Privacy Policy

Privacy Policy — LUP4LDN

Version 1.0 · Last updated: 27 August 2026

This policy explains what personal data the LUP4LDN platform (landusetool.org and app.landusetool.org) collects, why, and how it is handled.

The data controller is:
SCiO Private Company (SCiO P.C.)
P. Grigoriou and Neapoleos Str., GR-15310, Agia Paraskevi, Greece
lup4ldn@scio.systems

If you run your own copy of LUP4LDN. LUP4LDN is open-source software, published under the GNU General Public License v3.0. This policy covers only the instances SCiO operates at landusetool.org and app.landusetool.org. If you deploy LUP4LDN on your own infrastructure, you — not SCiO — are the controller of the personal data in that instance, and you are responsible for your own privacy notice.

1. What we collect

  • Account information: first name, last name, and email address, provided when you register.
  • Usage data: the land-use planning projects, scenarios, and inputs you create or upload within the tool, associated with your account.
  • Technical data: standard web server logs (IP address, browser type, access times) collected automatically for security and reliability.

We do not knowingly collect any special category data (for example health, biometric, or similarly sensitive personal data) through LUP4LDN.

2. Cookies and similar technologies

LUP4LDN uses only strictly necessary cookies and equivalent browser storage: those required to keep you signed in and to maintain the security of your session. We do not use advertising cookies, cross-site trackers, or third-party analytics that profile individual users. Because these cookies are strictly necessary to deliver a service you have asked for, we do not ask for consent to set them; you can block them in your browser, but the tool will not work without them.

3. Why we collect it

  • To create and secure your account, and authenticate you.
  • To provide the core functionality of the tool: saving, retrieving and managing your planning projects, and enabling the collaborative workflow in which a project owner invites participants and participants review each other’s proposals.
  • To communicate with you about your account or in response to support requests sent to lup4ldn@scio.systems.
  • To understand aggregate usage of the tool, so we can maintain and improve it, and report anonymised and aggregated usage statistics to funders and partners (UNCCD, GEO-LDN, FAO). We do not share your individually identifiable data with third parties for this purpose.

4. Legal basis for processing

  • Contract: processing your account and project data is necessary to provide the service you asked for, including where you use LUP4LDN under a specific piloting agreement (for example Tunisia, Burkina Faso, Senegal).
  • Legitimate interest: technical and security logs, and aggregate, de-identified usage analysis to maintain and report on the tool.
  • Consent: any optional communications, where used. You can withdraw consent at any time, without affecting processing carried out before you withdrew it.

5. Who we share data with

  • Infrastructure providers: LUP4LDN runs on Amazon Web Services (AWS Lambda, S3, and related services) for hosting, storage and processing, and uses SendGrid for transactional email delivery. Both act as processors on our instructions, under written data processing terms.

We do not sell personal data, and we do not share individually identifiable account data with third parties for marketing purposes.

6. International transfers

LUP4LDN is hosted in the eu-central-1 (Frankfurt, Germany) AWS region, inside the European Union. Where a processor we use may access or transfer personal data outside the European Economic Area — for example where a provider’s support or delivery infrastructure is located elsewhere — that transfer is covered by the European Commission’s Standard Contractual Clauses, or by another transfer mechanism recognised under Chapter V of the GDPR. You can ask us for details of the safeguards in place by writing to lup4ldn@scio.systems.

7. Data retention and deletion

  • While your account is active, we keep your account and project data.
  • If you ask us to delete your account, we will do so within one month of your request. Where a request is genuinely complex, we may extend that period by up to two further months, and we will tell you within the first month if we need to.
  • If your account is inactive for 24 months, we will delete or anonymise your personal data. Where project content is shared with other members of a planning team, we anonymise your association with it rather than destroying the team’s work.

We may keep data for longer only where we are required to in order to comply with a legal obligation or to establish, exercise or defend a legal claim.

8. Your rights

Depending on your location, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at lup4ldn@scio.systems. We will respond within the time required by applicable law — under the GDPR, normally one month.

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with a data protection supervisory authority. Our lead authority is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, GR-11523 Athens — www.dpa.gr. You may also complain to the supervisory authority where you live or work.

9. Security

We apply reasonable technical and organisational measures to protect your data, including authenticated access and cloud infrastructure with access controls.

If you believe you have found a security vulnerability, please report it responsibly under our security policy — email lup4ldn@scio.systems and do not open a public issue. You should expect an acknowledgement within five business days. Please do not send vulnerability reports as privacy enquiries.

10. Changes to this policy

We may update this policy as LUP4LDN evolves. Material changes will be noted on this page with an updated version number and “Last updated” date.

11. Contact

Questions about this policy or your data:
Dr. Panagiotis Zervas, COO, SCiO
lup4ldn@scio.systems