Privacy Policy

Personal data we process

• Account data, including username, business email address, password in hashed form, email-verification status, account role, and account status.
• Company-profile data, including company name, industry, company size, address, map coordinates, and optional professional profile information.
• Marketplace and learning-material content, including listings, descriptions, quantities, locations, contact details that a user chooses to publish, images, documents, and related activity.
• Communications and verification data, including verification emails, requests sent to administrators, and information used to review a user-company connection.
• Chatbot content, including questions, recent conversation context, and generated answers while a chatbot session is active.
• Technical data needed to operate and protect the service, such as IP address, request time, browser information, session identifiers, and security or error logs.

Please do not submit special-category personal data, confidential business information, passwords, financial details, or information about another person unless it is necessary and you are authorised to provide it.

Why we process data and our legal bases

• To create and administer accounts, verify email addresses, provide marketplace and materials features, display requested maps, and deliver the service requested by users. This processing is necessary to provide the platform and perform our agreement with the user.
• To protect accounts, prevent misuse, maintain service reliability, respond to support requests, and manually review user-company connections. We rely on our legitimate interests in operating a trustworthy and secure business platform, balanced against user rights.
• To send information or make optional profile and contact details visible when the user deliberately requests that feature. Where consent is the applicable basis, it can be withdrawn at any time without affecting earlier lawful processing.
• To comply with legal obligations and respond to lawful requests from public authorities where applicable.

Providing the fields marked as required is necessary to create an account or use the relevant feature. Without them, SymbioTech may be unable to provide that part of the service. Optional fields can be left blank.

Who can see platform information

General public pages and a marketplace overview may be available without an account. Detailed marketplace information, My Data, Dashboard, and Materials are restricted to registered users or appropriate roles. Visibility depends on the feature and the choices made when publishing content.

Platform administrators can access information when necessary for account support, moderation, security, verification, and platform maintenance. Optional contact details are not made public by default and are displayed only in the contexts described by the relevant feature.

AI chatbot and Ollama Cloud

The SymbioTech chatbot provides guidance about the platform and Industrial Symbiosis. It does not make account, verification, marketplace, employment, credit, or other decisions about users.

When a user sends a chatbot message, SymbioTech sends the message, recent chat context, and fixed platform guidance to Ollama Cloud so that a response can be generated. SymbioTech does not automatically add the user's account profile, company record, or contact details to that request. Personal data typed into the chat by the user will, however, be included in the request.

SymbioTech keeps recent chatbot messages in the platform session so that the conversation works and allows the user to clear the chat. SymbioTech does not sell chatbot content or use it for advertising.

Ollama states that cloud prompts and responses are processed transiently to provide the service, are not used to train AI models, and are not retained beyond the time needed to fulfil the request. Ollama may process limited account, device, security, and usage metadata under its own privacy policy. Ollama states that cloud compute is hosted primarily in the United States and may be routed to Europe or Singapore.

Users should not enter sensitive personal data or confidential business information into the chatbot. AI answers may be incomplete or incorrect and should not replace professional advice or human judgment.

Read Ollama's Privacy Policy ↗

Service providers and other recipients

We share personal data only when needed to operate the platform, when the user requests a feature, or when required by law. Current recipients may include:

• Ollama and its cloud infrastructure partners for chatbot response generation.
• World4You for production email delivery and related technical email logs.
• OpenStreetMap Foundation services for map tiles, address search, and reverse geocoding. Requests to these services may disclose the user's IP address, browser or device information, requested map area, search text, coordinates, date, and time to the service provider.
• The unpkg content-delivery network for loading the Leaflet map software used by the current site. The request may disclose technical connection data such as IP address and browser information to the network provider.
• The hosting, database, storage, and technical-support providers used to run and secure the platform.
• Public authorities or professional advisers where disclosure is required by law or necessary to establish, exercise, or defend legal claims.

OpenStreetMap asks users not to submit personal or confidential material to its search services. Company addresses entered into address search may be transmitted to Nominatim. Read the OpenStreetMap Foundation Privacy Policy ↗

International data processing

Some service providers may process data outside the European Economic Area. In particular, Ollama states that its cloud compute is primarily in the United States, with possible routing to Europe or Singapore, and that it uses appropriate safeguards for international transfers where required by law. Users can contact us for available information about applicable safeguards.

Cookies and browser storage

SymbioTech currently uses only cookies and browser storage needed for security, requested functionality, and user preferences. It does not currently use advertising cookies, marketing pixels, cross-site tracking, or optional analytics cookies.

These technologies are not used to build advertising profiles or sell information. Because they support security or functionality explicitly requested by the user, they are active without a separate consent banner. If optional analytics or marketing technologies are introduced later, this notice and the consent controls must be updated before those technologies are activated.

How long data is kept

• Account and company-profile data is generally kept while the account remains active and for a limited period afterwards where needed to complete deletion, resolve disputes, protect the service, or meet legal obligations.
• Marketplace content, uploaded images, and learning materials are kept while they remain active or are needed for the platform purpose, and are removed or anonymised when the related content or account is deleted unless retention is required.
• Chatbot history is associated with the Django session and is available until the user clears the chat or the session expires, normally up to 14 days after the latest relevant activity.
• Email and security logs are kept for the period needed for delivery, troubleshooting, abuse prevention, and legal compliance. Records held by service providers follow the provider's applicable retention policy.
• Rejected-account information may be retained temporarily so that a decision can be explained, reviewed, corrected, or disputed, and is then deleted or anonymised unless a longer period is legally required.

The exact period may vary where a legal obligation, active dispute, security incident, backup cycle, or valid deletion request applies. Data that is no longer required is deleted or anonymised.

Your data-protection rights

Subject to the conditions in applicable law, users may request:

• Access to personal data and information about how it is processed.
• Correction of inaccurate or incomplete personal data.
• Deletion of personal data, or restriction of processing.
• A portable copy of data provided by the user where the right to data portability applies.
• Objection to processing based on legitimate interests.
• Withdrawal of consent at any time where processing is based on consent.

To exercise a right, contact us using the address above. We may need to verify the requester's identity. Users also have the right to lodge a complaint with the data-protection supervisory authority in the country where they live or work, or where the alleged infringement occurred.

Automated decisions and AI limitations

SymbioTech does not use the chatbot to make decisions that produce legal or similarly significant effects. User-company verification is reviewed by human administrators. Users can contact the administrators to question or correct a verification decision.

Security

SymbioTech uses organisational and technical measures intended to protect personal data, including password hashing, encrypted network connections in production, access controls, CSRF protection, and role-based restrictions. No system can guarantee absolute security, and users should use a strong, unique password and avoid sharing sensitive information unnecessarily.

No sale of personal data

SymbioTech does not sell or rent personal data, does not use it for behavioural advertising, and does not operate the platform to profit from user tracking. Data is processed to provide, secure, maintain, and improve the platform and to meet applicable legal obligations.

Changes and contact

This notice may be updated when platform functionality, service providers, retention practices, or legal requirements change. Material changes should be communicated through the platform or by another appropriate method, and the date at the top of this page will be updated.

For privacy questions, requests, or concerns, email info@symbiotech-platform.eu or use the Contact page.