Privacy Policy

The controller is FIELD TO PORT LIMITED, registered in England and Wales, company number 17474840, registered office 83 Granville Road, Northwich, CW9 8EU, United Kingdom.

For anything about your personal data, write to contact@fieldtoport.com, or by post to the registered office above.

Your account: your name, an email address, a phone number or both, and a password. Without them there is no account. A grower may sign up with a phone number and give no email at all. We use these to identify you and sign you in, and, if you give an email address, to tell you things about your account. If you give no email address, the WhatsApp codes below are the only messages we send you outside the platform.

Your phone number and WhatsApp (sellers only): a grower who signs up with a phone number gets a code on WhatsApp to confirm the number is theirs. We also send a WhatsApp code to check a phone number you add to your profile. Once you confirm a number from an African country on your profile, you can also sign in with it and your password. If you forget your password, we can send a code on WhatsApp to the number you sign in with, or a link to your email address. Each code works once, and only for 5 minutes. We use WhatsApp only for these codes, and we never send them by text message. If you do not use WhatsApp, use an email address: you can sign up, sign in and reset your password with email alone.

If a seller names you as their company's contact person: we hold the contact details the seller gives us, and we email you a link so the seller can confirm your email address. Write to contact@fieldtoport.com to ask about this or to have your details deleted.

Your identity: date of birth and national identification number, and the identity documents you upload. For a company, the same for the person holding the account and for every director. Used only to check that you are who you say you are and may trade here.

Your business: company name, registration number, address, the farms you grow on and your right to use that land, and your certifications. Used to verify the business and describe it accurately to buyers.

What you list and what you ask for: produce, volumes, months, indicative prices, and the requests buyers post. Used to match growers to buyers and to record the deals they make.

How you use the platform: pages opened, searches, and the steps of a deal, with times. Used to run and improve the service and to understand the market.

We do not ask for, and do not want, information about your health, politics, religion or trade union membership.

To provide the service you asked for — your account, your listings, the requests and deals you make through the platform — we rely on PERFORMANCE OF A CONTRACT with you.

To verify identity and eligibility, and to keep the marketplace trustworthy, we rely on LEGITIMATE INTERESTS: ours in preventing fraud and misrepresentation, and buyers' in dealing with verified growers. You can object; see your rights below.

To send marketing email we rely on your CONSENT, asked for separately when you create your account and never bundled with accepting the terms. You can withdraw it at any time on your profile page, and withdrawing it changes nothing else about your account.

Where we must keep records to meet a legal obligation, we rely on LEGAL OBLIGATION.

The documents you upload are confidential. We use them only to verify identity and eligibility to trade on this platform. They are never shared with buyers, sellers or any other user, and are never used for marketing. Access is limited to our verification team and every view is logged.

Our verification team, to check documents. Every view is logged against the person who made it.

Buyers see a grower's BUSINESS: trading name, country and region, what is listed, and the certifications held. Buyers do NOT see identity documents, dates of birth, national identification numbers or phone numbers.

Sellers see a buyer's company and what they have asked for. They do not see the buyer's documents.

Our service providers, who process data only on our instructions: cloud hosting and database (Google Cloud, London), email delivery, payment processing (Stripe), and the UK company register lookup (Companies House).

WhatsApp codes: Meta, which runs WhatsApp, sends the codes that confirm phone numbers and let you reset a password. We give Meta only the phone number and the code. Meta sends these messages for us; as with any WhatsApp message, WhatsApp also checks for spam to protect its users.

A reseller who introduced you to Field to Port, or to whom we attached your account after telling you, sees your name, your company, the date you joined, the phone number you signed up with, your email address if you have added one, whether your email address is confirmed, whether your membership is paid and until when, and the date and amount of each membership payment you make, so they can help you get started.

Nobody else. We do not sell personal data and we do not share it for anyone else's marketing. Where the law requires a disclosure, we make it.

Growers are in countries across Africa; the platform and its database are in the United Kingdom. So personal data about growers leaves their country and comes to ours.

Where we send personal data from the UK to a service provider outside it, we use the UK International Data Transfer Agreement or the UK Addendum, and we assess the risk of that transfer beforehand, as the ICO requires. You can ask us for a copy of the safeguard for any of these transfers.

The WhatsApp messages that carry our codes are sent by Meta, which may store them outside the UK, including in the United States. For that transfer we rely on standard contract terms: the European Commission's standard contractual clauses with the UK Addendum issued by the UK Information Commissioner. They are part of WhatsApp's business terms. You can read them at whatsapp.com/legal/business-data-transfer-addendum-uk, or ask us for a copy. Meta says it keeps these messages for no more than 30 days.

Identity documents and identity details (dates of birth, national identification numbers): while the account is open, and 6 years after it closes. That follows the ordinary limitation period for a contract claim in England and Wales — the window in which a dispute about a deal made through the platform could reach us and we would need to show who we verified.

Company, director and farm verification records: the same 6 years, for the same reason.

Listings, requests, and the record of deals made through the platform: kept indefinitely. These are business records about produce and prices rather than about a person, and they are what the market history is made of.

Account and contact details: while the account is open, and 6 years after it closes.

Consent records, including withdrawn ones: 6 years after the consent ends, while your account exists. If we delete your account at your request, its consent records are deleted with it.

Usage and interaction records: kept indefinitely, and separated from the account after 6 years so what remains is about the market rather than about you.

Marketing lists: your address comes off as soon as you withdraw consent. The record THAT you withdrew is kept, unless your account itself is deleted, so we can show we stopped.

The record that a phone number was confirmed: kept with your account and contact details, for the same period.

Request counts: to stop codes being sent too often and passwords being guessed, we count requests and wrong passwords for each phone number, account and internet address. We store these in coded form, not as written. A clean-up runs every day and deletes those more than 48 hours old, so none is kept longer than about 3 days.

These periods are what we have committed to. The platform deletes the request counts itself. For the rest, we should tell you plainly that the automatic deletion behind this schedule is not built yet: today a file is removed when you ask us to remove it, or when we do it by hand. Ask us and we will tell you what we hold about you and delete what we are able to delete.

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict what we do with it, to object to our using it, and to receive it in a portable form.

You can withdraw consent to marketing at any time on your profile page, without affecting anything else.

Some of these have limits. We may not be able to delete records we need to answer a dispute about a deal. If we refuse a request we will tell you why.

Ask by writing to contact@fieldtoport.com, or by post to the registered office. We will answer within one month.

If you are unhappy with how we have handled your data, tell us at contact@fieldtoport.com and we will look into it. You can also complain to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority in your own country — for example, the Office of the Data Protection Commissioner in Kenya, or POTRAZ in Zimbabwe.

You can ask us to delete your account and the personal data we hold about you. Write to contact@fieldtoport.com, or by post to 83 Granville Road, Northwich, CW9 8EU, United Kingdom, and tell us the email address or phone number you sign in with.

We will check that the request comes from you before we act on it, asking only for what we need to be sure, and we will answer within one month.

There is no delete button in your account yet: our team does the deletion by hand. We delete everything we can, and tell you what we keep and why: for example the record of a deal made through the platform, which we may need if a dispute about it arises.

Copies in our backups are not removed at once: we use them only to recover from a fault, and if we ever restore one, we delete your data again.

The codes we sent you on WhatsApp stay in your WhatsApp chat until you delete them there, or until they disappear if you use disappearing messages.

Sign-in is protected, sessions can be revoked immediately, and administrator accounts require a second factor. Identity documents are stored separately from the marketplace data and are reachable only through short-lived links.

Access to identity documents is limited to the verification team, and every view is logged against the person who made it.

If a breach puts you at risk, we will tell you and the relevant regulator, as the law requires.

If we change how we use personal data we will update this policy and tell account holders by email before the change takes effect, not afterwards. An account with no email address cannot be told by email; the date below shows when this policy last changed, and your dashboard asks you to add an email address.

Last updated: 2026-10-13.