Your data. Briefly.

Scope.

This policy covers the personal information we handle through acreage.co.za (and any subdomains we operate). It does not cover personal information we handle as part of a paid engagement with you — that sits inside your signed engagement letter, a separate data processing agreement, and our POPIA notice.

References to "we" or "Acreage" mean the Acreage joint venture entity. References to "you" mean anyone visiting or using the site.

The data, plainly.

2.1 We collect three things, and only when you choose to give them.

2.2 We do not collect: precise location, browsing history outside our site, financial information, identity numbers, or sensitive personal information of any kind.

The purpose.

3.1 Subscriber email. So we can send you the briefings you asked for.

3.2 Quote request details. So we can respond to your enquiry, prepare an accurate proposal, and stay in touch about it. If we end up working together, this information becomes part of the engagement record under our service terms.

3.3 Analytics. So we can build a better site — see which sections people read, which CTAs convert, where the structure is confusing. Because IPs are hashed before storage, this data cannot be tied to any individual person.

3.4 Our lawful basis under POPIA: consent (for subscriptions and quote requests, which you actively initiate) and legitimate interest (for hashed analytics, which we need to run the site well).

Storage and infrastructure.

4.1 Subscriber emails, quote request data, and analytics events are stored in a Supabase Postgres database in the Frankfurt region (eu-central-1). Supabase is our database provider; the infrastructure underneath is operated by Amazon Web Services in the European Union.

4.2 We chose an EU region because the EU data protection regime offers strong baseline protections and the cross-border transfer mechanism back to South Africa is well-established under POPIA. See our POPIA notice for the detail on cross-border transfers.

4.3 Data is encrypted at rest by the underlying infrastructure. Connections to the database are encrypted in transit (TLS 1.2+). Access to the database is restricted to named Acreage operators with audited credentials.

Retention.

5.1 Subscriber emails: we keep them until you unsubscribe or ask us to delete the record. We will not hold them indefinitely beyond purpose — if you haven't opened an email from us in 24 months, we'll send a final check-in and remove inactive records after that.

5.2 Quote request data: we keep it for as long as the conversation is live, and for up to 24 months after the last contact, in case you come back to us. After that we delete it unless you've become a client (in which case it moves into your engagement record).

5.3 Analytics events: we keep them for 90 days, then they're deleted. The hashed IP makes individual-level retention meaningless anyway.

5.4 Backups follow the same logic. We don't keep shadow copies forever.

Who else sees it.

6.1 Nobody, mostly. We do not sell personal information. We do not share it with marketing networks. We do not feed it into ad platforms.

6.2 The infrastructure providers below process data on our behalf, under contracts that bind them to the same protections we offer you:

• Supabase (database hosting, Frankfurt)
• Amazon Web Services (the underlying cloud Supabase runs on, Frankfurt)
• Vercel (website hosting and edge delivery)
• Resend or equivalent (transactional and briefing email delivery, if you've subscribed)

6.3 We may disclose information if we are legally required to (court order, regulator request, criminal investigation). We will tell you first if we lawfully can.

What you can ask us to do.

7.1 Under POPIA and as a matter of plain decency, you can ask us at any time to:

• See what personal information we hold about you
• Correct anything that's wrong or out of date
• Delete your record entirely
• Object to specific uses (for example, briefing emails)
• Withdraw consent you previously gave, without affecting anything we lawfully did before then
• Receive a copy of your data in a portable format

7.2 Email hello@acreage.co.za with the request and we'll action it within 30 days. No forms, no friction.

7.3 If you think we've handled your information badly and we haven't fixed it, you can complain to the South African Information Regulator. Details are in our POPIA notice.

None, for now.

8.1 This site does not set tracking cookies. We do not use Google Analytics, Facebook Pixel, or any third-party advertising tags. Analytics are first-party and IP-hashed.

8.2 If we add functionality in future that genuinely needs a cookie (for example, a logged-in client area), we will update this page and ask for consent at the point it matters.

Not designed for under-18s.

9.1 This is a B2B website aimed at commercial farming operations. We do not knowingly collect information from anyone under the age of 18. If you believe a child has submitted information through the site, email us and we will delete it.

If this changes.

10.1 When we update this policy meaningfully, we update the last updated date at the top and, if you're a subscriber, mention it in the next briefing. For material changes that affect how we use existing data, we will ask for fresh consent.