Privacy Policy

1. Who We Are

HarvestHawk AgriSystem Ltd, trading as “HarvestHawk” (“we”, “us”), is the controller of the personal data described in this notice. It explains what we collect when you engage our services or use our Farmers Portal, why, who we share it with, how long we keep it, and your rights.

We are registered with the Information Commissioner’s Office (ICO) under registration reference ZC197205.

To ask anything about your data, or to use any of your rights, email info@harvesthawk.co.uk.

2. What We Collect

• About you: your name, email address, phone number, your role at the farm (owner, manager, farm hand or adviser) and the farm or business you work for.
• About the land and the work: your fields, their boundaries and access points (including what3words addresses), crops, job requests and bookings, what was applied where and when, spray and flight records, site surveys, the crew who attended, and the maps, imagery and crop reports we make.
• Messages: what you send us through the portal, by email, text or phone, and what we send you.
• Money: invoices, quotes and what has been paid. We never see or store card details.
• Sign-in and security: when you signed in, the code or link used, the approximate location and device for a new sign-in (so we can warn you of one you did not make), and the essential cookies that keep you signed in.
• Your choices: which messages you want, and when you gave or withdrew consent for news and offers, with the wording you were shown.

3. Why We Use It, and Our Lawful Basis

UK data protection law asks us to say which lawful basis we rely on for each use. Ours are:

• Contract: to quote for, book, carry out and invoice the work you ask for; to run your portal account; to send the messages that go with a job (the booking, the day before, a change of date, a cancellation, a report or an invoice being ready).
• Legal obligation: to keep tax and accounting records (HMRC), the operational records our aviation authorisation requires (the Civil Aviation Authority), the records of plant protection products applied, and health and safety records.
• Legitimate interests: to keep the portal secure (sign-in records and alerts); to tell the other people at a client farm about the jobs they work alongside; to keep the record of what we did and were asked to do, in case a claim arises; and to improve our service using anonymised, aggregated figures. We have weighed these against your interests, and you can object to any of them (see Your Rights).
• Consent: news and offers, including reminders about quotes and renewals, only if you have ticked to receive them. You can withdraw consent at any time, from the link in every such message or in your portal settings.

4. Payment

Invoices are issued through our accounting system, Xero, and each one has a secure online invoice page. Card payments on that page are taken by Stripe, connected through Xero. HarvestHawk never sees, receives or stores your card details.

5. Who We Share It With

We use these providers to run our business. Each acts on our instructions, under a contract that requires it to protect your data, and sees only what it needs:

• Supabase: the database and file storage behind the portal, and portal sign-in.
• Vercel: hosts the portal, so every page you open passes through them.
• Resend: sends our emails.
• Twilio: sends our text messages.
• Xero: invoicing, and the online invoice page you pay on.
• Stripe: card payments on Xero’s online invoice page.
• Microsoft: our own email, calendars and office systems (Microsoft 365).
• what3words: suggests a what3words address as you type one; it is sent the words you type.
• Met Office: forecasts for a job; it is sent the location of a field, never whose field it is.
• Google: draws some maps of field locations; it is sent the location, never whose field it is.
• Pix4D and DJI: the software and aircraft our mapping imagery comes from. Imagery of your fields is processed with their tools; we do not send them your name or contact details.
• ElevenLabs: the narration in our own staff training. It is given training scripts only, never client data.

We also share data with legal, tax or regulatory authorities (such as HMRC or the Civil Aviation Authority) where the law requires it, and with our professional advisers (accountant, insurer, solicitor) where needed. We do not sell your data, and we never share identifiable client or farm data for anybody else’s marketing.

6. Data Outside the UK

Some of these providers store or reach data in the European Economic Area or the United States. Where personal data leaves the UK we make sure it is protected to the UK standard: by UK adequacy regulations (for the EEA, Switzerland, and US companies certified under the UK Extension to the EU-US Data Privacy Framework), or by the ICO’s International Data Transfer Agreement or Addendum to the EU standard contractual clauses. Ask us and we will tell you which applies to a provider.

7. How Long We Keep It

We keep data only as long as we need it, and deletion runs automatically every day, so records leave when they are due to rather than when someone remembers:

• Jobs, invoices, quotes you accepted, compliance and flight records, spray records, reports and their figures and preview pictures: nine years from the date of each record. HMRC requires six years of accounts, the Civil Aviation Authority three years of operational records and the law three years of plant protection records, and a claim about work can be brought for six years after it; nine years covers all of them on one clock, so a job and the evidence behind it go together.
• Messages with us: nine years, with the job they belong to. Your instructions to us (which field, which product, when not to come) are part of the record of the work, and we may need them for the same six-year claim period and for our tax and aviation records.
• Interactive maps: the map tiles are kept for the year of the visit (or of your season package) and two more growing seasons, then removed. The report, its figures and its preview pictures stay for the nine years above, and the original imagery is kept on our own company storage, so a map can be rebuilt if you ever need it.
• Sign-in and security records: two years. Texted sign-in codes and request counters: 24 hours.
• Quotes never accepted, and enquiries from people who never became clients: 24 months from the last time we heard from you. After that your name and contact details are removed; we may keep an anonymous note of the region, acreage and service asked about.
• The marketing list: 24 months from your last activity, unless you unsubscribe sooner. A record that you unsubscribed is kept indefinitely: it is the minimum we need (your email address or mobile number) to make sure you are never contacted again by mistake.

If nobody at your farm signs in, and we do no work for you and send you no invoice or message, for 24 months, we pause your portal sign-in. We email you 30 days before. Nothing is deleted: sign in, or ask for a sign-in code, and it switches straight back on, or ask us to. If it stays paused for a further 36 months, with no work and nothing owed, we close the account, after a person here has checked. Nine years after closing, we replace your name and contact details with a reference and delete your sign-in, keeping only the records the law requires for what is left of their time.

8. How We Contact You, and Your Choices

We contact you in two distinct ways, and they are governed separately.

Service messages are part of delivering work you have booked: confirming a job, the day before it, telling you a date has moved or a job is cancelled, and letting you know a report or an invoice is ready or a payment has landed. These come by email, and by text where you have chosen texts. You can turn either off in your portal settings, or with the link at the foot of every email.

News and offers, including reminders about quotes and renewals, only ever go to people who have ticked to receive them, a box we never pre-tick. They have no bearing on the service you receive, and every one carries a link to stop them.

Text messages come from the sender ID “HarvestHawk” and cannot be replied to, which every message says. To reach us, reply to any of our emails, use the portal, or ring the office on 07957 302263.

9. Anonymised Data

HarvestHawk may use operational and field data in an anonymised and aggregated form (field performance, mapping outputs and application data) to improve our service and understand trends. It may contribute to our “Hawk Greener Growing” initiative, which works on sustainability and efficiency in farming. Nothing that identifies you or your farm is shared without your explicit consent.

10. Keeping It Safe

Access to client data is limited to the staff whose role needs it, staff sign in with a second step, sign-in is by a code sent to you rather than a password, and every important change is recorded in a sealed audit trail.

A document you download from the portal (an invoice, a report, a record) leaves our protected systems once it is on your device, so please keep those copies safe.

11. Your Rights

You have the right to:

• be told how we use your data (this notice);
• a copy of the personal data we hold about you (subject access);
• have inaccurate data corrected, and incomplete data completed;
• have your data deleted, where we no longer need it or have no lawful reason to keep it (records the law requires us to keep stay until their time is up);
• ask us to restrict how we use your data while a question about it is settled;
• object to our use of your data on the basis of legitimate interests, and object at any time, absolutely, to direct marketing;
• receive data you gave us in a common, machine-readable form, or have it sent to another organisation (portability);
• withdraw consent you have given, at any time, without affecting what we did before;
• not be subject to a decision made solely by automated means that has a legal or similarly significant effect on you. We make no such decisions.

To use any of these, email info@harvesthawk.co.uk. It is free, and we will answer within one month (we will tell you if a complex request needs longer, up to two further months). We may need to confirm who you are first.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

12. Changes to This Notice

We update this notice when what we do with your data changes. When we do, the portal shows you the new version the next time you sign in, and you confirm you have read it.