Privacy Policy

This Privacy Policy explains how Demeter Publishing Limited (“Demeter”, “we”, “us”, or “our”) collects, uses, stores and protects personal data.

If you have any questions about this policy or your data, you can contact us at [email protected].

This Privacy Policy applies to personal data we collect through our website at demeterdata.ag (including its subdomains), our newsletters, our downloadable reports and datasets, sign-up forms we use at events, and the Demeter platform.

We process personal data in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR"). Where we process the personal data of people in the European Economic Area, we also comply with the EU General Data Protection Regulation.

# 1.2 Data controller

Demeter Publishing Limited is the data controller responsible for your personal data. We have not appointed a data protection officer. Any questions about your data should be sent to [email protected] or by post to 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom.

# 1.3 Platform customers

We are the controller for the account details of people who use the Demeter platform (such as name and email address) and for data about how the platform is used. The platform is not designed to hold other personal data. Customers must not upload or input personal data into the platform unless we have expressly agreed to it.

# 2. The personal data we collect

# 2.1 Data you give us

When you download a report or dataset: your first name, last name, work email address and the role you select (for example, institutional investor or grower), plus which file you requested and the page you requested it from.

When you sign up to a newsletter: your email address, the newsletters you choose and, where you provide them, your name and role.

When you sign up at an event: your email address, the event, the newsletters you choose, and anything you ask us to follow up on (for example, information about hedging products or access to our AI tools).

When you contact us or become a customer: your name, employer, contact details and the content of your correspondence.

When you use the Demeter platform: your account details.

# 2.2 Data we collect automatically

Website usage data: the pages you visit, the links and buttons you click, the website that referred you (including whether you arrived from an AI assistant), your approximate location derived from your IP address, and your browser and device type. We collect this using cookies and similar technologies (see section 5).

Email data: whether an email we sent could be delivered and whether you unsubscribed.

Platform usage data: how you use features of the Demeter platform.

Linking usage data to you: if you submit one of our forms, we link your website usage data, both past and future, to your email address. This helps us understand which of our research and data is most useful to the people who use it.

# 2.3 Data we do not collect

We do not collect Special Categories of Personal Data (information about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, genetic or biometric data), or information about criminal convictions and offences.

# 3. How we use your personal data

We only use your personal data where the law allows us to. The table below sets out what we use it for and the legal basis we rely on.

Purpose	Data used	Legal basis
Sending you a report or dataset you requested, and remembering your details so you do not have to fill in the form again	Name, email, role, file requested	Contract: to provide what you asked for
Sending you the newsletters you signed up for	Email, newsletter choices, name and role where given	Consent
Following up on a download or event sign-up about our products and services	Name, email, role, files requested, requests made	Legitimate interests: developing our business with people who have shown interest in it
Providing the Demeter platform and supporting customers	Account details, platform usage data	Contract
Understanding how our website, emails and platform are used, and improving them	Usage data, email data	Legitimate interests: improving our services
Keeping our website and services secure and investigating errors	Usage data, technical logs	Legitimate interests: security
Keeping a record of unsubscribes so we do not email you again	Email, unsubscribe date	Legal obligation
Meeting our legal obligations and establishing or defending legal claims	Any relevant data	Legal obligation or legitimate interests

Where we rely on legitimate interests, we have considered your rights and concluded that the processing is what you would reasonably expect and has minimal impact on you. You can object at any time (see section 8).

# 3.1 Marketing emails

We only send you newsletters if you have opted in. Downloading a report or dataset does not sign you up to a newsletter unless you tick the box on the form.

Every newsletter includes a link to unsubscribe. You can also unsubscribe by emailing [email protected]. Withdrawing consent does not affect processing we carried out before you withdrew it.

# 3.2 Change of purpose

We will only use your personal data for the purposes we collected it for, unless a new purpose is compatible with the original one. If we need to use your data for an unrelated purpose, we will tell you and explain the legal basis for doing so.

# 3.3 Automated decision-making

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

We use service providers to run our business. They include providers of:

website hosting and delivery
website and product analytics
customer relationship management
email sending and newsletter management
internal team communication and collaboration tools
cloud computing and data storage

These providers process personal data only on our instructions, under contracts that require them to keep it secure and confidential.

We may also share personal data:

with professional advisers such as lawyers and accountants
with regulators, law enforcement or courts where the law requires it, or to enforce our terms
with potential buyers or investors, and their advisers, if we sell or restructure all or part of our business. If that happens, your data may pass to the new owner, who will continue to use it in line with this policy.

We do not sell your personal data.

California Privacy Rights: Under California Civil Code sections 1798.83–1798.84, California residents may ask us for a notice identifying the categories of personal information we share with third parties for their own direct marketing purposes. We do not share personal information for those purposes. To request this notice, write to [email protected].

# 5. Cookies and similar technologies

Cookies are small files stored on your device. We also use your browser's local storage, which works in a similar way. We use them for the following purposes.

Name	Purpose	How long it lasts
`ph_…_posthog`	Website analytics: recognises your browser across visits so we can understand how the site is used. If you submit one of our forms, it links that usage to your email address.	1 year
`demeter_landing_download_contact`	Remembers the name and email address you entered to download a dataset so you do not have to enter them again	30 days
`demeter-resource-download-contact` (local storage)	Remembers the name and email address you entered to download a dataset, on your device only	Until you clear your browser storage
`demeter_ai_referral_fired` (session storage)	Records that you arrived from an AI assistant, so it is only counted once per visit	Until you close the browser tab

You can block or delete cookies and local storage through your browser settings. If you do, our dataset download forms will ask for your details each time, and we will not be able to measure how you use the site.

# 6. International transfers

We are based in the UK. Some of our service providers are based in, or store data in, other countries, including the United States. Our website analytics data is stored in the European Union.

When personal data is transferred outside the UK, we make sure it is protected by one of the following:

UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it
the International Data Transfer Agreement or the International Data Transfer Addendum issued by the UK Information Commissioner

You can contact us for more information about the safeguards we use.

# 7. How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this policy:

Newsletter subscriptions: until you unsubscribe. We then keep your email address and unsubscribe date on a suppression list so we do not email you again.
Download and event sign-up records: up to three years after your last interaction with us.
Customer and platform account data: for the length of your contract and up to six years afterwards, for legal and accounting purposes.
Website usage data: up to two years.

We may keep data for longer if there is a complaint or a likely legal claim, or if the law requires it.

# 8. Your rights

Under data protection law, you have the right to:

Be informed about how we use your personal data. This policy provides that information.
Access the personal data we hold about you.
Rectification: ask us to correct inaccurate or incomplete data.
Erasure: ask us to delete your data where there is no good reason for us to keep it. Some legal reasons may prevent us from doing so, and we will tell you if that is the case.
Object to our use of your data where we rely on legitimate interests. You have an absolute right to object to direct marketing.
Restrict our use of your data in certain circumstances, for example while we check its accuracy.
Data portability: receive data you gave us in a structured, machine-readable format, or have it sent to another organisation, where we process it based on your consent or a contract.
Withdraw consent at any time where we rely on consent.

To exercise any of these rights, email [email protected]. We do not charge a fee unless a request is clearly unfounded or excessive. We may need to confirm your identity before we respond. We aim to respond within one month.

You have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). If you are in the European Economic Area, you can also complain to your local data protection authority. We would appreciate the chance to address your concerns first, so please contact us in the first instance.

# 9. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including:

storing data with reputable providers that use encryption in transit and at rest
limiting access to staff who need it and who are bound by confidentiality obligations
requiring our service providers to protect data to the same standard

Platform account holders are responsible for keeping their password secure and for signing out of shared devices.

No transmission of data over the internet is completely secure. If you believe your interaction with us is no longer secure, please contact us straight away.

# 10. Children

Our website and services are intended for business users and are not directed at anyone under 18. We do not knowingly collect personal data from children.

# 11. Changes to this policy

We keep this policy under review and will publish any changes on this page. If we make significant changes, we will tell people who have subscribed to our emails or hold a platform account. This version is dated 16 September 2026.

Our Master Subscription Agreement and Data Licence Agreement govern customers' use of our services and data. Separate Terms of Use may apply to publicly accessible parts of the Demeter website.

Contact

Email: [email protected]

Demeter Publishing Limited
71-75 Shelton Street
London WC2H 9JQ
United Kingdom