Privacy Policy

Organic Forward (organicforward.org) is a B2B directory connecting EU procurement buyers with certified organic producers and suppliers. This privacy policy explains how we collect, use, and protect information when you use Organic Forward.

Organic Forward is the data controller for the processing described here. You can reach us at Anckargripsgatan 3, 211 19 Malmö, Sweden, or by email at legal@organicforward.org.

You can browse the directory without an account. We collect information you provide when you:

• Create an account or sign in (name, email, password or your Google/Microsoft sign-in, job title, phone, country)
• Apply to join the directory through our application survey (your answers, company details and contact details)
• Build a brand page or product listing (company information, certifications, trade facts, and files you upload such as certificates, product sheets and sustainability reports)
• Contact a supplier, request a quote, or send and receive messages
• Send, receive or negotiate an offer
• Join a video call arranged through the platform, or log a call afterwards
• Use the account assistant
• Submit a contact form or listing claim request, or report an issue with a listing

Files you upload to the private buckets (certificates, product documents, brand documents and message attachments) are served only to signed-in users who are allowed to see them.

When you visit Organic Forward, we automatically collect certain technical data:

• Device and browser type, operating system, and screen resolution
• IP address and approximate geographic location (city/state level)
• Pages visited, time spent, and interactions on the site
• Referring URL (how you found us)

This data is collected through cookies and similar technologies. For details on specific cookies, see our Cookies page.

We use collected information to:

• Provide and improve the directory service
• Respond to your inquiries or listing claims
• Analyze website traffic and usage patterns
• Ensure security and prevent abuse
• Comply with legal obligations

We do not sell your personal information.

We may share information in the following circumstances:

• Service providers: We use third-party services that process data on our behalf to operate the platform. Section 12 lists them
• Suppliers and producers: If you submit a claim or contact request for a specific supplier or producer listing, we may share your contact details with that organization
• Legal compliance: We may disclose information when required by law, regulation, or legal process
• Business transfer: If Organic Forward is merged, acquired, or its assets sold, personal data may transfer to the acquirer. We will tell you before that happens and you keep every right described in this policy

We use our own first-party analytics to understand how visitors use Organic Forward. It stores a random session identifier in your browser, rotating every six hours, and records which pages you view and which channel you arrived from. It sets no cookies, never tracks you across other websites, and we do not share raw events with anyone. Nothing is stored or sent until you accept analytics in the privacy banner.

We use Cookiebot to manage cookie consent. You can adjust your cookie preferences at any time on our Cookies page.

We may use Meta Pixel for advertising measurement. These tools are subject to your cookie consent choices.

We measure how the platform is used (pages viewed, searches, saves, inquiries) with first-party technology. We store no IP addresses; a short-lived random identifier links a visit's pages together. Unless the next paragraph applies, suppliers see aggregate statistics only — never your browsing.

If you are signed in and have accepted analytics, we additionally link your views of brand and product pages to your account. A supplier can see your activity on their own pages once you have contacted them — for example which of their products you viewed — never your activity anywhere else on the platform. This rests on your analytics consent; withdraw it at any time via Manage privacy settings in the privacy banner, or from Account → Privacy, and the linking stops.

While you are signed in, members you already have a conversation with can see that you are currently online (a green dot); nobody else can, and we do not keep a history of when you were online.

When you use the account assistant we log the request outcome and any rating or feedback you volunteer, to improve the service. These logs are size-capped and never used for advertising. On your request the assistant can look up data in your own account (for example your saved lists, products and brand pages); these lookups run with your own permissions, are not stored beyond the reply, and are never used to train AI models.

When you contact a supplier, the details you submit are delivered to that supplier — including to systems they have connected, such as their CRM. From the moment it arrives, the supplier is responsible for your data as an independent controller.

We retain personal information only as long as necessary for the purposes described in this policy. Analytics data is retained in aggregated form. Contact form submissions are retained for up to 24 months unless you request earlier deletion.

Deleted brand pages and product listings are kept for 30 days before permanent removal. During those 30 days the content is hidden from the public directory, from search and from everyone except the account that owns it, and it can be restored. After 30 days it is deleted permanently and cannot be recovered. The purpose of this window is protection against accidental deletion.

This 30-day window does not apply to erasure requests. If you ask us to erase your personal data, we act without undue delay and do not wait for the window to expire.

Organic Forward is established in Sweden, so the GDPR applies to this processing and you have the following rights:

• Access: request a copy of the personal data we hold about you (Art 15)
• Rectification: have inaccurate or incomplete data corrected (Art 16)
• Erasure: have your personal data deleted (Art 17)
• Restriction: have processing limited while a dispute is resolved (Art 18)
• Portability: receive the data you gave us in a machine-readable format, or have it sent to another controller (Art 20)
• Object: object to processing based on our legitimate interests, including profiling (Art 21)
• Withdraw consent: withdraw analytics or marketing consent at any time, via Manage privacy settings in the privacy banner or from Account → Privacy. Withdrawing does not affect processing carried out before you withdrew (Art 7(3))

Write to legal@organicforward.org to exercise any of these. We answer within one month.

You also have the right to complain to a supervisory authority. In Sweden that is Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy@imy.se. You may instead complain to the authority where you live or work.

We rely on the following lawful bases under Art 6(1) GDPR:

• Contract (Art 6(1)(b)): running your account, publishing the listings you create, delivering your messages, quote requests, offers and calls, and sending the service emails that go with them
• Consent (Art 6(1)(a)): analytics and marketing cookies, and the linking of your brand and product page views to your account described in section 6. You can withdraw it at any time
• Legitimate interests (Art 6(1)(f)): keeping the platform secure, preventing abuse, and measuring aggregate usage so we can improve the service. We balance these against your rights, and you can object under Art 21
• Legal obligation (Art 6(1)(c)): responding to lawful requests and meeting our accounting and reporting duties

We use the following third-party services that may process your data:

• Supabase: database, authentication and file storage. Holds your account, listings and uploaded files.
• Cloudflare: hosting, CDN, DNS and security. Serves the site and may log IP addresses briefly to protect it.
• Amazon Web Services (Amazon Bedrock): generates the account assistant's replies.
• Algolia: powers product and directory search.
• Resend: sends transactional and notification email.
• Google: optional sign-in.
• Cookiebot: records and manages your cookie choices.
• Meta: advertising measurement, where you have accepted marketing cookies. Some of these events are sent to Meta from our server rather than from your browser, and your consent choice governs both routes.
• Hetzner: hosts our self-hosted video-call service at meet.organicforward.org.

Each processor is bound by a data processing agreement and may use your data only on our instructions. We share only what each service needs to do its job.

This list is the same one shown in your account under Settings → Privacy. If you ever find the two disagreeing, please tell us at legal@organicforward.org.

If you connect your own CRM (for example HubSpot, Pipedrive, Mailchimp or GoHighLevel), data you send there is handled by you as an independent controller under your own agreement with that provider.

Some browsers include a Do Not Track (DNT) signal. Organic Forward does not currently respond to DNT signals. However, you can manage your tracking preferences through our cookie consent banner powered by Cookiebot, which allows you to opt out of analytics and marketing cookies regardless of your DNT settings.

Organic Forward is established in Sweden and serves a European audience. We host in the EU where the service offers it.

Some of our processors are US-headquartered and may process data outside the European Economic Area. Where that happens we rely on the safeguards in Art 46 GDPR, principally the European Commission's Standard Contractual Clauses, together with the processor's own certification under the EU-US Data Privacy Framework where it holds one. Write to legal@organicforward.org for a copy of the safeguards relied on for a specific transfer.

Organic Forward aggregates supplier and producer information from publicly available sources and from the organizations themselves. Most of it is company information rather than personal data. Some of it is not: a named contact person at a supplier, or a sole trader whose business is their own name, is personal data and this policy applies to it in full, including the rights in section 10.

If you are a supplier or producer and wish to update, correct, or remove your listing information, please visit our Claim Your Listing page or contact us directly.

Organic Forward is a B2B service not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

We implement reasonable technical and organizational measures to protect your information, including HTTPS encryption, Cloudflare security services, and access controls. However, no method of transmission over the internet is 100% secure.

We may update this privacy policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this policy periodically.

For privacy questions, data requests, or concerns, get in touch:

Organic Forward, Anckargripsgatan 3, 211 19 Malmö, Sweden. Privacy and data requests: legal@organicforward.org. Everything else: team@organicforward.org.

We have not appointed a Data Protection Officer. Our processing does not meet the Art 37 criteria that require one: we do not carry out large-scale systematic monitoring, and we do not process special categories of data on a large scale.