BETA — THIS IS A PROTOTYPE. SOME OF THE INFORMATION MAY BE INCORRECT.
Source LoopBETAOpen Origin Passport

Privacy

Privacy policy

Last updated: 1 May 2026

Source Loop is operated by Forrest Strategy, registered at Voorburgstraat 234, 3037 BS Rotterdam, Netherlands (KVK 24489395). This policy explains what personal data we process, why, and your rights under the EU General Data Protection Regulation (GDPR).

What we collect

Website visitors. We collect anonymised analytics on page visits, referral sources, and device type. We do not use third-party advertising trackers.

Buyers and partners. When you contact us via email, WhatsApp, or web form, we collect your name, contact details, and the content of your enquiry to respond and maintain a commercial relationship.

Producers and cooperative partners. We process plot polygons, producer names, harvest records, and supporting documents as part of operating the Source Loop passport. This data is processed under contract with the cooperative and the named producers.

Consumers scanning bag QR codes. Scanning a Source Loop QR code records an anonymous page view. No personal identification is captured at scan.

What we publish, and what we restrict

Public passport pages display origin region at approximate level only. Exact GPS coordinates, individual producer identification, and commercial pricing are restricted to verified buyers under non-disclosure agreement.

Your rights

Under GDPR you have the right to access, correct, delete, or export your personal data, and to object to its processing. Requests should be sent to privacy@sourceloop.org.

Data retention

Buyer correspondence is retained for the duration of the commercial relationship plus seven years for tax compliance. Producer and lot data is retained for the lifetime of the lot and any traded product made from it, plus five years.

Hosting and processors

The Source Loop website is hosted in the European Union. Passport tamper-evidence anchors are published to public Sui and Walrus networks; these anchors do not contain personal data. The current list of sub-processors (including email and analytics providers) is available on request.

Contact

Questions about this policy: privacy@sourceloop.org.