Privacy policy

How we collect, use, and protect your information on Mallport.

Last updated: 23 March 2026

This Privacy Policy describes how your personal information is collected, used, and shared when you visit or make a purchase from https://mallport.co.uk/ (the "Site").

Information We Collect

When you visit the Site, we automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device. Additionally, as you browse the Site, we collect information about the individual web pages or products that you view, what websites or search terms referred you to the Site, and information about how you interact with the Site. We refer to this automatically-collected information as "Device Information".

We collect Device Information using the following technologies:

  • "Cookies" are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.
  • "Log files" track actions occurring on the Site, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
  • "Web beacons," "tags," and "pixels" are electronic files used to record information about how you browse the Site.

Additionally, we may collect information that you provide us directly through forms, such as name, email address, and other contact information when you register for an account on the Site. We refer to this as "Account Information".

Farm workspace data

If you use the optional farm workspace (land parcels, crop notes, soil observations, livestock batches), that operational information is stored against your account and farmer profile so you can manage it in one place. You can download a copy and delete these workspace records from the farm workspace pages; deleting workspace data does not remove your public farmer profile or marketplace listings. Optional API keys (issued by site operators for integrators you authorise) can read summary or export data over HTTPS; revoke keys from the admin if a partner relationship ends.

Data protection governance (operators & users)

For site operators: Before marketing or scaling features that invite commercially sensitive farm or supply-chain data, you should complete (and periodically refresh) a data protection impact assessment appropriate to UK GDPR expectations — covering purpose, retention, access, subprocessors, breach response, and user rights. Mallport provides export and delete tools for farm workspace data to support minimisation and erasure requests; they do not replace legal or DPO sign-off.

For users: You are responsible for the accuracy of what you enter (including optional trace references and listing types such as product vs service). A “verified seller” badge reflects Mallport’s internal review of business profile information — see our verified sellers explainer and terms — not a government or statutory guarantee of every listing.

The optional food chain pilot is for sellers who choose to use it: anyone can list on the marketplace without trace lots; if you have a producer profile, you may maintain internal trace lots and a simple timeline of steps (for example handoffs or notes). It is not a statutory traceability or certification service. You can export a lot as JSON from the lot page; staff manage named partner organisations in the admin for optional references on timeline entries. Partner portal accounts (pilot): staff can link registered users to a partner organisation so those users see a read-only list of ledger steps where that organisation is named—without access to edit sellers’ lots. If enabled for the organisation and the site, we may email those users when a new ledger step names their organisation (staff can turn this off per organisation in the admin). On some deployments we may batch several steps into a single digest email per delay window instead of one email per step. Linked users can also turn off these emails in their account email preferences. Public verify links use signed, time-limited URLs so recipients can view a read-only copy of a lot without logging in; treat shared links like credentials and do not post them publicly unless you intend to. If you configure webhooks, we send HTTPS POST requests with JSON when new ledger entries are created to the URLs you provide; you may set an optional shared secret so your server can verify payloads (HMAC-SHA256 of the raw body). An optional external trace reference field on a lot (for example a batch or GS1-style identifier you type yourself) is for your own records and integrations only; we do not verify or assert legal compliance from that value.

Regional news tags (England, Scotland, Wales, Northern Ireland) on editorial posts are for discovery and context on our UK regions and news pages only. They do not change who can list or buy on the marketplace, and they are not a guarantee of where a product was produced unless the article or listing itself states that separately.

Agricultural intelligence (pilot)

When enabled, the Site may display reference weather from the third-party Open-Meteo service (no API key; we store a short-lived snapshot on our servers), headlines from an official GOV.UK Atom feed filtered to DEFRA news, and (when staff enable it) a second GOV.UK Atom aimed at drought / water / environment discovery — all for general context only, not farming, safety, or statutory warnings. If configured with a Met Office DataPoint key, we may store a short Met Office forecast excerpt under their licensing terms. We may show signposts to AHDB and official statistics pages (via the same signed redirect where applicable). If you save an optional town preset or coordinates for a personal weather card (UK pilot area only), we request Open-Meteo data for that point when you view the hub while logged in; that personal card is not included in the public widgets JSON. The public widgets JSON endpoint (/intelligence/api/v1/widgets.json) may expose cached summaries of these feeds (excluding your personal point) for embedding. Links to GOV.UK, Open-Meteo, the Met Office, AHDB, and similar pages may go through our signed redirect (/intelligence/go/) so we can log aggregate exits and reduce open-redirect risk; we may record the link kind, destination URL, approximate session, and your account if you are logged in. The weekly digest may include a short intelligence teaser when you opt in; separately, you may opt in to DEFRA headline change emails (throttled), which are not government advisories. In-app, email, and push intelligence alerts (including watch-zone overlap checks) are automated summaries and may be wrong or delayed; they are not a substitute for Met Office or Environment Agency statutory products, Floodline, or emergency services — see the disclaimer on the intelligence hub, dashboard, and alert centre.

When we talk about "Personal Information" in this Privacy Policy, we are talking both about Device Information and Account Information.

How Do We Use Your Personal Information?

We use Account Information to create and manage your account on the Site. We use Device Information to improve the Site and optimize our services.

Sharing Your Personal Information

We do not share your Personal Information with third parties, except as necessary to provide services through the Site, comply with legal obligations, and protect our rights. Here are the limited situations where we may share your Personal Information:

  • With third party service providers who help us manage the Site. Any third parties will be bound by strict data processing terms and conditions.
  • To comply with legal obligations, court orders or other legal process.
  • To investigate potential fraud, harassment or other violations of our Terms or this Privacy Policy.

Sellers: We do not share any of your Personal Information with sellers listing products on the Site. Transactions between buyers and sellers are conducted directly between the users. We are not involved in any shipments, payments, returns, or exchanges of products purchased through the Site.

Your Rights

If you are a UK resident, you have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. If you would like to exercise this right, please contact us through the contact information below.

Changes

We may update this privacy policy from time to time in order to reflect changes to our practices or for other operational, legal or regulatory reasons.

Contact Us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at support@mallport.co.uk.