Who we are
Preferred by Nature (formerly NEPCon) is an international non-profit organisation supporting better land management and business practices that benefit people, nature and climate.
We are the data controller in respect of the personal data described in this Privacy Notice. Our contact details are:
Organisation: Preferred by Nature
Address: Skindergade 23, 3., 1159 Copenhagen K, Denmark
Registration: 18044633
Email: info@preferredbynature.org
Website: www.preferredbynature.org
DPL Contact: dataprotection@pbn.org
Our lead supervisory authority is the Danish Data Protection Authority (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark (www.datatilsynet.dk). Depending on where you live or work, you may have the right to lodge a complaint with your local data protection authority.
Who this notice is for
This Privacy Notice applies to individuals whose personal data we collect and/or use. This includes:
- Individuals who engage our services
Individuals that engage Preferred by Nature for certification, consultancy, technical assistance, training or other activities, including those acting on behalf of client organisations. - Individuals who work with or for us
Engaged to deliver work: Auditors, technical experts, suppliers, and service providers. Partnering with us: project partners, donors. - Individuals who seek to work with or for us
Job applicants. - Individuals who interact with our communications and website
Visitors to our website (www.preferredbynature.org), event participants, subscribers, and newsletter recipients. - Individuals whose data we encounter indirectly through our work
Individuals identified in certification records, audit evidence, or project documentation (such as smallholder farmers, landowners, forest workers, or community members). These individuals may not have a direct relationship with us, and we address how we handle their data in Section 8 below.
What personal data we collect
The personal data we collect depends on your relationship with us. The table below summarises the main categories:
| Who you are | Data we collect |
| Individuals who engage our services (including certification, consultancy, technical assistance, and training clients) | Name, job title, organisation, contact details; service and project records (including audit findings, corrective action plans, consultancy outputs, and training records); assessment and examination results; certificates of completion; invoicing and payment information |
| Individuals who work with or for us (auditors, technical experts, suppliers, service providers, project partners, and donors) | Auditors, technical experts, suppliers, and service providers: name, job title, organisation, and contact details; professional qualifications, CV, competence and training records; approval, accreditation, and scope-of-work records; independence and conflict-of-interest declarations; assignment and performance records; contract, invoicing, and payment details, including bank details where we pay you directly. Project partners and donors: name, job title, organisation, and contact details of representatives; project and grant correspondence; financial and grant reporting information |
| Individuals who seek to work with or for us (job applicants and candidates) | Name and contact details; CV or résumé, cover letter, and application form responses; employment and education history; professional qualifications and certifications; right-to-work or work authorisation status where relevant; interview notes, assessment and test results; references, where you have given us permission to contact your referees; salary expectations; and correspondence relating to your application; professional profile information obtained from publicly available professional networking sites. |
| Individuals who interact with our communications and website (website visitors, event participants, subscribers, and newsletter recipients) | Website visitors: IP address, browser and device information, and cookie identifiers (see Section 10); pages visited and usage data; contact form submissions and any information you choose to include in them. Event participants: name, job title, organisation, and contact details; Subscribers and newsletter recipients: name and email address; subscription preferences; records of your consent and of any withdrawal; and, where you have consented, information about how you interact with our emails. |
| Individuals whose data we encounter indirectly through our work (such as smallholder farmers, landowners, forest workers, and community members) | Name and contact details where recorded; land, farm, or site identifiers and ownership or tenure information; livelihood and economic activity information; records of field interviews or observations; location and geospatial data; photographs and video recorded as audit evidence; and information contained in documents provided to us by our clients as evidence of compliance, which may include employment records, working hours, wage and payroll information, and identity or age verification documents. See the note below regarding sensitive information and section 8 for further details |
In the course of field activities, we may incidentally encounter information that reveals health status, ethnic origin, religious belief, or other characteristics that qualify as special category data under applicable data protection law. We do not actively seek this information, but where it forms part of audit evidence or project records, we process it only to the extent necessary and in accordance with the conditions set out in applicable law. Section 4 below explains the legal bases on which we rely.
Where we collect dietary or accessibility requirements for events, we treat this as sensitive information and collect it only with your explicit consent.
Where you access our systems, portals, or platforms (for example to submit audit evidence, manage a certification, register for a course, or use a client or auditor account) we also collect technical data relating to that access. This includes IP address and device identifiers, account and session logs, access and authentication records, and records of actions taken within the system. This notice does not cover the processing of our employees' personal data.
We collect this data to operate our systems, keep them secure, prevent unauthorised access, and maintain the integrity and traceability of records. It applies across all the categories described above, in addition to the data listed in the table.
How and why we use your data
We only use your personal data where we have a valid legal reason to do so. The table below sets out our main processing activities, why we carry them out, and the legal basis we rely on. Where we rely on legitimate interests, we have assessed that these interests are not overridden by your rights. You may request further detail on any of these assessments by contacting us:
| Purpose | What this involves | Legal basis |
Delivering certification,
| Managing audits, issuing certificates,
| Contractual necessity (where you are party to an agreement) / Legitimate interests (where you act on behalf of a client organisation) / Legal obligation (statutory verification and reporting duties)
|
| Managing auditor and expert competence and independence | Assessing and recording qualifications, training and competence; approving scope of work; recording independence and conflict-of-interest declarations; performance evaluation | Contractual necessity (where you are engaged under a contract with us) |
| Delivering training & education | Administering enrolments and registrations; assessing participants and recording results; issuing certificates of attendance or completion; communicating with participants about course logistics and follow-up; sharing assessment results and certificates with sponsoring employers where enrolment is employer-funded; complying with any applicable accreditation or scheme requirements | Contractual necessity (where you enrol directly with us) / Legitimate interests (where your employer has enrolled you, to deliver the training agreed with them and to maintain records required under applicable
|
| Processing personal data identified in certification and project activities | Recording names, site identifiers, livelihood information, and field interview observations of individuals (such as smallholder farmers, landowners, or community members) encountered during audits or project work (see section 8) | Legitimate interests (conducting credible, evidence-based certification; meeting the requirements of certification scheme owners and donors; and supporting confidence in certified supply chains) |
| Marketing and communications | Sending newsletters, event invitations, service updates, and marketing communications | Consent (newsletters and marketing); Legitimate interests (service-related updates) |
| Recruitment and selection | Advertising vacancies; receiving and assessing applications; interviewing; obtaining references; verifying right to work; communicating with candidates | at your request prior to entering a contract) / Legitimate interest (assessing suitability, keeping a record of the process) |
| Running projects and partnerships | Implementing grant-funded activities, reporting to donors | Contractual necessity (where you are party to a grant or partnership agreement with us) / Legitimate interests (where you act on behalf of a partner or donor organisation, or participate in a project we implement, to deliver and report on the funded activity) |
| Operating our website | Ensuring security, analysing usage, improving performance, processing contact form submissions | Legitimate interests |
| Operating and securing our systems and platforms | Managing accounts and authentication; recording access, session and activity logs; monitoring for unauthorised access; maintaining audit trails so certification records are traceable | Legitimate interests (security and integrity of our systems; traceability of certification records) |
| Meeting other legal obligations | Maintaining tax and accounting records, responding to regulatory requests | Legal obligation |
| Defending or pursuing legal claims | Establishing, exercising, or defending rights in proceedings | Legitimate interests |
| Financial administration & payment processing | Processing payments and issuing invoices; maintaining financial records. Payment card details are collected directly by our payment service provider and are not retained by Preferred by Nature | Legal obligation (accounting and tax records); Contractual necessity (payment processing) |
| Research & sustainability reporting | Producing anonymised or aggregated research, impact assessments, and sustainability reports | Legitimate interests |
| Improving our services | Using anonymised or aggregated data to evaluate and improve service delivery; contacting past participants for feedback | Legitimate interests (anonymised/aggregated analysis) / Consent (direct feedback request) |
Where special category data (such as information revealing health, ethnic origin, or religious beliefs) is incidentally recorded during field activities, we process it only to the extent strictly necessary and rely on GDPR Article 9. Where we rely on your consent (for example, to send you our newsletter), you can withdraw it at any time by contacting us or clicking 'unsubscribe' in any email we send you. Withdrawal does not affect the lawfulness of processing before the withdrawal.
If you would like more detail about how we process your personal data for a particular purpose, please contact our Data Protection Lead at dataprotection@pbn.org.
Who we share your data with
We share personal data only where necessary. This may include:
Certification scheme owners and accreditation bodies: Where required by standards or accreditation obligations. This may include uploading data to standards owner platforms and databases.
Donors and grant funders: Where required for grant reporting, project monitoring, or contractual
obligations under related agreements.
Sponsoring employers: Where your employer has funded your enrolment, we share attendance, assessment results, and certificates with them.
IT and cloud service providers: Who host our systems and data on our behalf under applicable data processing terms.
Legal and professional advisors: Under obligations of professional confidentiality.
Regulatory authorities: Where required by law or court order.
Payment service providers: To process payments for services where individuals pay directly.
Payment card details are collected directly by our payment service provider and are not retained by Preferred by Nature.
Successors and assignees: In the event of a merger, acquisition, restructuring, or assignment of a
contract or portfolio of activities, subject to equivalent data protection safeguards and, where required, notification to affected individuals.
Certain information in audit report summaries is made publicly available in accordance with standards requirements and our Confidentiality Policy. We take care to minimise personal data in published summaries, but where it is included, we inform the relevant party in advance.
Where third-party service providers process personal data on our behalf, we require appropriate data processing terms to be in place. Processors may only use your data on our instructions and for the
purposes we specify.
Not all third parties act as our processors. Some (such as banks, tax and social security authorities, insurers, and payment network operators) process your data as independent controllers, and their own privacy notices apply. In some certification or project contexts, Preferred by Nature and a partner organisation may act as joint controllers determining how personal data is used. Where this applies, we will inform you and provide the essence of the arrangement, and you may exercise your rights against either controller.
International data transfers
Preferred by Nature operates globally. Where your personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place. These typically include:
- Standard Contractual Clauses (SCCs) approved by the European Commission
- Adequacy decisions by the European Commission, where the destination country has been
recognised as providing equivalent protection - In rare cases where no other transfer mechanism is available, we may rely on your explicit
consent after informing you of the relevant risks. - We do not use consent as a basis for routine or recurring transfers.
- Vital interests or legal claims, in exceptional circumstances
You can request details of the specific safeguards in place for any transfer by contacting our Data
Protection Lead at dataprotection@pbn.org.
Please note that remote access to personal data from outside the EEA (for example by a staff member or auditor located in a non-EEA country) may itself constitute an international transfer. We assess and document all such access arrangements and apply the same safeguards described above. Where personal data relating to third parties identified in field activities (such as smallholder farmers or community members) is transferred internationally, the same safeguards apply.
Preferred by Nature operates through wholly-owned subsidiary entities in multiple countries. Personal data may be transferred between our group entities for purposes including centralised administration, IT systems, and certification record-keeping. These intra-group transfers are governed by Standard Contractual Clauses executed between the relevant entities.
How long we keep your data
The periods below reflect Danish law as our primary jurisdiction and the requirements of the standards we operate under. Where we are aware that local law in another jurisdiction requires a different retention period, we apply whichever period is longer. Key retention periods are:
| Type of data | Retention period | Reason |
| Certification and audit records | Duration of certification +10 years | Retention of records covering the current and previous certification cycle; defence of legal claims |
| Training participant records | Duration of programme + x years | Contractual obligations / Legitimate interest |
| Financial and invoicing records | 5 years from end of financial year | Statutory obligation |
| Project and grant records | Duration of project +10 years | Donor audit requirements and contractual obligations |
| Marketing consent records | Until withdrawal +3 years | GDPR accountability requirements |
| Job application records (unsuccessful) | 6 months after decision (2 years where required by local law) | Legitimate interests, equal opportunities |
| Website analytics | 13 months rolling | Consent (for non-essential analytics cookies) |
| Third-party field data | Duration of the relevant certification cycle or project +10 years. Personal identifiers are anonymised where no longer necessary for the stated purpose. | Scheme owner requirements and legal obligations (aligned with certification records) |
| IT security logs | 12 months | Legitimate interest (system security and incident investigation) |
| System audit trails within certification platforms | Aligned to the related certification records | Scheme owner requirements (traceability of certification decisions) |
| Dispute and complaint records | Duration of proceedings +3 years | Legal obligations and legitimate interests |
| Legal claim records | Duration of proceedings +3 years | Legitimate interests (limitation periods) |
When retention periods expire, data is securely deleted or anonymised. Anonymised data may be retained indefinitely for statistical and research purposes. Where you have withdrawn consent for marketing communications, we retain a minimal suppression record (your contact details and the date of withdrawal) indefinitely to prevent inadvertent re-contact.
Individuals identified in certification & project activities
If your personal data has been collected indirectly (for example because you are a smallholder farmer, landowner, forest worker, or community member whose activities were assessed as part of a certification audit or project), this section explains how we handle your data.
We typically receive personal data about you from our certification clients, from field auditors, or from uploaded evidence files. This may include your name and contact details where recorded, land or site identifiers, livelihood and economic activity information, records of field interviews or observations and location data, photographs taken as audit evidence, and information contained in compliance documents provided by our clients. In some cases, sensitive information may appear incidentally in field evidence. We do not seek such information, and where it is recorded, we process it only to the extent strictly necessary.
We use it solely to carry out the audit or project activity and to comply with the requirements of the relevant certification scheme or donor. Where data is used for research or sustainability reporting, it is anonymised so that no individual is identifiable. We do not use it for any other purpose.
Given the scale and nature of our certification and project activities across many countries, it would involve disproportionate effort to individually contact every person whose data is incidentally recorded during field work. This notice, made publicly available on our website, is the primary means by which we provide transparency about our use of this data, in accordance with applicable laws.
Depending on where you live, you may have the right to access, rectify, or request erasure of your data, or to object to its processing. You may also have the right to lodge a complaint with a data protection authority in your country. To exercise any of these rights, you can contact our Data Protection Lead directly at dataprotection@pbn.org. If you are unable to reach us directly, you may also raise a concern through the organisation that commissioned the project.
Your rights
Depending on applicable data protection law, you may have the following rights in relation to your personal data. Each right is subject to certain conditions and exceptions under the law. You can exercise any of these rights by contacting our Data Protection Lead at dataprotection@pbn.org. We will respond within one calendar month.
Right of access: Ask us for a copy of the personal data we hold about you and information
about how we use it.
Right to rectification: Ask us to correct personal data that is inaccurate or incomplete.
Right to erasure: Ask us to delete your data where it is no longer needed, you withdraw
consent, or you object to processing.
Right to restriction: Ask us to pause processing of your data, for example while you contest its
accuracy.
Right to data portability: Receive your data in a structured, machine-readable format and transfer it elsewhere (where processing is based on consent or contract).
Right to object: Object to processing based on legitimate interests or for direct marketing
purposes.
Right to withdraw consent: Withdraw consent at any time where we rely on consent to process your data.
Right to complain: If you are in the EEA, you have the right to lodge a complaint with Datatilsynet (www.datatilsynet.dk) or the supervisory authority in your EEA country of residence or place of work. If you are located outside the EEA, your country may have its own data protection authority; we encourage you to raise concerns with us directly in the first instance, and we will direct you to the appropriate authority where one exists in your jurisdiction.
Right re. automated decisions: We do not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects. If this changes, we will update this notice and tell you about your rights.
These rights are not absolute. Where we are required to retain personal data to meet legal obligations or certification scheme requirements, or to establish or defend legal claims, we may not be able to action a request in full. We will always explain our reasons.
We will not charge a fee for requests made in good faith. We may ask you to verify your identity before processing your request. Where a request is complex or involves searching across multiple systems, we may extend the response period. If we need to do so, we will let you know and explain why.
Cookies
Our website uses cookies and similar technologies. Cookies are small files stored on your device that help us make our website work and allow us to understand how it is used. Some cookies are strictly necessary for the website to operate and cannot be disabled. Other cookies, including those used for analytics, enhanced functionality, and marketing, are activated only with your consent.
You can manage your cookie preferences through the cookie consent banner on our website or via your browser settings. For full details, please see our Cookie Policy, available at www.preferredbynature.org.
How we protect your data
We take data security seriously. Our technical and organisational measures include:
- Encryption of data in transit (TLS/SSL) and at rest
- Role-based access controls and multi-factor authentication
- Regular security patching, vulnerability assessments, and audits
- Mandatory data protection training for all staff
- Confidentiality obligations in all employment and supplier contracts
- Data Protection Impact Assessments (DPIAs) for high-risk processing activities
In the event of a data breach that is likely to affect your rights and freedoms, we will notify Datatilsynet within 72 hours and inform you without undue delay where required by law.
Changes to this notice
We may update this Privacy Notice from time to time to reflect changes in how we process personal data or changes in applicable law. The effective date at the top of this document shows when it was last revised.
Where we make material changes, we will notify you by email or by a prominent notice on our website. We encourage you to check this page periodically.
Questions or concerns?
If you have any questions about this Privacy Notice or how we handle your personal data, or if you wish to exercise any of your rights, please contact our Data Protection Lead:
Name: Data Protection Lead, Preferred by Nature
Email: dataprotection@pbn.org
Post: Preferred by Nature, Skindergade 23, 3., 1159 Copenhagen K, Denmark
Response time: We aim to acknowledge to all enquiries within 5 working days
You also have the right to complain directly to Datatilsynet at any time:
Authority: Datatilsynet (Danish Data Protection Authority)
Website: www.datatilsynet.dk
Email: dt@datatilsynet.dk
Telephone: +45 33 19 32 00
Download the Policy Notice file here.