These documents are drafts. They were prepared to describe how ZEST works today and have not yet been reviewed by a solicitor. Everything [highlighted like this] still needs to be filled in or confirmed before this page goes live.
Last updated 14 November 2026 · effective from [DATE]
1.1 These terms govern use of ZEST, the Zonovi Ecology Survey Toolkit (the Service), a web application for recording ecological surveys.
1.2 The Service is provided by Zonovi Ltd, a company registered in England and Wales with company number 17332539, whose registered office is at [REGISTERED ADDRESS] (Zonovi, we, us).
1.3 You means the business or organisation that creates an organisation account in the Service, and each person it allows to use that account.
1.4 The Service is for business and professional use only. It is not offered to consumers.
1.5 By creating an account or using the Service you accept these terms. If you accept them on behalf of an organisation, you confirm you have authority to do so.
1.6 If we agree a separate written contract with you, that contract takes priority over these terms where the two conflict.
2.1 The Service lets you create projects, draw a site boundary, record survey data and photographs, calculate indicative outputs such as biodiversity units, and export reports and GIS data.
2.2 The Service saves data on your device first and copies it to our online database when you are signed in and connected. Data recorded while signed out or offline stays on that device until it is synced.
2.3 The Service is under active development. Features may be labelled as prototype or beta, and may change.
3.1 Each user account belongs to one or more organisations. The person who creates an organisation is its owner.
3.2 Owners and admins can invite and remove users. Everyone in an organisation can see and edit all of that organisation's projects.
3.3 You are responsible for who you invite, for what your users do in the Service, and for removing users who should no longer have access.
3.4 Each user must keep their password confidential and must not share a login. Tell us promptly at [CONTACT EMAIL] if you suspect unauthorised access.
3.5 You must give accurate account details and keep them up to date.
4.1 Free trial. A new organisation receives a free trial of 30 days with 3 user seats, unless we agree otherwise.
4.2 Paid plans. After the trial, continued use needs a paid plan. A plan sets the number of seats and the period it covers. Fees are £25 per user per month, or £250 per user per year, payable [in advance by invoice within 30 days], and are [exclusive of VAT].
4.3 Seats. Each user and each pending invitation uses one seat. You cannot invite more people than your plan has seats. Contact us to add seats.
4.4 When a trial or plan ends. If a trial ends without a paid plan, or a plan is not renewed or paid for, the organisation becomes read-only. Your users can still sign in, view your data and export it, but the Service will not accept new or changed data online. Changes made on a device while read-only stay on that device.
4.5 Restoring access. Full access returns when a plan is started or renewed. Changes held on a device are then uploaded the next time it syncs.
4.6 Price changes. We may change fees for a future plan period by giving you at least 30 days' notice before it starts.
4.7 Refunds. Fees are non-refundable except where these terms or the law say otherwise.
5.1 You own the survey records, photographs, boundaries, notes and reports you create in the Service (Customer Data). We claim no ownership of it.
5.2 You give us permission to host, copy, process and back up Customer Data only as needed to provide and support the Service.
5.3 You can export Customer Data at any time, including while read-only, using the export tools in the Service.
5.4 You are responsible for having the right to record and upload Customer Data, including landowner permissions and any photographs that show people or private property.
5.5 Where Customer Data includes personal data, the Schedule (Data processing terms) applies.
5.6 We will not access Customer Data except to provide support you have asked for, to maintain or secure the Service, or where the law requires it.
6.1 You must not use the Service unlawfully, try to access another organisation's data, interfere with the Service's security or operation, or upload malicious code.
6.2 You must not resell the Service, or copy or reverse engineer it to build a competing product, without our written agreement.
6.3 We may suspend an account that breaches this clause. Where we reasonably can, we will tell you first.
7.1 The Service is a recording and calculation tool. It does not replace the judgement of a competent ecologist or the requirements of current guidance.
7.2 Outputs such as habitat classifications, condition assessments, biodiversity units, population size classes, suitability categories and conservation status flags are indicative. You must check them against the current published sources before relying on them or submitting them to a client or authority.
7.3 Biodiversity unit figures are not a substitute for the Statutory Biodiversity Metric tool. Default values marked as assumed must be confirmed by a suitably qualified person.
7.4 Grid references and areas are calculated from device and map data and are not survey grade.
7.5 You remain responsible for your survey findings, reports and professional advice.
8.1 We own the Service, including its software, design and documentation. These terms give you a right to use the Service during your trial or plan. They do not transfer ownership.
8.2 The Service includes reference content from third parties, such as habitat classifications, species lists and background mapping. That content belongs to its owners and may be subject to their licence terms. [CONFIRM: UKHab classification and symbology are included under licence from UKHab Ltd / are not included.]
8.3 Background maps and aerial imagery are provided by third parties and may be withdrawn or changed. You must not copy or extract them other than as part of a report or export produced by the Service.
9.1 We aim to keep the Service available but do not guarantee uninterrupted or error-free operation. The Service depends on third-party hosting, database and mapping providers.
9.2 We keep backups of the online database as provided by our hosting provider. You should also export important data regularly. Data that exists only on a device is not backed up by us.
9.3 We may update, add or remove features. If a change materially reduces the Service during a paid plan, you may end the plan and receive a pro-rata refund of fees paid for the unused period.
9.4 We may change these terms by giving at least 30 days' notice in the Service or by email. Continued use after the change takes effect means you accept it.
10.1 Nothing in these terms limits liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot be limited by law.
10.2 Subject to clause 10.1, we are not liable for loss of profit, loss of business, loss of anticipated savings, or any indirect or consequential loss.
10.3 Subject to clause 10.1, we are not liable for decisions made or advice given in reliance on outputs of the Service that have not been checked as clause 7 requires, or for loss of data held only on a device.
10.4 Subject to clause 10.1, our total liability in any 12-month period is limited to [the fees you paid for the Service in that period, or £AMOUNT if greater].
10.5 The Service is provided for business use, and all warranties and conditions not set out in these terms are excluded as far as the law allows.
11.1 You may stop using the Service at any time. Fees already paid are not refunded, except under clause 9.3.
11.2 Either of us may end this agreement by written notice if the other materially breaches it and does not put that right within 30 days of being asked.
11.3 After a trial or plan ends, we keep Customer Data in read-only form for at least [90 days] so you can export it. After that we may delete it. We will delete it sooner on written request from an owner.
11.4 Clauses that by their nature should continue, including clauses 5.1, 7, 8.1, 10 and 12, survive the end of the agreement.
12.1 We will send notices to the email address of your organisation's owner. Send notices to us at [CONTACT EMAIL].
12.2 Neither of us is liable for failure or delay caused by events beyond reasonable control.
12.3 You may not transfer this agreement without our consent. We may transfer it to a successor to our business.
12.4 These terms, with any plan details we have agreed with you, are the whole agreement between us about the Service.
12.5 A person who is not a party has no right to enforce these terms.
12.6 These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
This Schedule applies where we process personal data in Customer Data on your behalf. For that data you are the controller and we are the processor under UK data protection law.
S1. What we process. Names and email addresses of your users and surveyors; names, contact details or other personal data you type into notes and forms; photographs that may show people, vehicles or private property; and locations of survey records. Processing lasts for the term of the agreement plus the retention period in clause 11.3.
S2. Your instructions. We process this data only to provide the Service and on your documented instructions, which these terms and your use of the Service set out, unless the law requires otherwise.
S3. Confidentiality. Anyone we authorise to access the data is bound by a duty of confidentiality.
S4. Security. We apply appropriate technical and organisational measures, including encryption in transit, access controls that separate each organisation's data, and restricted administrative access.
S5. Sub-processors. You authorise us to use the sub-processors listed below. We will give you at least 30 days' notice of a new or replacement sub-processor, and you may object on reasonable grounds. We remain responsible for their work.
| Sub-processor | What it does | Data location |
|---|---|---|
| Supabase | Database, sign-in, photo storage, account emails | London, UK (Amazon Web Services) [CONFIRM REGION] |
| Netlify | Delivers the app's web pages | Global network; company based in the USA |
| Map tile providers (Esri, OpenStreetMap) | Supply background maps to the user's browser | Outside the UK; they receive the device's IP address and the map area viewed, not your survey records |
S6. International transfers. Where a sub-processor processes personal data outside the UK, we rely on a transfer mechanism recognised under UK law, such as adequacy regulations or the UK International Data Transfer Addendum.
S7. Helping you comply. We will give reasonable help with data subject requests, data protection impact assessments and dealings with the Information Commissioner's Office, taking account of the information available to us.
S8. Breaches. We will tell you without undue delay after becoming aware of a personal data breach affecting your data, and give you the information we have about it.
S9. Return and deletion. You can export your data at any time. At the end of the agreement we delete it as set out in clause 11.3, unless the law requires us to keep it.
S10. Audit. On reasonable written request, and no more than once a year, we will provide information needed to show we comply with this Schedule.
S11. Sensitive locations. Records such as badger setts, bat roosts and Schedule 1 bird nest sites are confidential ecological information. You decide who in your organisation can access them by controlling who you invite.
Zonovi Ltd runs ZEST, the Zonovi Ecology Survey Toolkit. We are a company registered in England and Wales, company number 17332539, with our registered office at [REGISTERED ADDRESS]. You can contact us about privacy at [PRIVACY EMAIL].
This policy explains what personal data we handle when you use the toolkit, why, and your rights. It covers the web app and its online database.
We handle personal data in two different roles:
| Data | Where it comes from | Why we use it | Lawful basis |
|---|---|---|---|
| Email address and password (the password is stored only in hashed form) | You, when you create an account | To sign you in and keep your account secure | Performance of our contract with your organisation |
| Organisation name, your role, who invited you | You or your organisation's admin | To put you in the right organisation and control access | Performance of contract |
| Plan status, seats, trial and renewal dates, invoice references | Us and your organisation | To manage trials, subscriptions and billing | Performance of contract; legal obligation for accounting records |
| Sign-in times, sync times and which user last changed a survey | Generated when you use the service | To run sync, resolve conflicts, investigate faults and keep the service secure | Legitimate interests in running a reliable, secure service |
| IP address and basic request logs | Collected automatically by our hosting providers | Security, fault-finding and preventing abuse | Legitimate interests |
| Messages you send us | You | To answer support requests | Legitimate interests |
We do not use your data for advertising, we do not sell it, and we do not use it for automated decisions that have legal or similarly significant effects.
Survey content. Records, notes, surveyor names and photographs entered into surveys are processed on behalf of your organisation, as described in section 2. Photographs may show people or private property. Your organisation is responsible for having a lawful basis to record them.
Location. If you press the location button on the map, your browser shares your position with the app to centre the map. The app does not track your location in the background. The position is stored only if you save a record at that point.
We share personal data only with the providers that run the service for us, and only as far as each needs.
| Provider | What it does | What it receives | Location |
|---|---|---|---|
| Supabase | Database, sign-in, photo storage, account emails | Account details and survey content | London, UK (Amazon Web Services) [CONFIRM REGION] |
| Netlify | Delivers the app's web pages | IP address and request logs; no survey content | Global network; company based in the USA |
| Map tile providers (Esri, OpenStreetMap) | Supply background maps direct to your browser | IP address and the map area you view; no survey content | Outside the UK |
People in your own organisation can see the survey content your organisation records, and owners and admins can see the email addresses of its members.
We may also disclose data where the law requires it, or to a buyer of our business, who would be bound by this policy.
Some providers process limited data outside the UK. Where they do, we rely on a safeguard recognised under UK law, such as adequacy regulations or the UK International Data Transfer Addendum. [CONFIRM for each provider.]
We protect data with encryption in transit, database rules that keep each organisation's data separate, and restricted administrative access protected by multi-factor authentication. No system is completely secure, so please use a strong, unique password and tell us if you suspect misuse of your account.
The app does not use advertising or tracking cookies. It stores data in your browser so that it works offline:
This storage is necessary for the service to work. Clearing your browser's site data removes it, including any records not yet synced. Anyone who uses the same browser profile on a shared device could see data stored there, so sign out on shared devices.
Under UK data protection law you can ask us to:
To use these rights, email [PRIVACY EMAIL]. We will reply within one month. For survey content recorded by your organisation, we will pass your request to your organisation, which is responsible for answering it.
If you are unhappy with how we handle your data, please contact us first at [PRIVACY EMAIL]. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
We will post any changes here and update the date at the top. If a change is significant we will tell account owners by email or in the app before it takes effect.
