.com. For account or Platform assistance, contact support@toskglobal.com. You may also complain to the Irish Data Protection Commission or your local supervisory authority.

8. Security

Access is protected by authenticated sessions, role-based permissions and row-level security policies. Listing media and order attachments are stored in private buckets accessible only through short-lived signed links to authorised participants. Uploads are restricted by file type and size. Administrative and role changes are audit-logged. No system can be guaranteed completely secure; we encourage you to use a strong, unique password.

9. Cookies and local storage

We use essential browser storage to keep you signed in and remember security and language preferences. With your permission, we may use Google Analytics cookies to measure visits, navigation and important actions so we can improve the Platform. The analytics tag does not load until you accept analytics cookies, and we do not enable advertising personalisation. You may reject optional cookies without losing access to the Platform.

10. Children

The Platform is intended for business use and is not directed at children.

11. Changes and contact

We will post updates to this policy here and, where changes are material, notify you through the Platform. See also our Terms of Service. Privacy and legal contact: legal@toskglobal.com. General contact: contact@toskglobal.com.