Privacy Policy
Effective date: 15 September 2026
This Privacy Policy explains how personal information is collected, used and protected when you use the Pesticide Stock Management System ("PSMS" or the "Platform"). That includes the website at psms.bcrc-caribbean.org, its API, and the PSMS mobile application. The Platform is operated by the Basel Convention Regional Centre for the Caribbean ("BCRC-Caribbean", "we", "us").
Please read it together with our Terms of Use.
1. Who is responsible for your information
PSMS is used by national pesticide regulatory authorities ("Regulators") and the businesses and individuals they regulate. Each Regulator has its own separate workspace on the Platform.
- The Regulator for your workspace decides what information is collected in that workspace and how it is used for regulatory purposes. It also administers user accounts there.
- BCRC-Caribbean operates, hosts and secures the Platform for the Regulator, and processes information to provide the service.
If you have a question about the regulatory records held about you or your organization, your Regulator is usually best placed to answer it. You can always contact us as well (see section 11).
2. Information we collect
Account information
- Name, email address and username
- The organization(s) you belong to and your role or user group
- Preferences such as language, time zone and display theme
- Account status, such as whether your email is confirmed and your account is approved
Security information
- Your password, stored only as a one-way hash — we cannot see it
- Two-factor authentication settings and recovery codes, stored in protected form
- Sign-in times, failed sign-in attempts and account lock status
- One-time codes for email confirmation and password reset, stored only as hashes
Activity and audit records
To keep a trustworthy regulatory record, the Platform logs who created, changed or deleted records and when. These logs include your IP address, browser or device type (user agent), the page or action used, and the values before and after the change. Passwords, two-factor secrets and other credentials are removed from these logs.
Regulatory records
Depending on your role, you may enter or be named in:
- product registrations and supporting documents
- organization details, licenses and contact persons
- import permits and shipment records
- stock levels, storage facilities, sales reports and disposal records
- facility inspection reports, findings, signatures and photographs
Documents and images you upload are stored with these records.
Location and photos (mobile app)
When an inspector captures inspection evidence in the mobile app, the app can record the device's location so the Regulator can confirm the inspection took place on site. The app uses the camera or photo library only when you choose to attach a photo. Location is requested only while the app is in use, and you can refuse or withdraw permission in your device settings. If you do, some inspection features may not be available.
Device and notification information
- Browser push notifications: if you turn them on, we store the push subscription address and security keys your browser provides, together with your browser's user agent.
- Mobile app: the app stores your sign-in session in your device's secure storage, and may keep inspection data on the device so you can work offline until it synchronizes. If you enable biometric unlock, your fingerprint or face data is handled entirely by your device's operating system and is never sent to us.
- Crash and error reports: the mobile app may send technical diagnostics when it crashes or encounters an error, such as device model, operating system version, app version and the error details. These reports help us fix problems and are not used for advertising.
Cookies
The website uses only the cookies it needs to work:
| Cookie | Purpose |
|---|---|
| Session cookie | Keeps you signed in and remembers your language choice |
| CSRF cookie | Protects forms against cross-site request forgery |
We do not use advertising cookies or third-party analytics, and we do not track you across other websites.
3. How we use information
We use information to:
- provide the Platform, including creating and securing accounts and letting you carry out your regulatory tasks;
- enable Regulators to process applications, issue and monitor permits and licenses, conduct inspections and oversee pesticide stock, sales and disposal;
- send service emails and notifications, such as account confirmations, password resets, expiry reminders, status changes and scheduled reports;
- keep the Platform secure, including detecting and preventing unauthorized access, rate-limiting sign-in attempts and keeping audit trails;
- diagnose faults and improve the Platform;
- comply with legal obligations and respond to lawful requests.
We do not sell personal information, and we do not use it for advertising or profiling.
4. Who can see your information
- Within your workspace. Users of your Regulator's workspace can see information according to the permissions their role grants. People who act for a regulated organization see only the records of the organizations they belong to.
- Other workspaces. Information is kept separate between Regulators' workspaces. It is not visible to users of another workspace.
- Platform administrators. A small number of BCRC-Caribbean administrators can access all workspaces when they need to support, maintain or secure the Platform.
- Service providers. We use trusted providers who process information for us under contract, only to deliver the service:
- cloud hosting, database and file storage — Amazon Web Services;
- transactional email delivery;
- browser and mobile push notification services operated by browser and device makers;
- mobile app crash and error reporting.
- Integrations set up by your Regulator. A workspace administrator can connect the Platform to other systems through API keys, data pipelines and webhooks. Information sent to those systems is then handled under the Regulator's own arrangements.
- Legal requirements. We may disclose information where required by law, or where necessary to protect the rights, safety or security of users, the public or the Platform.
5. Where information is stored
The Platform is hosted by Amazon Web Services in the United States (us-east-1 region), and our service providers may process information in other countries. This means your information may be stored and processed outside the country where you live. We rely on providers that apply appropriate contractual and technical safeguards.
6. How long we keep information
- Regulatory records are kept for as long as the Regulator needs them to carry out its functions and meet its record-keeping obligations. They are generally not deleted when a user account is closed.
- Account information is kept while your account is active. Closed accounts are deactivated rather than erased straight away, so that the regulatory records and audit trail that refer to them stay intact.
- Audit and security logs are kept to preserve the integrity of the regulatory record.
- Push subscriptions are removed when you turn off notifications or when the push service reports that they are no longer valid.
- Database backups are kept for a limited period and then replaced.
7. How we protect information
Protections include:
- encrypted connections (HTTPS) for all traffic;
- password hashing and optional or enforced two-factor authentication;
- sign-in rate limits and account lockout after repeated failures;
- strict separation of data between workspaces, with role-based permissions;
- encryption of stored integration credentials;
- removal of credentials from logs;
- audit logging of changes.
No system is completely secure. If you believe your account or data has been compromised, tell your workspace administrator or contact us straight away.
8. Your choices and rights
Depending on the law that applies to you, you may have the right to:
- see the personal information held about you;
- correct information that is inaccurate — you can update your name, language, time zone, password and two-factor settings yourself from your profile;
- ask for your account to be closed or your information deleted, subject to the Regulator's need to keep regulatory records;
- object to or restrict certain processing;
- turn off browser push notifications, or withdraw camera, photo or location permission for the mobile app, at any time.
To make a request, contact your workspace administrator or email us at the address in section 11. We may need to confirm your identity first. Where a request concerns records held by a Regulator, we may refer it to that Regulator.
9. Children
The Platform is intended for professional use and is not directed at anyone under 18. We do not knowingly collect information from children.
10. Changes to this policy
We may update this Privacy Policy from time to time. The effective date at the top of this page shows when it last changed. If a change is significant, we will take reasonable steps to let users know, for example by a notice in the Platform.
11. Contact us
For questions about this Privacy Policy or how your information is handled, contact:
Basel Convention Regional Centre for the Caribbean (BCRC-Caribbean) Email: info@bcrc-caribbean.org