How we govern the data we publish
The plot and farmer data on this site is personal data. This page describes the route a record travels from the internal register to the page, who approves it, what the system enforces by itself, and which part is still someone's word rather than a document.
Updated 11 October 2026
We publish farmer names and plot coordinates because transparency you can check needs plot-level data. Publishing personal data needs rules an outsider can inspect, not only our good intentions.
The route one record travels
- 1 · Internal register
- Plot data comes from the coffee plot coordinate file and field survey work, and is held internally together with fields that are never published, such as phone numbers and supporting documents.
- 2 · Review and approval
- A plot enters the published set only once it has been reviewed and marked approved. A plot that has not been is absent from the site entirely, rather than present but empty.
- 3 · Published tables
- The system copies only approved fields into a separate set of public tables. The website and the API read from those tables alone, never from the internal register.
- 4 · Website and API
- The map, the plot table and the API serve the same set. No channel sees more than another.
What the system enforces, not what we promise
Forbidden fields are blocked by an automatic check
Fields such as phone numbers and unapproved raw coordinates are on a deny list in the code, with tests that fail the moment anything tries to export them. The block does not depend on anyone remembering it.
A change at source withdraws the plot from publication
If a plot's data is edited in the internal register, the system withdraws that plot from the published set until it is reviewed and approved again. Edited-but-unreviewed data cannot reach the public.
The published set is read-only
The public tables have no write path from the website. Every change comes from re-deriving them from approved records in the internal register.
No identifiable face in sustainability photography
Photographs in this section must show no identifiable face, and when one does we fix the image file rather than cover it in the page: an overlay leaves the face in a file anyone can download.
Who decides
- The data owner is the purchasing team, who work with the farmers directly and decide which plot data is ready to publish.
- Widening the scope of publication, such as adding a new field, needs management approval first, every time.
- Any change to what is published is recorded in the changelog with its date.
Corrections, withdrawal and the rights of the people in the data
- A person in the data may ask for a correction or withdrawal through the company's contact channels.
- On withdrawal the plot leaves the map, the plot table and the API together, at the next rebuild of the published set.
- Both the error found and the correction made are recorded in the changelog. Nothing is removed quietly.
info@hillkoff.com · What we publish and what we hold back · Privacy notice
Where this is not yet strong enough
- Approval to publish the current personal data set rests on management's decision and is not yet recorded as a written resolution. We are preparing one.
- We do not yet have a grievance channel announced publicly for farmers and communities; today a concern has to come through the company's general contact channels.
- The figures on this site have not been checked by an external assurance provider.