Skip to content
PlotDR
Get started

Privacy Policy

Last updated 2026-10-29

Our two commitments

Your data (account data such as organization and user details; customer data such as supplier records, plot geometries, checks and reports; and marketing-site visitor data) is stored on Swiss-hosted infrastructure (Infomaniak). Billing is the exception: we pass your billing name and email (which may duplicate your account details) to our payment processor, Stripe, and Stripe separately collects your billing address and tax ID directly. We run no external tracking or third-party analytics: no ad networks, no third-party scripts, no third-party font or asset CDNs, anywhere on this site or in the PlotDR product.

1. Who we are

Help Comptabilité & Immobilier Sàrl, Chemin du vallon 18, 3960 Sierre, Valais, Switzerland, is the controller for the account, billing, error-report, access-log, application-log, support-correspondence and marketing-site visitor data described below. For customer data we act as processor for your organization, under our Data Processing Agreement. See our Legal Notice for registration details.

2. What we collect

Account data (for which we are the controller): your organization and user account details, such as user email addresses, roles, and sign-in records. This is personal data under the GDPR and the Swiss Federal Act on Data Protection (FADP). Account data also includes a log of the actions our staff take on your organization’s account through our administration tools: deactivating or reactivating a user, signing a user out of all sessions, resending an invitation, and manually setting or removing your organization’s plan. Each entry records the action, when it was taken, the IDs of the staff member, your organization and the user concerned, and, for a plan change, the plan before and after. It never records an email address.

Customer data (processed on behalf of your organization, as our customer): the supplier records, plot geometries, checks and reports your organization submits or generates for EUDR screening. Your organization is the controller of this data and we are its processor, under our Data Processing Agreement, which describes it in detail.

Billing data: for paid subscriptions, we pass your billing name and email to our payment processor, Stripe, and Stripe collects your billing address and tax ID directly at checkout; see sections 7 and 8 below.

Error-report data (for which we are the controller; any customer data in a report we process only as your organization’s processor, see section 4): when the PlotDR dashboard or the PlotDR service hits an unexpected error, a technical error report goes to our self-hosted error tracker, on our own infrastructure at Infomaniak in Switzerland. A dashboard report holds the error message, the stack trace, the page path without its query parameters, the paths and status codes of the pages and API requests just before the error, and the browser and app version. A service report holds the error message, the stack trace, the technical log lines leading up to the error, the method and path of the request being handled, without its query, a few technical request headers (such as the accepted language, the requesting site and a request ID, never cookies or credentials), and the name of the server and the software versions involved; a report of a failed satellite-dataset lookup holds only the dataset’s name and the type of error. Reports are designed to exclude personal content such as names, email addresses, passwords, form contents and request bodies, but the error text and the identifiers in a report can still occasionally refer to your organization’s records (for example an organization, user or record ID, or plot coordinates quoted in an error message). The error tracker also records a shortened (truncated) IP address of the browser that sent a dashboard report. We keep error reports for up to about 30 days, after which they are deleted automatically.

Marketing-site visitor data serves a separate, distinct purpose from the above. If you use our contact form, we collect the name, email address, and message you submit, to respond to your inquiry and prevent spam abuse of the form.

Access-log data (for which we are the controller; any customer data in a log entry we process only as your organization’s processor, see section 4): we record every request to the plotdr.ch website, the PlotDR dashboard and the PlotDR API in technical access logs (see section 5), with its IP address, its time, the address requested (including any query), the response status and, for the website and the dashboard, the browser’s user-agent string and the referring page. An address requested can include the ID of one of your organization’s records or a search term you entered. We also use the IP address, for at most one hour, to limit how often sign-up, sign-in, password-reset, invitation, email-verification and contact-form requests can be made, to protect them against abuse.

Application log data (for which we are the controller; any customer data in a log entry we process only as your organization’s processor, see section 4): our API and background services write technical application logs. A log line records what happened, when, and the identifiers of the records the action concerned, such as your organization ID, your user ID, and the ID of a check, plot, batch or report, plus a request ID. For emails we log only the recipient’s domain, never the address. We do not log message bodies, request bodies or passwords, and we filter out the access tokens and API keys we recognise. The text of an error can occasionally quote a record’s content (for example plot coordinates), and error-level lines, together with the log lines leading up to them, are also sent to our error-reporting service described above.

Support and data-protection correspondence (for which we are the controller; any customer data in a support message we process only as your organization’s processor, see section 4): when you email us with a support or data-protection request (see section 7) or send a problem report from the PlotDR dashboard or through the PlotDR API, we receive your email address and, where you give it, your name, your message, and any attachments you send. A problem report also carries the category you chose, the page you were on, the details of the error you were looking at, if any, the ID of the check or plot it concerns, your organization and user IDs, your plan, whether you were signed in with a session or an API key, and the user-agent string of your browser or API client. A support message can contain customer data, such as supplier records, plot locations or check results, if you write it in or it is part of the error details; the ID of a check or plot on its own is not treated as customer data.

3. Cookies and local storage

We use three strictly necessary technologies to run the site and product. None is used for tracking, advertising, or analytics, so none requires consent-banner opt-in under the ePrivacy Directive’s exemption for technologies “strictly necessary” to provide a service you request, but we describe them here for transparency:

We process account data under contract performance with your organization. We keep the log of our staff’s actions on your account (section 2) under our legitimate interest in securing the service, holding our staff accountable for what they do in customer accounts, and answering questions or claims about those actions. We process customer data only as your organization’s processor, on its instructions, under our Data Processing Agreement. We process contact-form data under our legitimate interest in responding to inquiries and preventing abuse of the form. Where a contact-form message becomes part of a quote or contract, we process it to take steps before the contract and to perform it, and we keep it afterwards under our legal obligation under Swiss law to retain business records (Art. 958f of the Swiss Code of Obligations) and our legitimate interest in establishing, exercising or defending legal claims. We process error-report data under our legitimate interest in keeping the service reliable, by finding and fixing errors. Where an error report contains customer data, we process it only as your organization’s processor, under our Data Processing Agreement. We keep technical access logs, and use IP addresses for rate limiting, under our legitimate interest in operating and securing the site and the service. We keep technical application logs under our legitimate interest in operating, securing and troubleshooting the service. Where an application log entry or an access-log entry contains customer data, we process it only as your organization’s processor, under our Data Processing Agreement. We process support and data-protection correspondence, including in-product problem reports, under our legitimate interest in answering your requests and, for data-protection requests, our legal obligation to handle them; we keep it afterwards under our legitimate interest in being able to show how we handled it. Where a support message contains customer data, we process it only as your organization’s processor, under our Data Processing Agreement. We process billing data under contract performance (to charge you for your subscription) and our legal obligation under Swiss law to retain invoicing records (Art. 958f of the Swiss Code of Obligations). The GDPR accepts a legal obligation as a legal basis only when EU or EU member-state law lays it down (GDPR Article 6(3)). Where the GDPR applies, we therefore keep business and invoicing records under our legitimate interest in complying with these Swiss obligations. We keep encrypted backups of our databases (section 5), which include account data, under our legitimate interest in being able to restore the service after a failure or data loss and in keeping it secure and available (GDPR Article 32). Customer data in backups we process only as your organization’s processor, under our Data Processing Agreement.

5. Retention

Customer data: we keep it as your organization’s processor, on its instructions, under our Data Processing Agreement (section 9) and the Terms of Service (section 11). Active supplier and plot records are kept while they are in use. Unless your organization has data erased sooner (section 6), we keep it to support the due-diligence record-keeping the EU Deforestation Regulation requires of your organization (Art. 9(1)). Each check is kept for six years from the screening it records, which allows up to one year between screening and placing on the market or export. Each supplier and plot record is kept for five years from its archiving (including when the organization is deleted), or longer while a check on it is still kept; archiving a supplier archives its plots with it. Every record is therefore kept for at least five years from its screening or archiving. Reports go with the checks they cover: a report for a single check is purged with that check, and a report for a batch of checks once every check in it has been purged. If your organization needs a record for longer, for example because a product is placed on the market or exported later, it should export the record before its retention period ends.

We purge customer data in the first periodic retention review after its retention period ends, and we run that review at least every six months. This is a policy commitment we operationalize via a periodic internal review process, not an instantaneous automatic deletion the moment a retention period elapses.

Account data: kept while your organization’s account exists (except the staff action log, below). When the organization is deleted, user accounts are anonymized rather than deleted, so that the record of who ran a given due-diligence check survives (see the Terms of Service, section 11).

Staff action log: each entry is kept for three years from the action, then deleted automatically, including after your organization is deleted. Entries hold IDs, not email addresses: once a user account is anonymized, its entries no longer show who the user was.

Contact-form messages: kept for up to 12 months, and deleted at the next review, which happens at least every six months. If your message becomes part of a data-protection request you made, we keep it as described under “Support and data-protection correspondence” below; if it becomes part of a quote or contract with you or your organization, we instead keep it until the quote is declined or expires (on its validity date or, if it has none, six months after we last heard from you); if the quote is accepted, it becomes a contract, and we keep the message for as long as the contract runs and afterwards until the end of the tenth year after the year in which the contract ends, or longer while a dispute or an authority’s inquiry about it is still open, then delete it at the first review after that; we run that review at least every six months.

Support and data-protection correspondence, including in-product problem reports, which reach our support mailbox as emails: kept while we handle your request and for 3 years after the last message about it, to show how we handled it, or longer while a dispute or an authority’s inquiry about it is still open, then deleted at the first review after that period ends; we run that review at least every six months. A support message from your organization that contains customer data (such as supplier records, plot locations or check results) is kept only as long as needed to resolve the request, as our Data Processing Agreement (section 4.2) provides.

Backups: every night we take an encrypted backup of our databases, for disaster recovery only. It includes account data (name, email address, organization and password hash) and customer data as they stood when it was taken. We keep the newest backup of each of the last 30 days and the earliest of each of the last 12 months, so data you delete, or ask us to erase, stays in the backups for up to about 12 months while the service runs, and then rolls off. Backups are not erased individually and are used only to restore the service after a failure, data loss or operating error, and to test automatically, every week, that they can be restored. If a backup is ever restored, we first re-apply the deletions and erasures recorded since it was taken. They are stored with Infomaniak in Switzerland.

Access logs: our web servers and API record each request, with its IP address, in technical access logs used for security and troubleshooting. These logs are not archived: each server keeps only its most recent entries, up to a fixed size, and the logs are deleted entirely whenever the service is updated. How long an entry survives therefore depends on traffic and on how often we update the service, typically days to a few weeks.

Application logs: kept under the same criteria as the access logs: not archived, held only up to a fixed size per server, and deleted entirely whenever the service is updated, typically days to a few weeks. Error-level lines, and the lines leading up to them, that reach our error-reporting service follow the 30-day period above.

Error-report data: kept for up to about 30 days, then deleted automatically.

Billing data: retained by Stripe per its own policies, and by us for the 10-year period Swiss law requires for accounting records (Art. 958f of the Swiss Code of Obligations).

6. Your rights and erasure on request

You (or, for customer data, your organization on your behalf) may request deletion of your data at any time under GDPR Article 17. We support both a partial erasure (respecting any records you may still be legally required to retain, e.g. under EUDR’s own 5-year window) and a full, immediate erasure at your own informed risk of losing records EUDR may require you to keep. Error reports, access logs and application logs (section 2) are the exception: they are not erased on request or when an account or organization is deleted. Because they are kept only briefly and are not organized by account, we do not erase them individually; error reports are deleted automatically about 30 days after they are received, and access-log and application-log entries as described in section 5. Backups (section 5) are a further exception: erased data stays in them until they roll off, about 12 months at most while the service runs, and is erased again on any restore. Support and data-protection correspondence that we keep to show how we handled a request (section 5) is erased on request only if you object to that retention and your objection succeeds (see Right to object below). The log of our staff’s actions on accounts (section 5) is not erased on request or when an account or organization is deleted; each entry is deleted automatically three years after the action, or sooner if you object to that retention and your objection succeeds (see Right to object below). Quote, contract and invoicing records that we must keep under a legal retention duty, or need to establish, exercise or defend legal claims, are not erased on request while that duty or claim period runs; we delete them once it ends (section 5). Contact us at contact@plotdr.ch to make a request. If your data was submitted by one of our customers, for example as a supplier contact, that customer is the controller: we forward your request to it and do not act on it ourselves.

You also have the right to access, rectify, or port your data, and to lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your local data protection authority.

Right to object. Where we process your data under our legitimate interest (contact-form data, error reports, technical access logs and rate limiting, technical application logs, support correspondence, keeping the log of our staff’s actions on accounts, keeping data-protection correspondence after we have handled it, keeping encrypted backups, and keeping business and invoicing records to comply with Swiss law, see section 4), you may object at any time, on grounds relating to your particular situation, under GDPR Article 21. We will then stop that processing unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. A quote, contract or invoicing record that we must keep under a legal retention duty, or need to establish, exercise or defend legal claims, is kept despite an objection while that duty or claim period runs. Backups are not changed individually: data covered by a successful objection stays in them until they roll off (section 5), is not used, and is erased again if a backup is ever restored. To object, contact us at contact@plotdr.ch.

7. Processors we use

We use the following service providers as processors of the data for which we are the controller:

8. International transfers

Switzerland holds an EU adequacy decision, so account data, customer data, error-report data, access-log data, application-log data, support-correspondence data and marketing-site visitor data may move between the EU and Switzerland without additional transfer safeguards under GDPR Article 45.

Billing data is the exception: Stripe processes it (name, email, billing address, and tax ID) in the US and Ireland. Per Stripe’s own published data processing terms, these transfers are covered by Standard Contractual Clauses and, where Stripe maintains it, EU–U.S. Data Privacy Framework certification.

9. Contact

Questions about this policy: contact@plotdr.ch.