Privacy Notice — Ecology App

Last updated: 7 November 2026 | Controller: Owletts Farm Partnership (SBI 200801263), Fleur Cottage, Owletts Farm, Ashurstwood, East Grinstead RH19 3SL | Data Protection Lead: Ben Todd

This notice explains what personal information Ecology App holds about UK landowners, where we obtained it, how we use it, and the rights you have over it. It is issued under UK GDPR Article 14 because in most cases we did not obtain your information directly from you — we obtained it from UK public registers that already published your information under known legal bases.

If you would like the short version, see our Data Subject Promise. If you want to exercise your rights — see what we hold, correct it, object to it, or have us suppress it — use the Data Subject Rights portal.

What is Ecology App?

Ecology App is a decision-support platform operated by Owletts Farm Partnership. It overlays UK public-register data about land — scheme participation, ownership, corporate structure — against authenticated user-defined catchment boundaries. Authenticated users, who include farmers, organisations and people with a home or small plot, use the platform to identify, evaluate and prioritise restoration, stewardship and Biodiversity Net Gain partnership opportunities in their local catchment, and to read and keep the history of their land.

We are not a marketplace, not a credit-reference agency, not a direct-marketing service. We aggregate already-public information into a more useful form for restoration partnership work. Authenticated users may use the platform to inform individualised, human-mediated outreach to identified landowners, using only correspondence addresses that the landowner has affirmatively-published in a relevant public register.

What information we hold about UK landowners

We collect from UK public registers, not from data subjects directly. The fields we hold per landowner depend on which registers they appear in:

From HM Land Registry

• INSPIRE Index Polygons (OGL v3.0): title number, polygon boundary — no proprietor identity at this layer.
• CCOD (Commercial and Corporate Ownership Data) (HMLR bespoke licence): for registered companies and charities that own land in England and Wales — company name, company number, address-on-register, tenure, price paid (if recent), country of incorporation.
• OCOD (Overseas Companies Owning UK Land) (HMLR bespoke licence): for overseas companies that own land — proprietor name, country of incorporation, address-on-register, tenure.
• Price Paid Data (OGL v3.0): for property transactions — sale date, price, address, type (no proprietor identity at this layer).

We do not aggregate the HM Land Registry Index of Proprietors' Names, which is name-search only and requires a paper form (HMLR Form PN1) and £11 fee per search.

From the Rural Payments Agency and Defra

• SBI registered land parcels (OGL v3.0): for farmers registered under their SBI — parcel polygon, SBI, scheme participation indicators.
• Find Farm and Land Payment Data (FFLPD) (OGL v3.0 with embargo): for businesses receiving £1,250+ in agri-environment payments — business name, partial postcode (outward code, e.g. "RH19 1"), post town, scheme name, total payment per scheme year. We never show an address derived from the partial postcode to our customers. For our own restoration outreach we may look for an address in the edited (open) electoral register, never the full register. You can take your name off the edited register at any time by asking your local council's electoral registration office.
• CAP Payments (legacy): historical EU-era payment beneficiary data — business name, partial postcode, scheme, total payment. Sunsetted May 2027.

From Natural England + Forestry Commission

• Countryside Stewardship (CS) Agreement Publications: agreement reference, option codes, area, contract dates, organisation name where published.
• Sustainable Farming Incentive (SFI) Actions + Agreement Areas: agreement reference, option codes, area, contract dates. SFI publication is anonymised at source. Where we work out a likely holder, we do it by comparing it with other public sources (see "How we work out who owns or farms land" below).
• Environmental Stewardship (ES, legacy): agreement reference, options, area, contract dates.
• EWGS / EWCO Forestry Commission woodland grants: scheme reference, options, area, holder name where published.
• Biodiversity Net Gain Register: reference number, grid reference, responsible body (a planning authority or conservation body, not the landowner), habitats. The published register does not include landowner names.

From Companies House + Charity Commission

• Companies House Active Register: for directors of land-holding companies — director name, date-of-birth month and year only, service address, registered office, role.
• Companies House register of people with significant control: for natural persons with significant control of land-holding companies: name, date-of-birth month and year only, country of residence, nature of control.
• Charity Commission Register: for local charities that may hold land, the charity's name, number, registration status and dates; for a charity looked up by its number, also its type, its published address and contact details, its activities, income and expenditure. We do not collect the names of trustees.

From the UK Land Carbon Registry

• Woodland Carbon Code and Peatland Code projects: for carbon projects, the project developer's name, which is a person where a landowner runs their own project.

From the Welsh Government (DataMapWales)

• Glastir Entry and Glastir Advanced permissive-access areas (Open Government Licence v3.0): for farms in or next to Wales, the areas where a Glastir agri-environment agreement provided public permissive access (footpaths, bridleways and access land), as the Welsh Government publishes them - the area's boundary, the Glastir scheme reference number, the scheme, the option type and description, and the years the agreement was active. The published layer carries no holder name, address, business identifier or payment value, and we hold none for it. We use the scheme reference only as published, to identify the access area; we do not link it to a named person.

From the Environment Agency public registers

• Water Discharge Consents and Exemptions (Environment Agency Conditional Licence): for sites with a registered private sewage discharge — septic tanks, package treatment plants and consented discharges — we hold the published site address, postcode, grid reference, discharge type and registration reference. We hold the published site location only; we do not hold or derive the holder's or occupant's name. Used to screen which properties are likely on off-mains sewage for catchment river-health work (the "Sort Our Sewage" project, with Friends of the River Medway).
• Industrial installations and waste operations (Environment Agency Conditional Licence): for sites holding an environmental permit, the permit holder's name as published, the site address and postcode, and whether the holder is an individual.

Sources we deliberately do NOT collect

To limit the risks identified in our assessments, Ecology App does not collect:

• HMRC Trust Registration Service (no public extract)
• HM Land Registry Index of Proprietors' Names
• Per-LA Section 31(6) Highways Act deposits (no national aggregator)
• Northern Ireland land registration records
• Scottish land ownership records beyond the published boundary layer
• SFI intervention sub-codes that could correlate with sensitive personal characteristics (e.g. Farming in Protected Landscapes Wellbeing component)
• Charity Commission entries for religious or political charities where trustee identity could be sensitive
• WhatDoTheyKnow FOI archives that could surface political opinions
• Environment Agency prosecution records naming individual farmers (criminal-offence data, Art 10)

How we work out who owns or farms land

Some public registers name the land but not the person or business behind it. For example, Sustainable Farming Incentive agreements are published without the holder's name. Where this happens, we may work out a likely holder by comparing the register with other public sources, such as overlapping Countryside Stewardship agreements, Land Registry company ownership, Defra payment data or Companies House. This is our own inference. It is not something a register has published, and it can be wrong. We mark inferred names as "inferred". Only our own team can see inferred names; our customers cannot.

If we have matched you wrongly, tell us through our rights request form and choose "Correct something that's wrong". We hide the name straight away while we check it. If the match is wrong we delete it, and we stop it coming back when the registers are refreshed.

If you contact us or apply for an account

Separately from the public-register landowner data above, if you fill in a contact or enquiry form on this site (for example our Contact or Apply for an account pages), or request access to a feature from within Ecology App, we collect only the details you choose to give us — your name, email address, organisation (if provided) and your message. Unlike the register data above, this information comes directly from you.

We use it solely to respond to your enquiry and, where relevant, to set up and manage your account. Our lawful basis is Article 6(1)(f) legitimate interests (responding to people who contact us), or Article 6(1)(b) where it concerns a contract with you. We do not use it for marketing without your consent, and we do not share it beyond the processors listed below. We keep enquiry records for up to 24 months after our last contact with you, then delete them. The rights set out in "Your rights" below apply to this data too.

If you have an account on Ecology App

If you sign in to Ecology App, usually because the organisation you work for is our customer, we hold: your name, email address and username; your sign-in details (password or passkey, stored in a protected form); which organisation and teams you belong to; records of when you signed in, from which IP address and browser; a record of the pages you used and of the landowner profiles you viewed; and the work you create on the platform, such as farm records and notes. This comes from you and from the organisation that set up your account.

We use it to run your account, keep the platform secure and keep a record of who has seen landowner information. Where you use Ecology App as a member of staff of a customer organisation, our lawful basis is Article 6(1)(f) legitimate interests (providing the service your organisation has asked for, and keeping it secure and accountable). Where you hold the account under your own contract with us, it is Article 6(1)(b) (the contract).

We keep your account while it is open. When it closes, we delete it and the work saved in it, unless you or your organisation ask us otherwise. Records of sign-in, of the pages you used and of the landowner profiles you viewed are kept for 3 years, as set out in the table below.

If you have an account for your own home

If you use Ecology App for your own home, we hold your name and email address, your sign-in details, the boundary of your plot, the history we prepare for you, and anything you add. We use it to give you the service you asked for, to keep it secure, and to see whether you have been able to get started so that we can help. Our lawful basis is Article 6(1)(b) (our agreement with you). What you add is private to you and the team that prepared your history. We do not use it for marketing or share it beyond the processors listed below. You can ask us to remove your account and everything in it at any time. If you sell your home, your account and what is in it stay yours, and a new owner applies afresh.

Your history comes from old maps and public records and can name people, including recent owners and occupiers. If you are named in a history and want something corrected or removed, contact us.

Sharing your LNRS commitments with a partnership

This section is given under UK GDPR Article 13 because it concerns information you give us directly about your own land — distinct from the public-register landowner data above.

If you use the Land Options feature, you can record the land-management actions you intend to take on your own farm against the Local Nature Recovery Strategy (LNRS) priorities that apply to it. These commitments are yours — they are not shared with anyone unless you choose to share them. We give you an opt-in to share your committed actions with a named partnership organisation (for example a Local Nature Recovery partnership such as the Sussex Nature Partnership). The opt-in is off by default. If you tick a partnership:

• What is shared: only your committed LNRS actions on that farm — which action, its status, the LNRS priority it delivers, and (only if you drew one) that action's location. Nothing else about your farm is shared — not your other platform data, reports, maps, funding case, satellite imagery, or your boundary beyond a committed action's own footprint.
• With whom: only the specific partnership organisation(s) you tick — sharing is per-partnership.
• Why: so the partnership can see what nature-recovery work is planned across the area and signpost you to relevant advice and funding.
• Lawful basis: your opt-in — Article 6(1)(a) consent where your farm trades as a natural person, or Article 6(1)(f) legitimate interests where it trades as a legal entity (where the data is generally not personal data at all). Either way, it happens only because you chose it.
• Your control: you can turn it off at any time by un-ticking the partnership; their access stops when you do. Each opt-in and opt-out is recorded.
• The partnership's role: once shared, the partnership is an independent controller of the commitment information it receives and uses it under the LNRS Partnership Data-Sharing Terms — limited to LNRS coordination, advice and signposting, with no re-sharing or marketing. Their own privacy notice governs what they then do.

How we use this information

The rest of this notice concerns the public-register landowner data described above. Our lawful basis for processing it is UK GDPR Article 6(1)(f), legitimate interests. The interests we have identified, the necessity test, and the balancing-test outcome are documented in our Legitimate Interests Assessment and our Data Protection Impact Assessment, both available on request from the Data Protection Lead.

We use this information to:

• Display per-landowner profiles to authenticated users, scoped to their catchment boundary.
• Aggregate cross-source for identification and prioritisation of restoration partnership opportunities.
• Inform individualised, human-mediated outreach by authenticated users — using only the landowner's affirmatively-published correspondence address from the relevant register.

We do not, and our authenticated users may not under our Acceptable Use Policy:

• Resolve hidden or redacted addresses for anyone outside our own team, or show an address we have looked up to a customer.
• Operate mass mail-merge or automated marketing campaigns to identified landowners.
• Sell, license, sub-license or republish raw register data.
• Make automated decisions producing legal or similarly significant effects on a natural person (Article 22).
• Infer religion, political opinion, trade-union membership, health, sexual orientation, racial/ethnic origin, or criminal-offence information.

How long we keep your information

For each source we keep records for the period the publisher keeps them, as set out below. If a publisher removes a record, we keep our copy, marked as no longer published, until the period below ends; an objection or an erasure request still suppresses it (see “Your rights”).

Records about you as a platform user, an enquirer or a requester:

Who we share your information with

• Hetzner Online GmbH: hosts our servers in Finland and Germany. Our sign-in service (Keycloak), visit counting (Umami) and error reporting (GlitchTip) run on these servers. Processor under an Article 28 agreement.
• Cloudflare, Inc.: runs our domain name service and stores our files and encrypted backups (in its EU storage region). Processor under an Article 28 agreement.
• Brevo (Sendinblue SAS, France): sends our service emails, such as replies to enquiries, sign-in and account emails, and alerts to our team. Processor under an Article 28 agreement.
• GitHub, Inc. (United States): stores our software code. We do not use it to hold personal information about you.
• Authenticated business users of the platform (today: OFP / UMLSC CIC directors; future: ecology consultancy customers) — catchment-scoped profile view, under our Acceptable Use Policy.

We do not sell or share data with brokers, advertisers or marketing providers.

Our servers are in Finland and Germany, and our stored files and backups are kept in Cloudflare's EU storage region. Cloudflare is a US company and may handle some information outside the UK and EEA, for example to run its network. Where it does, its data processing agreement with us includes the UK's approved transfer terms (the UK Addendum to the EU standard contractual clauses).

How we secure your information

• Access to our servers and databases is restricted, and our databases are not open to the internet. Backups are encrypted before they leave our servers.
• Information sent to and from the site is encrypted in transit.
• Role-based access control.
• Audit logs: records of sign-in and access kept for 3 years (IP addresses shortened after 90 days), records of administrative actions kept for 7 years.
• Encrypted backups, kept in Cloudflare's EU storage region.
• Regular security checks of our servers and software.

Cookies and analytics

We use cookies to run the site and to remember choices you make in it. We do not use them for advertising or to track you across other sites.

• __Host-ecology.session: keeps you signed in (up to 7 days).
• __Host-ecology.oidc-flow: used for up to 10 minutes while you sign in.
• pref_org: remembers which organisation you are working in, if you belong to more than one (30 days).
• ecology_active_farm: remembers the last farm you opened, so you can get back to it quickly (until you close your browser).
• ecology_first_visit: remembers that you have seen the welcome to your farm, so it shows once (1 year).
• ecology_view_as: used only by our own staff to preview the site as a customer sees it (8 hours).
• Our sign-in service at auth.ecology.land sets its own cookies while you sign in and while you are signed in. They last no longer than your sign-in session.

The app also keeps a few display settings in your browser's own storage, such as the map view and time range you last chose. They stay on your device.

Analytics. We count visits with Umami, which we run on our own servers. It does not use cookies. It records the page, browser, device type and country, using an anonymous visitor code rather than your IP address. We keep these statistics for 25 months.

Error reports. If a page fails, our error-reporting tool (GlitchTip, also run on our own servers) records the address of the page, your browser and technical details of the error. It is set up to avoid collecting personal details, and we delete these reports after 30 days.

Map and postcode services. To show maps and look up postcodes, your browser connects directly to services such as MapTiler (maps) and postcodes.io (postcode lookup). Like any website you connect to, they receive your IP address.

Your rights

Under UK GDPR and the Data Protection Act 2018 you have rights to:

If you are unhappy with how we have handled your personal data, complain to us at privacy@ecology.land or through the data rights request form. We confirm receipt within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk. We would prefer you contact us first so we can resolve it directly, but it is your right to escalate at any time.

How to contact us

• Exercise data subject rights: the data rights request form
• Data Protection enquiries: privacy@ecology.land
• Postal: Ben Todd, Data Protection Lead, Owletts Farm Partnership, Fleur Cottage, Owletts Farm, Ashurstwood, East Grinstead RH19 3SL
• Complain to us: privacy@ecology.land
• Complain to the regulator: ico.org.uk

Changes to this document

We will publish material changes here with at least 28 days' notice. Cosmetic and clarifying changes may take immediate effect. We keep previous versions.

6 November 2026: we added a section for people with an account for their own home. It changes nothing for other accounts, and it takes effect on publication.

30 October 2026: we corrected and expanded this notice so that it fully describes processing that was already taking place: how we work out who probably holds land and how to correct a wrong match, accounts, cookies and analytics, the services we use, retention periods and response times. Because these changes describe existing processing rather than start new processing, they take effect on publication.

Last updated: 7 November 2026.