Privacy Policy

This policy explains how Plant Ecology Beyond Land (PEBL) CIC ("PEBL", "we", "us") collects, uses and protects personal data. It covers our website, these docs, the fleet portal, the PEBL data cloud, and the way we handle email, calls and orders. FishSpotter has its own notice, explained below. We are the data controller.

Effective date: 8 October 2026

Who we are

Plant Ecology Beyond Land (PEBL) CIC is a community interest company limited by shares, registered in England and Wales with company number 12076622. Our registered office is 29 Glan Yr Afon Road, Sketty, Swansea, SA2 9JA.

We are registered with the UK Information Commissioner's Office (ICO) under registration reference ZB385831. For anything about your personal data, contact us at hello@pebl-cic.co.uk.

What we collect, and why

Our website, www.pebl-cic.co.uk

Visiting the site. Our host, Netlify, processes your IP address and browser details to deliver pages to you and to protect the site from attack. We rely on legitimate interests (running a secure website). Netlify processes this in the United States.

Forms. When you use a form on our website, such as the order form, an enquiry form or the newsletter sign-up, we collect what you enter. That can include your name, email address, phone number, organisation, delivery address, purchase order number and message. Netlify stores each submission for us and may record technical details with it, such as your IP address and browser. Each submission is also emailed to us (see Email, phone calls and orders below).

• Why: to handle your order, answer your enquiry, or send the newsletter you asked for.
• Lawful basis: contract, for orders, including the steps you ask us to take before we confirm one; legitimate interests, for enquiries; consent, for the newsletter.
• Processed by: Netlify, in the United States.

Website statistics. Once our new website is live, we measure how it is used so that we can improve it.

• Cloudflare Web Analytics shows us which pages people view, which websites refer them to us, their country and type of device, and how fast pages load. It does not use cookies and does not follow you across other websites.
• We also count page requests ourselves on Netlify, by page address and campaign tag, and count visits from automated crawlers. These counts hold no IP addresses or browser details.
• You can switch statistics off for your browser at www.pebl-cic.co.uk/privacy-choices. If your browser sends a Global Privacy Control signal, we treat it as a request to switch them off.
• Cloudflare and Netlify process this data only for us. The law allows this kind of measurement without asking first, as long as we explain it and give you a simple way to switch it off.
• Lawful basis: legitimate interests (understanding and improving our website).
• Processed by: Cloudflare and Netlify, in the United States.

Booking a call. If you book a call through our Calendly link, Calendly collects your name, email address, the time you choose and anything you add to the booking, and passes the booking to our calendar.

• Lawful basis: legitimate interests (arranging the call you asked for).
• Processed by: Calendly, in the United States.

Videos. Some pages show YouTube videos. The preview picture is loaded from YouTube, so YouTube can see your IP address and browser details when the page opens. The video itself loads only if you press play, and YouTube may then store information on your device. YouTube is part of Google, and Google's own privacy policy covers its use of this data.

These docs, docs.pebl-cic.co.uk

This site has no forms, sets no cookies and runs no analytics tools. Our host, Netlify, processes your IP address and browser details in the United States to deliver pages and protect the site, and we rely on legitimate interests (running a secure website). If you switch between light and dark mode, your browser remembers the choice on your device. It is not sent to us.

The fleet portal, peblapp.co.uk

The fleet portal is where customers see and manage their PEBL kit and its data.

• Data: your name, email address, username and organisation, and your password, which is stored in a form we cannot read. Records of which kit you hold, and data from that kit, including device settings, status and logs, sensor readings, deployment records (where and when kit was deployed) and the footage and images it captures. Footage can sometimes show people, boats or places that could identify someone.
• Why: to give you access to your kit and its data, to check that kit is working, to support you, and to improve our kit and service.
• Lawful basis: contract, for providing the portal to customers; legitimate interests, for device health checks, support, security and product improvement.
• AI log review: where we have switched it on, the portal can send short extracts of device logs, with any automatic fault findings, to Anthropic's AI service, which suggests what may have gone wrong. We rely on legitimate interests (finding and fixing faults).
• Processed by: Render, which hosts the portal and its database in Oregon, United States; Cloudflare R2, which stores footage, images, archived logs and backups and may process them outside the UK, including in the United States; and Anthropic, in the United States, for the AI log review.

The PEBL data cloud, pebl-data.cloud

The data cloud is our partner sign-in for storing, viewing and sharing monitoring data.

• Data: your name, email address and role; the projects, data files, notes and map locations you add or that are shared with you; and records of sign-ins and access.
• Why: to let you store, view and analyse data, and to share it with the people you choose.
• Lawful basis: contract, where you use it under an agreement with us; legitimate interests otherwise, for example for partners on joint projects.
• Processed by: Vercel, which hosts the app, with its server functions in the United States (near Washington DC); and Supabase, which provides the database, sign-in and file storage, held in Stockholm, Sweden.

FishSpotter

FishSpotter is our citizen science app. It has its own privacy notice at www.fishspotter.app/privacy, with a page for parents and carers at www.fishspotter.app/parent. That notice explains what FishSpotter collects and who processes it, so we do not repeat it here. The sections below on your rights and on complaints apply to FishSpotter too.

Email, phone calls and orders

• Data: your name and contact details, what you tell us, and records of quotes, orders, hires, invoices and payments.
• Why: to reply to you, to supply and support your kit, and to keep the business and tax records the law requires.
• Lawful basis: contract, for orders and hires; legitimate interests, for enquiries and support; legal obligation, for tax and accounting records.
• Processed by: Google, through Google Workspace, which provides our email, calendar and file storage. Google may process this data in the United States and other countries. Intuit, through QuickBooks, keeps our accounts and invoice records. Revolut, through Revolut Business, provides our business bank account and sends some of our invoices.

The PEBL App on your kit

The PEBL App runs on the kit itself over a local WiFi network, with no internet connection, and sends nothing to us. If your kit is set up to upload to the fleet portal, what it uploads is handled as described above.

Lawful bases

We rely on contract, legitimate interests, legal obligation and consent, as set out for each service above. Where we rely on legitimate interests, you have the right to object (see Your rights).

Cookies and similar technologies

• We use no advertising or tracking cookies on our new website, these docs, the fleet portal or the data cloud.
• The fleet portal and the data cloud use cookies and browser storage that are needed to sign you in and keep your session secure. Because they are essential, we do not ask for consent.
• Our new website's statistics use no cookies. If you switch statistics off, we store one small cookie, pebl_stats, to remember your choice for a year.
• These docs only remember your light or dark mode choice, in your browser.
• YouTube may store information on your device if you play a video (see Videos above).

Who we share it with

We do not sell your personal data. We share it only with the service providers below, who process it for us under contract and only on our instructions, and with:

• the courier that delivers your kit, which receives your name, delivery address and phone number;
• Revolut, our business account provider, which also uses the details of payments to and from us to meet its own legal duties, such as confirmation of payee checks, under its own privacy notice; and
• authorities such as HMRC, where the law requires it.

Provider	What it does for us	Where	Transfer safeguard
Netlify, Inc.	Hosts our website and these docs, handles website forms and counts page views	United States	UK Extension to the EU-US Data Privacy Framework
Cloudflare, Inc.	Website statistics; stores fleet portal footage, images, archived logs and backups (R2)	United States and other countries outside the UK	UK Extension to the EU-US Data Privacy Framework, backed by EU standard contractual clauses with the UK International Data Transfer Addendum in Cloudflare's data processing terms
Render Services, Inc.	Hosts the fleet portal and its database	Oregon, United States	UK Extension to the EU-US Data Privacy Framework
Anthropic, PBC	AI review of device logs in the fleet portal, where switched on	United States	EU standard contractual clauses with the UK International Data Transfer Addendum
Vercel Inc.	Hosts the PEBL data cloud	United States (server functions near Washington DC)	UK Extension to the EU-US Data Privacy Framework
Supabase, Inc.	Database, sign-in and file storage for the data cloud	Stockholm, Sweden	UK adequacy regulations for the EEA, plus EU standard contractual clauses with the UK International Data Transfer Addendum for any access from the US
Google (Google Workspace)	Email, calendar and file storage	United States and other countries	UK Extension to the EU-US Data Privacy Framework
Intuit (QuickBooks)	Accounting and invoicing	United States and other countries where Intuit or its service providers operate	UK Extension to the EU-US Data Privacy Framework, and EU standard contractual clauses with the UK International Data Transfer Addendum
Revolut (Revolut Business)	Business banking; sends some of our invoices	United Kingdom, with some processing outside the UK	A contract with data protection safeguards before any transfer to a country without UK-standard protection
Calendly, LLC	Booking calls	United States	UK Extension to the EU-US Data Privacy Framework

International transfers

Some of our providers process data outside the UK. We only transfer it with a safeguard that UK law recognises.

• The European Economic Area. UK adequacy regulations recognise the EEA as protecting personal data adequately.
• US companies certified under the UK Extension to the EU-US Data Privacy Framework. UK adequacy regulations, often called the UK-US data bridge, cover transfers to certified companies.
• Other providers. We use the EU standard contractual clauses with the UK International Data Transfer Addendum, which commit the provider to protecting your data in line with UK law.

If a provider's certification lapses, we will put another lawful safeguard in place and update this policy. Email us if you would like a copy of the safeguard for any provider.

How long we keep it

• Enquiries, including call bookings: up to 24 months.
• Account data for the fleet portal and the data cloud: while your account is active, and up to 12 months afterwards.
• Order, invoice and tax records: 6 years, as required by law.
• Fleet portal database backups: 30 days, on a rolling basis.
• Footage, images and sensor data in the fleet portal: for as long as your rental or service runs and 12 months after it ends, unless you ask us to delete it sooner or we agree otherwise in writing.
• Archived device logs in the fleet portal: 24 months.
• Data files and projects in the data cloud: while your account is open and 12 months after it closes.
• Website statistics: 13 months for our own counts. Cloudflare Web Analytics lets us see the previous six months of its figures.
• Newsletter sign-ups: until you unsubscribe.

Marketing

We send marketing emails only if you have signed up for them, and every one has an unsubscribe link. If we start using a mailing service to send them, we will add it to the list above first.

Your rights

You have the right to:

• get a copy of the personal data we hold about you;
• have it corrected if it is wrong;
• have it deleted;
• restrict how we use it;
• object to how we use it, including for direct marketing and website statistics;
• receive the data you gave us in a format you can reuse, or have it sent to another organisation;
• withdraw your consent at any time, where we rely on consent; and
• not be subject to decisions made solely by automated means that significantly affect you. We do not make decisions like that.

Some of these rights depend on the lawful basis we rely on, and some have exceptions. To use any of them, email hello@pebl-cic.co.uk. We reply within one month, or tell you within that month if a complex request needs longer. In most cases there is no charge.

Complaints

If you are unhappy with how we have handled your personal data, please tell us. The Data (Use and Access) Act 2025 gives you the right to complain to us directly.

1. Send your complaint by email to hello@pebl-cic.co.uk, by post to our registered office, or by phone on 07905 672766.
2. We acknowledge your complaint within 30 days of receiving it.
3. We look into it, keep you informed, and tell you the outcome without undue delay.

If you are not satisfied with our response, you can complain to the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this policy

We may update this policy from time to time. The version shown here is the current one, with the effective date above.

Questions?

Get in touch at hello@pebl-cic.co.uk.