Scope
This Notice applies to personal data processed by the Company in connection with enquiries made through land-art.space, purchases of Trees, partnership agreements, and use of the website.
Defined terms have the meanings given in clause 1 of the Terms of Purchase.
Categories of data processed
Enquiries. Name; email address or telephone number; the content of the enquiry.
Purchases. Name of the individual or legal entity; Registered Email; billing country; the name to be recorded against the Cell; and, for corporate purchasers, the contact person's name and position and the registration and tax particulars required to issue an invoice.
Payment. The Company neither receives nor stores card credentials. Card payments are processed by [payment service provider] and by the card schemes, from which the Company receives the transaction outcome, the amount and the last four digits of the instrument.
Website. Server logs recording IP address, user agent, pages requested and time of request. [Identify any analytics tool and what it measures; if none is deployed, substitute: "The Company deploys no analytics or advertising technology."]
Purposes and legal bases
The Company processes personal data only for the following purposes:
- to respond to and conduct correspondence arising from an enquiry — basis: consent;
- to record the Trees, issue the NFC card and certificate, record the name against the Cell and provide the annual growth report — basis: performance of the contract;
- to issue invoices and maintain the records required by Mongolian accounting and tax legislation — basis: legal obligation;
- to maintain the security and integrity of the website and the payment flow — basis: legitimate interests.
The Company does not use personal data for any purpose beyond those stated. It does not sell personal data, does not process it for advertising, and does not send marketing communications without prior request.
Disclosure
The Company does not disclose, sell, lease or otherwise transfer personal data to any third party, save to the following recipients and in each case to the minimum extent required:
- the payment service provider and the card schemes, for the purpose of effecting and settling payment;
- the website hosting and email providers — [identify];
- delivery services, being the name and address required to deliver an NFC card;
- professional advisers and auditors, where required for accounting, audit or legal advice;
- public authorities, where disclosure is compelled by law.
Certain recipients operate outside Mongolia. Where personal data is transferred abroad, the Company engages recipients affording an equivalent standard of protection and contracts for appropriate safeguards.
Publication of the recorded name
The name recorded against a Cell is published on the public cell map and may appear on the pavilion screen and in project reporting. That publication is an element of the contracted performance.
The data subject determines the form of the recorded name and may specify a given name only, initials, a dedication, or anonymity. Email address, telephone number, billing particulars and correspondence content are not published in any circumstances.
A recorded name may be altered or removed at any time on written request. Material already printed or broadcast cannot be recalled; every digital surface under the Company's control will be amended.
Retention
Enquiries. Two years from the last communication, whereupon the record is deleted, save where the enquirer places an Order, in which case clause 6.2 applies to the record from the date of Confirmation.
Purchase records. The Undertaking Period of ten (10) years from planting, together with the statutory accounting retention period. Retention for that term is necessary to perform the annual growth reporting obligation at clause 6.1(d) of the Terms of Purchase; erasure before its expiry would defeat that obligation. A data subject who requires erasure within that term may do so under clause 7, whereupon the Company is discharged from the reporting obligation for the balance of the term.
Accounting records. As required by Mongolian accounting and tax legislation.
Server logs. [period — typically 30 to 90 days].
Rights of the data subject
Under the Law on the Protection of Personal Information of Mongolia and, where applicable to a data subject in the European Economic Area or the United Kingdom, under the General Data Protection Regulation, a data subject may request access to, and a copy of, the personal data held; rectification of inaccurate data; erasure, save where retention is required by law; restriction of or objection to a particular processing operation; withdrawal of consent at any time; and receipt of the data in a portable, machine-readable form.
Requests shall be addressed to hello@shambala.today. The Company shall respond within thirty (30) days.
A data subject dissatisfied with the Company's response may complain to the competent supervisory authority in the data subject's country of residence or, in Mongolia, to the National Human Rights Commission.
Cookies
[Adopt one of the following and delete the other.]
Where no analytics are deployed. The website sets only those cookies strictly necessary to display pages and complete a payment. No advertising or tracking cookies are set and no consent banner is displayed.
Where analytics are deployed. In addition to strictly necessary cookies, the website uses [tool] to measure visits and page use. Consent is obtained through the banner displayed on first visit and may be withdrawn at any time.
Children
The website is directed to adults. The Company does not knowingly process the personal data of persons under sixteen (16) years of age.
Where a school or youth organisation participates in the Company's education programme, the Company acts through that institution and its own consent procedures, and publishes images of participants only with the consent of a parent or guardian.
Amendment
The Company may amend this Notice. The date in force is stated above. Where an amendment materially affects the processing of personal data already collected, the Company shall notify affected data subjects by email before the amendment takes effect.