Minimise Registry Platform Privacy Policy

Effective Date: August 5, 2026
Last Updated: August 5, 2026

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application (registry.minimise.today) as an account holder or otherwise interact with our registry services.

1. Important Information and Who We Are

Data Protection Roles under the GDPR

Under the EU General Data Protection Regulation (GDPR), the role we play depends on the type of data we are handling:

• Minimise as a Data Controller: We act as a Controller for the personal data of visitors to our registry platform, registered account users, and anyone who submits feedback or support requests directly to us. This includes account setup information, login credentials, support ticket communication, and telemetry data.
• Minimise as a Data Processor: We act as a Processor for any data that our users upload, store, or process within the platform, including organizational information, supplier/PRO contact networks, materials inventory, and transaction logs. If you enter third-party personal data into our platform, your Organization is the Controller of that data.
• Minimise as a Controller for funded projects: Where Minimise funds a project, we also act as a Controller for the limited purpose of verifying and accounting for that funded activity. This can include retaining records that evidence funded activity — including related proof documents and logistics and shipping records — for that purpose. Our legal basis is our legitimate interest in the integrity and accountability of the funding (together with any applicable legal or contractual obligations), and we keep such records only as long as necessary for that purpose.

User Accounts Created by Organizations

Registered accounts on our platform are linked to an Organization. Your account may be created directly by us, or it may be created and provisioned on your behalf by an administrator within your Organization. While your Organization controls who is granted access and manages active permissions, Minimise acts as a Controller for the essential technical credentials and session authentication logs required to keep your account secure and operational.

Data Controller

The controller responsible for the personal data for which Minimise acts as Controller is:
Minimise GmbH
Meyerbeerstr. 35
13088 Berlin, Germany

Contact Details

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:
Email: hello@minimise.today

Your Right to Lodge a Complaint

In accordance with Art. 13(2)(d) and Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The authority competent for Minimise is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59–61, 10555 Berlin, Germany.

2. The Data We Collect, Purposes, and Legal Bases

We collect different types of personal data depending on how you interact with our platform.

A. Platform Visitors and Technical Telemetry

When you visit or use our web application, we automatically capture technical logs to keep our platform secure and operational.

• Data Collected: IP addresses, browser user-agent strings, sign-in times, and preferred language settings.
• Purpose: Error tracking, system telemetry, maintaining security logs, and preventing fraud.
• Legal Basis: Legitimate Interests (Art. 6(1)(f) GDPR): We have a legitimate technical and security interest in ensuring our platform remains operational and safe.

B. Registered Account Users and Support Requests

When you sign up for an account to use Minimise, or contact us for help, we collect information required to deliver our services and assist you.

• Data Collected: Name, email address, phone number, authentication session data, and support submissions, which can include screenshots and error descriptions you submit via our Registry feedback form.
• Purpose: To manage your account, authenticate sessions, communicate platform updates, and resolve technical bugs or support issues.
• Legal Basis: Performance of a Contract (Art. 6(1)(b) GDPR) and Legitimate Interests (Art. 6(1)(f) GDPR): This data is necessary to fulfill our Terms and Conditions and help resolve platform errors.
• Note on Screenshots: When submitting a bug report or screenshot, please ensure you do not capture sensitive or unrelated personal data.

C. Data We Process on Your Behalf (Processor Data)

Your organization uploads and processes operational logistics through our platform, and Minimise processes it strictly under your instruction:

• Data Types: Organization addresses; material inventory data (incoming/outgoing transactions, scale weights, and logistics details); third-party contact records; and photos of waste/materials on a scale.
• Purpose: To operate platform features, track inventory, and run automated image-categorization tools.
• Legal Basis: Governed by the customer-facing processor terms within our Terms and Conditions.

3. Cookies and Tracking Technologies

Minimise takes a deliberately minimal approach to tracking. We do not use non-essential marketing, tracking, or profiling cookies, and we do not run session replays. Consequently, no cookie consent banner is legally required.

We only use the following consent-exempt cookies and tracking mechanisms:

Beyond cookies, we use the following consent-exempt on-device storage strictly to make the application function:

• IndexedDB and Cache Storage: store offline draft entries, uploaded files, and cached pages so the registry works without a connection.
• Local and session storage: remember minor interface state (such as whether a panel was opened).

These storage technologies hold no marketing, advertising, or tracking data.

4. Third-Party Sub-processors and International Transfers

To deliver our platform features, we share data with selected third-party service providers (our sub-processors). The table below is our authoritative sub-processor list: every party Minimise engages appears here, and our internal records reference this list rather than restating it. Where a provider is located outside the European Economic Area (EEA), we ensure appropriate safeguards, such as Standard Contractual Clauses (SCCs), are in place to legally protect your data.

Google Maps Platform (Geocoding) is not a sub-processor: for the address strings it receives it acts as an independent data controller under its own controller-to-controller terms. Transfers to Google (US) are covered by Standard Contractual Clauses (Art. 46 GDPR); we share only the address string — no account identifiers.

Data Residency and International Transfers

Your data is stored and primarily processed in the selected EU region. Administration, support, operational telemetry and content delivery may, however, occur outside that region. Standard Contractual Clauses (SCCs) are the safeguard for those transfers.

Vendor Support Access

When requesting support from our platform vendors, Minimise does not share customer records, personal data or live database contents with them. Should a support case ever require it, we will ask the affected customer first.

Supabase personnel outside the EEA may access platform data for administration, support and incident response under least-privilege, need-to-know controls, and such access is logged.

5. Data Retention Schedules

We only retain personal data for as long as necessary to fulfill the purposes for which we collected it, including satisfying legal, accounting, or reporting mandates.

• Active Account Data (PROs and Suppliers): Kept for the duration of your active platform relationship.
• Disabled User Accounts:Because Minimise is a multi-user organizational platform, if an individual user account is disabled but their associated Organization remains active, that user's historical actions, log entries, and inventory records are retained to maintain the integrity of the Organization's operational history.
• Consent Grants and Legal Acceptances: Records of your agreement to our Terms and Conditions, Privacy Policy, and other legal consents are retained for the duration of your account and are deleted when your account is erased.
• Terminated Organizations: If an entire organization terminates its relationship with Minimise, all associated account and inventory data is retained for up to 12 months for administrative closure before being permanently deleted, unless legal or tax obligations require longer preservation. Following termination, Supabase removes its own copies after a 30-day period.
• Backup Archives: Because we keep weekly encrypted storage backups, data you delete can persist in those archives for up to 7 weeks before the archive holding it is rotated out.
• Support and Feedback Emails: Any emails, bug reports, or screenshots sent to hello@minimise.today are deleted after 2 years from the resolution of the ticket.
• Platform Logs and Audit Entries:Security and change-history logs (IP addresses, sign-in times, and record change-history) are kept only as long as necessary for security and integrity — the change-history audit is retained for the lifetime of your organization and purged when the organization's data is deleted. When you erase your account, your identifying details are removed from these logs (or the entries deleted) even where the log itself is retained.
• Photos of Waste/Materials (Processor Data) In Funded Projects: Photos of materials uploaded for funded projects, and only those, are sent to OpenRouter (United States), which routes them to DeepInfra (United States) for automated categorization; uploads for other project types are never processed this way. OpenRouter is configured so that providers neither store the images nor use them for training, and the images are processed transiently and not retained.

6. Your Data Subject Rights (DSR)

Under the GDPR, you have specific, enforceable legal rights regarding your personal data.

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct incomplete or inaccurate data.
• Right to Erasure (Right to be Forgotten): You can ask us to delete your personal account data under certain conditions.
• Right to Restrict or Object to Processing: You can object to our processing or request that we suspend processing your data.
• Right to Data Portability: You can request a structured, machine-readable export of your personal configuration data.

How to Exercise Your Rights

To exercise any of these rights, please email us at hello@minimise.today. We will respond directly to all Controller requests within one month.

Important note for third-party contacts: If your personal information was uploaded to Minimise by one of our customer organisations (a PRO or Supplier) or a user acting on its behalf, Minimise acts strictly as a Processor. We cannot fulfill your request directly. Please route your data request to the specific user or company controlling your data, and we will assist them in executing it.

7. Data Security and Breach Notification

Security Measures

We implement comprehensive technical and organizational safeguards to secure your information. This includes application-layer role-based access control (RBAC) that scopes data to your organization, database access via a privileged service account, and encryption of data both at rest and in transit. Uploaded documents are held in a private storage bucket and are never publicly reachable; each view is served through a short-lived signed link generated only after we have checked that the requester is entitled to that organization's data.

Data Breach Protocol

In the event of a security incident affecting your personal data, we follow strict statutory notification procedures:

• Where Minimise is the Data Controller: If a breach presents a high risk to your rights, we will notify the appropriate Data Protection Authority within 72 hours of becoming aware, and notify affected users directly without undue delay.
• Where Minimise is the Data Processor: If a breach affects data uploaded by you, including contacts, organization details, or inventory logs, we will notify you, the Controller, without undue delay so that you may inform your users and regulators accordingly.