Privacy Policy

Crown Fields B.V., Weena 690, 3012 CN Rotterdam, The Netherlands. KvK 98450182. Contact: info@crownfields.nl. We are the data controller for the personal data described below.

Depending on how you interact with us, we process:

• Identification & contact data — name, job title, business email, business phone, company, country.
• Account data — login email, hashed password, language and notification preferences, audit-log records of significant actions.
• Commercial data — orders, quotes, invoices, payment status, delivery addresses, claims.
• Communications — emails, WhatsApp messages and call notes you exchange with us.
• Technical data — IP address, device, browser, pages viewed, timestamps, security logs.

• Performing our contract with your company — quotes, orders, deliveries, invoicing, support (Art. 6(1)(b) GDPR).
• Complying with legal obligations — tax, food-safety traceability under Regulation (EC) 178/2002, accounting retention (Art. 6(1)(c)).
• Our legitimate interests — securing the portal, preventing fraud, improving our service, direct B2B communication with existing customers (Art. 6(1)(f)).
• Consent — optional analytics cookies and marketing communications you can opt in/out of (Art. 6(1)(a)).

We share personal data only with parties that need it to deliver our service:

• Hosting & infrastructure: Supabase (EU region), Cloudflare.
• Accounting & invoicing: our accounting platform.
• Payments: Stripe Payments Europe Ltd. (when prepayment is required).
• Email & messaging: Mailgun, Meta (WhatsApp Business).
• Logistics partners strictly for the delivery of your orders.
• Public authorities where legally required.

All sub-processors are bound by GDPR-compliant data-processing agreements.

Data is stored within the EU/EEA wherever possible. Where a sub-processor processes data outside the EEA (e.g. Meta), the transfer is covered by the European Commission's Standard Contractual Clauses (2021/914) and supplementary technical measures.

• Account data: while your account is active, plus 12 months after closure.
• Commercial records (invoices, orders): 7 years (Dutch tax law).
• Traceability data on produce lots: 5 years.
• Marketing consent records: 3 years from last interaction.
• Security and audit logs: 12 months.

You have the right to: access, rectify, erase, restrict or object to processing, and to data portability. You may also withdraw consent at any time. To exercise these rights, email info@crownfields.nl with proof of identity. We respond within 30 days.

Authenticated portal users can export or request deletion of their data directly from Account → Privacy in the buyer portal. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

We use strictly necessary cookies (session, CSRF, language) and — with your consent — analytics cookies to understand portal usage.

Meta pixel. On our public website we use the Meta (Facebook/Instagram) pixel, provided by Meta Platforms Ireland Ltd., to measure which of our Facebook and Instagram ads lead to visits and to enquiries (quote requests, trial-truck requests and grower applications). The pixel sends Meta technical data such as your IP address, browser, the pages you view, ad-click identifiers and the fact that a form was sent. It does not send the contents of the forms (your name, email or phone). Meta may use this data to measure and improve the delivery of our ads. The pixel never runs inside our customer, grower or staff portals.

Visitors in the EU/EEA, the UK and Switzerland — or whose location we cannot determine — are asked first, and the pixel only runs after they choose "Accept all" (Art. 6(1)(a) GDPR). Elsewhere it runs by default. Everyone can switch it off at any time via Cookie settings in the website footer by choosing "Essential only"; the change applies immediately. We keep your choice, its date and the version of the notice you saw in your browser as the record of your consent. See also Meta's privacy policy at facebook.com/privacy/policy.

We apply industry-standard measures: TLS in transit, encryption at rest, role-based access control, row-level security in the database, audit logs on admin actions, and regular backup verification.

We may update this policy. Material changes will be notified in the portal at least 14 days before they take effect.