Privacy policy
Version 1.0, effective 14 October 2026.
1. Who we are
TimberTrail by Kaudata ("TimberTrail", "the service") is a service of KAUDATA d.o.o., Kidričeva cesta 2 B, 3320 Velenje, Slovenia, registration number 8948925000, VAT number SI 76817008 ("KAUDATA", "we", "us"). It helps organisations in the wood sector prepare and check due diligence statements and simplified declarations under Regulation (EU) 2023/1115 on deforestation-free products (the "EUDR") and file them in the EU Information System, including as an authorised representative under Article 6 of that regulation.
This policy covers the platform at https://platform.timbertrail.si, including its connection for AI assistants at https://platform.timbertrail.si/api/mcp. It explains what personal data the service holds, why, who receives it, how long it is kept, and what rights you have.
The contact for everything in this policy is info@kaudata.si. KAUDATA has not appointed a data protection officer.
2. Who decides about the data
The service is provided to organisations under a contract with KAUDATA (the "customer"). There is no self sign-up: KAUDATA creates the customer's organisation and its first administrator, and the administrator invites colleagues.
The customer decides about the data its users put into the service. That covers its organisation details, its users' accounts, and everything it records about its supply chain: suppliers, producers (often forest owners who are natural persons), plots and their geolocation, felling decisions of the Slovenia Forest Service (ZGS), Article 6 mandates, products, statements and their records. For this data the customer is the controller. KAUDATA processes it on the customer's behalf as its processor under Article 28 of Regulation (EU) 2016/679 (the "GDPR") and, where the customer appoints it by a written mandate, as its authorised representative in the EU Information System.
KAUDATA decides about the data it needs to run its business and the service itself: the contact details of the people it deals with at a customer, messages sent to it for support or about security, the technical records it keeps to protect the service, and the measurement of how the service's pages are used (section 9). For this data KAUDATA is the controller.
If a customer has recorded data about you, for example as a forest owner or as a supplier's contact person, the customer is the first place to ask about it. You can also write to us, and we will pass your request on.
3. What the service holds
| Data | What it includes | Decided by |
|---|---|---|
| Organisation | name, registration and tax numbers, EORI number, address, e-mail address and telephone number, size and class under the EUDR | the customer |
| User accounts | name, e-mail address, role, whether the account is active, time of the last sign-in; the password only as a one-way hash; the optional second factor's secret and the hashes of its unused recovery codes, both encrypted | the customer |
| Suppliers | name, identifier, address, e-mail address, telephone number, notes | the customer |
| Producers | name, country, the supplier they belong to, notes; a producer is often a forest owner who is a natural person | the customer |
| ZGS felling decisions | decision number, dates, issuing unit, the forest owner's name, cadastral municipality and parcel numbers, volume, the content of the QR code, the scanned document | the customer |
| Plots and geolocation | name, the geometry exactly as supplied and as converted for filing, area, the results of the checks | the customer |
| Article 6 mandates | the principal's name, identifier, address, e-mail address and telephone number, the scope and dates of the mandate, the signed document | the customer |
| Products, statements and declarations | products, commodities, quantities, tree species, the producers and plots a statement names, reference and verification numbers, statuses, the requests sent to the EU Information System and its answers stored exactly as exchanged, reference numbers received from upstream suppliers, templates and import profiles | the customer |
| EU access keys | the EU Login user name, the authentication key (encrypted), the web service client identifier, and the name and e-mail address of the person responsible for the key | the customer |
| Audit log | who did what and when, whether it was done on a screen or through a connected AI app (and which app), and the content sent to and received from the EU Information System with credentials removed | the customer |
| Notifications | notices about deadlines and statements, and whether they have been read | the customer |
| AI app connections | see section 6 | the customer |
| Support and security messages | what you write to info@kaudata.si and our replies | KAUDATA |
The application does not store IP addresses. It uses them briefly, in memory, to limit repeated password-reset requests, attempts to use an invitation or password-reset link, and registrations of AI apps. The hosting platform records requests to the service (time, address requested, IP address, browser) in its logs, together with the application's own operational messages (section 7).
4. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Preparing, checking and filing statements and declarations, and keeping the records the EUDR requires | On the customer's behalf. The customer relies on its legal obligations under the EUDR (Article 6(1)(c) GDPR) and on its contracts. |
| Filing as authorised representative under Article 6 EUDR | On the customer's behalf, under the customer's written mandate, and KAUDATA's own duty to produce the mandate to the competent authority on request (Article 6(1)(c) GDPR). |
| User accounts, sign-in, roles, the second factor and the audit log | On the customer's behalf, as part of the service it contracted for. |
| Service e-mails: invitations, password-reset links and warnings about deadlines | On the customer's behalf, as part of the service. |
| The AI assistant connection | On the customer's behalf and on the instruction of the user who connects an app, where the customer's organisation has the connection switched on. |
| Managing the contract with the customer and dealing with its contact people | Our legitimate interest in running the business relationship (Article 6(1)(f) GDPR). |
| Answering support requests and security reports | Our legitimate interest in helping customers and keeping the service secure (Article 6(1)(f) GDPR). |
| Protecting the service: limiting repeated attempts, keeping technical logs | Our legitimate interest in the security of the service (Article 6(1)(f) GDPR). |
| Measuring how the pages are used | Our legitimate interest in seeing which content is used and improving the service (Article 6(1)(f) GDPR). You can object at any time (section 9). |
| Establishing, exercising or defending legal claims, and meeting legal obligations that apply to KAUDATA | Article 6(1)(f) and Article 6(1)(c) GDPR. |
The service checks data and suggests how a business is classified under the EUDR, but it takes no decision that has legal effects for a person. A user in the customer organisation decides what is filed, and files it.
5. Who receives data
We do not sell personal data and do not use it for advertising. It reaches the following recipients and no one else.
| Recipient | What, and why | Role |
|---|---|---|
| European Commission, EU Information System | Each statement or declaration a user files: the operator or authorised representative, products, quantities, species, producers, the geolocation of plots, references. Filing is the purpose of the service. | Recipient in its own right, under the EUDR |
| Competent authorities | In Slovenia, the Ministry of Agriculture, Forestry and Food (MKGP): on request, the signed Article 6 mandate (Article 6(2) EUDR) and the records it may ask for. Other authorities only where the law requires it. | Recipient in its own right |
| Hosts the service. Google Cloud: the application and its background job run on Cloud Run, and Cloud Scheduler starts the job on a schedule; the database runs on a managed database service of the same platform; uploaded documents are kept in Cloud Storage, the application's keys and passwords in Secret Manager, and request and application logs in Cloud Logging. Region: europe-west1 (Belgium). | Processor (our sub-processor) | |
| E-mail delivery | Invitations, password-reset links and warnings about deadlines, from the production installation only. They are sent by a mail server in Slovenia for KAUDATA's own domain; no e-mail service company is involved. | Processor (our sub-processor) |
| OpenStreetMap Foundation | When a screen shows a plot on a map, your browser loads the map images directly from tile.openstreetmap.org. It receives your IP address, your browser's details, the address of the platform and which map area is shown. | Independent, under its own policy |
| The provider of an AI app you connect | Only if your organisation has the connection switched on and you connect an app, for example Claude (Anthropic) or ChatGPT (OpenAI): what you ask the app to read, and what you give it to save (section 6). | Not our processor; it works for you or your organisation under its own terms |
| The network provider that carries traffic to our analytics server | The requests your browser sends to analytics.kaudata.si (section 9) | Carries the traffic only |
Personal data leaves the European Economic Area only in these cases: when your browser loads map images from OpenStreetMap Foundation, which is in the United Kingdom, a country for which the European Commission has adopted an adequacy decision; when you or your organisation give it to an AI app whose provider processes it elsewhere, under that provider's terms; and where Google or its sub-processors access the hosted data from outside the European Economic Area, which Google's data processing terms allow under the European Commission's standard contractual clauses. The hosting region and the mail server named above are both in the European Economic Area.
6. AI assistants
An organisation's users can connect an AI app, such as Claude or ChatGPT, so that the app can work in TimberTrail on their behalf through the Model Context Protocol (MCP). The connection is off for every organisation until KAUDATA switches it on for that organisation. How it works is described in the AI connector documentation.
Connecting. The user adds https://platform.timbertrail.si/api/mcp in the AI app, signs in to TimberTrail with their own e-mail address and password (and a code, if they use a second factor), and chooses Dovoli (allow) on a screen that shows the app's name, the address it returns to, the user, the organisation, the user's role and the EU system statements are filed into. The AI app never sees the password. It acts with the user's role and never with more.
What the AI app sends to us. Calls to the service's tools, with the arguments the assistant fills in from the conversation: for example a supplier's or producer's details, plot geometry as text (GeoJSON or CSV), and documents such as a signed mandate or a scanned ZGS decision as base64, up to 11 MB each. What it saves is stored like anything entered on a screen.
What we send back to the AI app. The results of those tools: the records asked for, which can include personal data of producers and forest owners, the contact details of suppliers and mandate principals, the name and e-mail address of the person responsible for an EU access key, entries from the audit log, and the user's own name and e-mail address. Results never include passwords, EU authentication keys, second-factor secrets or access tokens.
The AI provider. What the AI app receives becomes part of the user's conversation with that app. The app's provider processes it under the terms between the provider and the user or the user's organisation, and decides where and for how long it is kept. It is not KAUDATA's processor. The customer decides whether its users may give its data to an AI app; KAUDATA switches the connection on for an organisation and can switch it off.
What we keep.
- The AI app's registration: the name the app gives itself and the addresses it may return to. A registration that never led to access is deleted once it is more than 24 hours old, the next time an app registers.
- Each connection: which user, which organisation, which app, when access was allowed, when it was last used, and when and why it ended. Access and refresh tokens are stored only as SHA-256 hashes.
- The audit log marks every change made through an AI app with the app's name and the connection.
- For a filing confirmed through an AI app, a fingerprint of the confirmation. It is deleted once it is more than 24 hours old, the next time someone in the same organisation confirms a filing.
- The application's log records each tool call by tool name, outcome, duration and organisation. It does not record the arguments or the results.
How long access lasts, and how to end it. Access through a connection ends 90 days after the user chose Dovoli (allow), however actively it is used; the user then connects again. It ends earlier if the app does not use it for 30 days, when the user changes their password, when the user's account or organisation is deactivated, when KAUDATA switches the connection off for the organisation, or when it is removed:
- in TimberTrail, on the AI-pomočnik (AI assistant) page, with Odstrani dostop (remove access); an organisation's Skrbnik (owner) can remove any user's connection;
- in the AI app, by removing the connector, which the app may report to us.
Signing out of TimberTrail does not end access. The records of a connection that has ended are kept with the organisation's records (section 7).
7. How long data is kept
- The organisation's records, everything in section 3 decided by the customer, are kept while the customer's contract lasts. The service deletes nothing automatically. Users with the right role can delete many records themselves; a record that a filed statement depends on, such as a plot named in it, cannot be deleted.
- Statements, declarations and their exchanges with the EU Information System. The EUDR requires the operator to keep them for 5 years. The service keeps them and has no function that deletes them.
- The audit log is append-only. The application cannot change or delete an entry, and the database refuses it. When a record is deleted, the entry recording the deletion stays, and it can contain the record's name.
- User accounts are deactivated, not deleted, because the audit log names the people who acted. A deactivated user cannot sign in.
- Uploaded documents are kept until a user removes them or deletes the record they belong to. Removing one takes it out of the service at once; its stored file is kept as a protected copy for up to 6 years, so that evidence a filed statement relied on survives a mistaken removal, and is then deleted.
- When the contract ends, the service has no function that deletes or returns an organisation's data as a whole. What happens to it then is agreed in the customer's contract.
- AI app connections: as described in section 6.
- Technical logs at the hosting platform are kept for 30 days, after which the platform deletes them.
- Page-view measurement: records of individual visits are deleted at the latest after 25 months (section 9).
- Messages to info@kaudata.si are kept as long as needed to deal with the matter and with any claim arising from it.
8. How the data is protected
- The service is reached over an encrypted connection (HTTPS), and its sign-in cookies are sent only over such connections.
- Passwords are stored only as one-way hashes (scrypt).
- A second factor, a code from an authenticator app, is available to every user and optional. Its secret is stored encrypted, and recovery codes are issued with it.
- EU access keys are encrypted with AES-256-GCM, each under its own data key, which is encrypted under a master key kept outside the database. A key is decrypted only to sign a request to the EU Information System, is never shown again after it is saved, and cannot be read or changed through an AI app.
- A sign-in lasts at most 12 hours. Changing a password ends every session and every AI app connection of that user.
- Invitation links, password-reset links and AI app tokens are stored only as hashes.
- Every read and every change is limited to the signed-in user's organisation, and four roles decide who may prepare, who may file and who may only read.
- Uploaded documents are kept in private storage. A document can be downloaded only after the session and the organisation have been checked, through a link valid for 5 minutes.
- The audit log cannot be changed or deleted by the application.
- Repeated password-reset requests, second-factor codes and attempts to use a link are limited.
9. Cookies, browser storage and page-view measurement
The service sets only the cookies it needs to work:
| Cookie | Purpose | Lifetime |
|---|---|---|
| kaudata_session | keeps you signed in | 12 hours |
| kaudata_2fa | holds a sign-in between the password and the code | 5 minutes |
| kaudata_oauth_pending | holds an AI app's connection request while you sign in | 10 minutes |
| kaudata_oauth_handoff | returns you to the AI app after you choose Dovoli (allow) | 2 minutes |
| mtm_consent_removed | records that you object to page-view measurement | set only when you object, removed when you withdraw the objection |
KAUDATA's own staff sign in to a separate area with two cookies of their own, kaudata_platform and kaudata_platform_2fa. There are no advertising or tracking cookies. Your browser's local storage keeps your display preferences, such as the colour theme, the layout of tables and whether you have seen the guided tour; they are not sent to us.
Page-view measurement. If the installation you use measures visits (the page /analitika says whether it does), it uses Matomo, which KAUDATA runs itself at analytics.kaudata.si on its own servers. The data is shared with no one; requests to the analytics server pass through the network provider that carries its traffic. Matomo uses no cookies. For each page view it records the page's address and title, the page you came from, the time, your browser, operating system, device type, screen size and language, and your approximate location (country, region and town), determined from your IP address. Only a shortened IP address is stored: the last two of the four parts of an IPv4 address, and all but the first three of the eight groups of an IPv6 address, are removed. Page addresses are reduced to the kind of page before they are sent, so no identifier of a record reaches the analytics server. Records of individual visits are deleted at the latest after 25 months; aggregated statistics that no longer relate to anyone are kept. You can object at any time with the switch on /analitika; your browser then keeps one cookie, mtm_consent_removed, which records only that choice.
10. Your rights
You have the right of access to your personal data, to rectification, to erasure, to restriction of processing, to data portability and to object (Articles 15 to 22 GDPR), and the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec).
For data a customer holds about you, the customer decides on your request. Write to the customer, or to us, and we will pass the request on and help the customer answer it. For data KAUDATA decides about, write to info@kaudata.si. We answer a request within one month of receiving it. Where requests are complex or numerous, that period can be extended by up to two further months, and we tell you if it is.
The EUDR obliges operators to keep their due diligence records, so a request for erasure may not extend to them (Article 17(3)(b) GDPR).
11. Changes to this policy
When this policy changes, the version and the date at the top change with it. The current version is always at /privacy.
12. Contact
KAUDATA d.o.o., Kidričeva cesta 2 B, 3320 Velenje, Slovenia. E-mail: info@kaudata.si. Company details are in the imprint; security vulnerabilities are reported as described on the security page.