Privacy Policy
My Food Forest B.V.
Last updated: October 1, 2026
1. Introduction
My Food Forest B.V. (“we,” “our,” or “us”) respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and protect your information when you use:
- our food forest mobile application (the “App”), and
- our website at www.myfoodforest.nl (the “Website”),
together the “Services”.
This policy complies with the General Data Protection Regulation (GDPR) and Dutch data protection laws, including the Uitvoeringswet Algemene verordening gegevensbescherming (UAVG).
2. Data Controller
My Food Forest B.V.
Domeinweg 11
7931 TJ Fluitenberg
The Netherlands
Email: hello@myfoodforest.nl
Chamber of Commerce number: 96517557
3. What Information We Collect
3.1 Information You Provide
In the App:
- Account registration details (name, email address, username)
- Profile information (the general location or region you enter yourself, gardening experience, preferences)
- Content you create (posts, photos, comments, plant and harvest records)
- Verification details, if we ask you to verify your identity or contact information (such as confirming your email address)
- Communication with us (support requests, feedback)
Photos can contain hidden metadata, such as the GPS location where they were taken (EXIF data). We automatically remove this location metadata from photos when you upload them.
On the Website:
- Newsletter subscription details (email address, optionally your first name, and the language of the Website you subscribe on: Dutch or English)
- Contact form submissions (first and last name, email address, optionally your phone number and the name of your food forest, the topics you tick, your message, and the language of the Website)
A message sent through the contact form is delivered as an email, sent through Microsoft’s Azure Communication Services, to our mailbox hello@myfoodforest.nl, with your email address as the reply-to address. The Website itself does not store your message.
3.2 Information Automatically Collected
- Device information (device type, operating system)
- Location data (only if you grant permission, to position your food forest and provide local weather information)
- Log data (IP address, access times, error logs) for operating and securing our Services
- Website statistics through Plausible Analytics, without cookies and without storing your IP address (see Section 11.1)
- Technical browser and connection data (such as IP address, TLS fingerprint and User-Agent) that Cloudflare Turnstile processes to protect our forms against bots (see Section 11.1)
In the App, we do not use advertising identifiers (such as the iOS IDFA or Android Advertising ID), device fingerprinting, or third-party behavioral tracking. On the Website, we do not use advertising or tracking cookies; the technical browser characteristics that Cloudflare Turnstile reads are used only to stop bots.
3.3 Information from Sign-In Providers
When you sign in to the App, authentication is handled by Microsoft Entra External ID. Depending on the sign-in method you choose (such as email or Sign in with Apple), we receive the basic details needed to create and secure your account, such as your email address.
3.4 Information from Third Parties
- Weather data from external services for your food forest’s location (we send the location, not your identity)
4. Purposes and Legal Basis for Processing
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Creating and managing your account, providing App functionality | Account details, profile, content | Contract (Art. 6(1)(b)) |
| Positioning your food forest and showing local weather | Location data | Consent (Art. 6(1)(a)) |
| Sending the newsletter | Email address, optional first name, language | Consent (Art. 6(1)(a)) |
| Responding to contact form submissions and support requests | Name, email, optional phone number and food forest name, topics, message, website language | Legitimate interest (Art. 6(1)(f)) |
| Protecting our forms against spam and abuse by bots (Cloudflare Turnstile) | IP address, technical browser and connection data | Legitimate interest (Art. 6(1)(f)) |
| Measuring use of the Website in aggregate statistics (Plausible Analytics) | Pages visited, referring website, browser, operating system, device type, country or region | Legitimate interest (Art. 6(1)(f)) |
| Securing our Services and preventing fraud or abuse | Log data, account details | Legitimate interest (Art. 6(1)(f)) |
| Improving our Services (error logs, diagnostics) | Log data | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | As required | Legal obligation (Art. 6(1)(c)) |
Where we rely on consent, you can withdraw it at any time (see Section 9.7).
5. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
6. Data Sharing and Disclosure
We may share your information with:
6.1 Service Providers (Processors)
Third-party companies that help us operate our Services:
- Microsoft Azure — cloud hosting and infrastructure for our Services, including the Website (Azure Static Web Apps)
- Microsoft Entra External ID — account sign-in and authentication
- Microsoft Azure Communication Services — delivering contact form messages from the Website by email
- Microsoft 365 — our email, including the mailbox hello@myfoodforest.nl where contact form messages arrive
- Mailchimp (The Rocket Science Group LLC, part of Intuit Inc.) — managing newsletter subscriptions (with double opt-in) and sending our newsletter
- Plausible Analytics (Plausible Insights OÜ, Estonia) — cookieless website statistics
- Cloudflare, Inc. (Turnstile) — bot check on the Website’s forms
We have data processing agreements in place with our processors as required by Article 28 GDPR.
Cloudflare processes the Turnstile signals as a processor on our behalf, and also uses them as an independent controller to improve Turnstile’s bot detection. See Cloudflare’s Turnstile Privacy Addendum.
We also share the location of your food forest (not your identity) with external weather data providers to retrieve local weather information (see Section 3.4).
6.2 Legal Requirements
We may disclose your information when required by law or to:
- Comply with legal processes or government requests
- Protect our rights, property, or safety
- Prevent fraud or security threats
- Enforce our Terms and Conditions
6.3 Business Transfers
In case of merger, acquisition, or sale of assets, your data may be transferred to the new entity.
We do not sell your personal data, and we do not share it with third parties for marketing purposes.
7. International Data Transfers
Our Services are hosted on Microsoft Azure in the European Union. The Website’s forms are processed in the Azure West Europe region, and Azure Communication Services processes the contact form emails with Europe as its data location. Plausible processes and stores the website statistics in the EU.
Where our service providers process limited data outside the European Economic Area (EEA) (for example, Microsoft for support or service operations, Mailchimp in the United States for our newsletter, or Cloudflare in the United States for the bot check on our forms), we ensure adequate protection through:
- Our providers’ compliance with GDPR and Standard Contractual Clauses
- Adequacy decisions by the European Commission (including the EU-US Data Privacy Framework, where applicable; Mailchimp and Cloudflare are certified under it)
- Other appropriate safeguards as required by law
8. Data Retention
We retain your personal data for as long as necessary to:
- Provide our services to you
- Comply with legal obligations
- Resolve disputes and enforce agreements
Specific retention periods:
- Account data: When you delete your account (which you can do in the App), your account and personal identifiers are deleted within 30 days. Contributions such as plant and harvest records may be retained in anonymized form, no longer linked to you.
- Usage and error logs: 12 months
- Support and contact communications (including contact form messages): 3 years
- Newsletter subscription: Until you unsubscribe. A sign-up that is not confirmed through the confirmation email is deleted by Mailchimp after 60 days
- Website statistics: Plausible stores no IP addresses, User-Agents or other persistent identifiers; the daily key is deleted after 24 hours. The aggregated statistics (such as page views per day) contain no personal data and are kept for as long as we use Plausible; they are deleted when we remove the Website from our Plausible account
- Bot check: We do not store the data of the Turnstile check ourselves
- Financial records (if applicable): 7 years (Dutch legal requirement)
If we terminate your account in accordance with our Terms and Conditions (for example, for violations or after prolonged inactivity), the same deletion periods apply from the date of termination.
9. Your Rights Under GDPR
You have the following rights regarding your personal data:
9.1 Access
Request access to your personal data and information about how we process it.
9.2 Rectification
Request correction of inaccurate or incomplete personal data.
9.3 Erasure
Request deletion of your personal data under certain circumstances. You can delete your account directly in the App via account settings.
9.4 Restriction
Request restriction of processing your personal data in specific situations.
9.5 Data Portability
Request transfer of your data to another service provider in a structured format.
9.6 Objection
Object to processing based on legitimate interests or for direct marketing.
9.7 Withdraw Consent
Withdraw consent at any time where processing is based on consent (for example, location access via your device settings, or the newsletter via the unsubscribe link).
To exercise these rights, contact us at hello@myfoodforest.nl. We will respond within one month of receiving your request. For complex or numerous requests, we may extend this period by up to two further months; if so, we will inform you within the first month.
10. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encryption of data in transit and at rest
- Access controls and authentication
- Regular security assessments
- Incident response procedures
While we strive to protect your data, no method of transmission or storage is 100% secure.
11. Cookies and Similar Technologies
This section describes our use of cookies and similar technologies on the Website and in the App, in accordance with the GDPR and Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet).
11.1 Website
Our Website does not set analytics, advertising or tracking cookies. Our own website code sets no cookies and stores nothing in your browser. We do not show a cookie consent banner, because we only use technologies that do not require consent (see below).
Website statistics (Plausible Analytics). We measure use of the Website with Plausible Analytics from Plausible Insights OÜ (Estonia). Plausible does not use cookies and stores nothing in your browser. To count visits without tracking you, Plausible calculates an anonymous code from your IP address and User-Agent, using a key that is replaced and deleted every 24 hours; your IP address and User-Agent themselves are not stored. We only see aggregate statistics, such as pages visited, referring websites, browser, operating system, device type, and country or region, and never data about individual visitors. Plausible processes and stores this data in the EU. See Plausible’s data policy for details.
Bot check (Cloudflare Turnstile). The newsletter form and the contact form are protected with Cloudflare Turnstile from Cloudflare, Inc. (United States), to prevent spam and abuse by automated programs (bots). Turnstile is loaded on the pages that contain one of these forms and runs a short check in your browser. For this, Cloudflare processes technical signals such as your IP address, your browser’s TLS fingerprint and User-Agent, and the results of tests on your browser’s characteristics and behavior; to do so, Turnstile reads data from your browser and may also store data in it. Turnstile does not read what you enter in the forms. After the check, your browser sends a one-time code (token) along with the form; our server has Cloudflare verify that code, together with your IP address. According to Cloudflare, these signals are strictly necessary to detect and block bots, and are not used to identify, profile or track individuals. We consider this check strictly necessary to secure our forms and do not ask for consent for it. See Cloudflare’s Turnstile Privacy Addendum for details.
Apart from Plausible and Cloudflare Turnstile, the Website loads no third-party scripts or content, such as external fonts, videos or social media buttons. Links to social media (such as Instagram, LinkedIn and Facebook) on the Website are plain links; no social media trackers are loaded on our pages.
11.2 App
The App stores authentication tokens and your settings on your device. These are strictly necessary for the App to function (keeping you signed in, remembering your preferences) and are not used to track you.
The App does not use:
- Advertising identifiers (iOS IDFA, Android Advertising ID)
- Third-party analytics or advertising SDKs
- Device fingerprinting
Legal basis: Strictly necessary storage is exempt from the consent requirement; for the underlying processing we rely on the performance of our contract with you and on our legitimate interest in providing a secure, functioning service.
11.3 Changes to Our Use of Cookies
If we introduce cookies or similar technologies that require consent in the future, we will update this policy and ask for your consent first, via a consent banner on the Website or an in-app prompt.
12. Children’s Privacy
Our Services are not intended for children under 16. We do not knowingly collect personal data from children under 16. If we become aware of such data collection, we will delete it promptly.
13. Marketing Communications
With your consent, we may send you marketing communications about our services, such as our newsletter. The newsletter uses double opt-in: after you subscribe, you receive an email with a confirmation link, and you only receive the newsletter after clicking it. Every newsletter contains an unsubscribe link. You can opt out at any time by:
- Using the unsubscribe link in emails
- Adjusting notification settings in the App
- Contacting us directly
14. Privacy Contact
We have not designated a formal Data Protection Officer, as this is not required for our organization. For all questions about data protection, you can contact us at:
Email: hello@myfoodforest.nl
Subject: Privacy
15. Supervisory Authority
You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag
The Netherlands
Website: autoriteitpersoonsgegevens.nl
If you live in another EU member state, you may also lodge a complaint with the data protection authority of your own country.
16. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes through:
- In-app notifications
- Email notifications
- Posting the updated policy on our Website
17. Contact Us
For questions about this privacy policy or our data practices, contact us:
My Food Forest B.V.
Email: hello@myfoodforest.nl
This privacy policy is available in Dutch.
Document Version: 1.2
Effective Date: October 1, 2026
