Last updated: 22nd February 2024

Welcome to climatealigned.co (the “Site”), brought to you by ClimateAligned Ltd ("ClimateAligned", "we", "us", and/or "our"). At ClimateAligned, we offer a cloud application (“Application”) designed for research and assessment of financial instruments ("Services"). Our commitment is to provide our Site and Services (collectively, "Platform"), while collecting minimal personal data from our valued customers (“Customers”).

This Privacy Policy explains the types of personal information, or personal data, we may collect during your interaction with our Platform, which encompasses any affiliated websites, software, or Applications we own or operate where this policy is displayed. Personal information refers to any data that uniquely identifies you, such as your name, email, organisation, and other details that can directly or indirectly identify you.

This document is designed to inform you about how we collect, use, and share your personal information across our Application. For those in the European Economic Area ("EEA") or the United Kingdom ("UK"), this Privacy Policy fully applies, with additional details provided in a specific section for EEA and UK users regarding your personal data rights.

We encourage you to read through this Privacy Policy carefully to understand how your personal data is handled, and your legal rights. Should you have any queries, feedback, or concerns about our data practices or wish to exercise your rights, please refer to our contact details at the bottom of this document.

Who we are and how to contact us

ClimateAligned is a UK company (registration number 14287639) with the following contact information:

ClimateAligned Ltd,
Flat 3 Criterium House,
13 Olympic Park Avenue,
London,
United Kingdom,
E20 1NY

Who this Privacy Policy applies to

This Privacy Policy applies to:

Customers: any individual who registers individually or on behalf of an entity or organisation in order to use the Services.

Site Visitors: any visitor to our Site that may or may not also be a Customer.

Changes to this Privacy Policy

This Privacy Policy was last updated on the date indicated at the top of this document.

We suggest that you review it from time to time, as our Application and our business may change. As a result, at times it may be necessary for ClimateAligned to make changes to this Privacy Policy. ClimateAligned reserves the right to update or modify this Privacy Policy at any time and from time to time without prior notice. However, if we make changes that we believe will materially impact this Privacy Policy or your rights, we will promptly notify you of those changes. Your continued use of the Platform after any changes or revisions to this Privacy Policy shall indicate your agreement with the terms of such revised Privacy Policy.

Personal Information we collect

What personal information we collect and process depends on how and why you use our Platform. Generally, we process personal information that we receive:

• Directly from you when you provide it to us, such as in connection with our Services.
• Indirectly, through automated technologies such as cookies, or from third parties.

Information we collect directly from you

• Name, email, and organisation, as provided by you when you enter a trial or a contract with us.
• If you are a customer, then we store the specific user data that you create through usage of the Platform. The data you create can be updated and deleted at any time through the Platform.

Information we collect indirectly

Device and usage information

When you use or interact with the Platform, even if you do not have an account, we, or authorised third parties engaged by us, may automatically collect information about your use of the Platform via your device, some of which is considered personal information. "Device and Usage Information" that we collect consists of:

• Information About your Device – information about the devices and software you use to access the Platform — primarily the internet browser or mobile device that you use, the website or source that linked or referred you to the Platform, your IP address or device ID (or other persistent identifier that uniquely identifies your computer or mobile device on the Internet), the operating system of your computer or mobile device, device screen size, and other similar technical information.
• Usage Information – information about your interactions with the Site, including access dates and times, hardware and software information, device event information, log data, crash data, cookie data. This information allows us to understand the screens that you view, how you've used the Site, and other actions on the Site. We, or authorised third parties, automatically collect log data when you access and use the Platform, even if you have not created an account or logged in. We use this information to administer and improve the Services, analyse trends, track users' use of the Platform, and gather broad demographic information for aggregate use.

Cookies and similar technologies

ClimateAligned uses cookies and similar technologies. Through our use of cookies (and similar technologies), we or authorised third parties collect some Device and Usage Information. These cookies are necessary to make the Platform available to you, while others are meant to improve the Platform and enable us to analyse and measure audience and traffic. For more information on our use of cookies and the data that they collect, see our Cookie Policy.

Analytics

We collect device and usage information through our third-party hosting service, Vercel, along with log data, to create and analyse grouped data, like statistics or demographic information. This grouped data can come from personal information but isn't considered personal if it doesn't reveal who you are. For instance, we might count how many people visit our Site, look over log data, or see how many people visit each page on our Site. We use this information to figure out what percentage of users use a certain feature of the app and to look for trends and statistics. Vercel’s Privacy Policy is available at https://vercel.com/legal/privacy-policy.

If we mix this grouped data with your personal information in a way that could identify you, either directly or indirectly, then we consider this combined data as personal information. This means we will handle it according to our Privacy Policy.

How we use Personal Information that we collect

We use your personal information for a number of different reasons, as further explained below. In addition, for users located in the EEA and the UK, we must have a valid legal basis in order to process your personal data. The main legal bases under the European Union's General Data Protection Regulation (GDPR) that justify our collection and use of your personal information are:

• Performance of a contract — When your personal information is necessary to enter into or perform our contract with you.
• Consent — When you have consented to our use of your personal information via a consent form (online or offline).
• Legitimate interests — When we use your personal information to achieve a legitimate interest and our reasons for using it outweigh any prejudice to your data protection rights.
• Legal obligation — When we must use your personal information to comply with our legal obligations.
• Legal claims — When your personal information is necessary for us to defend, prosecute or make a claim.

Below are the general purposes and corresponding legal bases (in brackets) for which we may use your personal information:

• Providing you access to and use of our Platform [performance of a contract, legitimate interests].
• Responding to your queries and requests, or otherwise communicating directly with you [performance of a contract, legitimate interests, and in some cases, legal claims].
• Improving the functionality and quality of our applications [legitimate interests].
• Detecting fraud, illegal activities or security breaches [legitimate interests].
• Ensuring compliance with applicable laws [compliance with a legal obligation].
• Monitoring and analysing usage patterns and activities of our application [consent where required (e.g. 3rd-party cookies), or legitimate interests].
• Sending commercial communications, in line with your communication preferences, about updates to our application updates [consent and in some cases, depending on location, with existing customers, legitimate interests].
• Providing information to regulatory bodies when legally required, and only as outlined below in this Privacy Policy [legal obligation, legal claims, legitimate interests].

When we share information

We only disclose your personal information as described below.

Third-Party Service Providers

ClimateAligned discloses users' information to third-party service providers who provide a service to Customers on our behalf. These companies do things to help us provide the Application, and in some cases collect information directly. Below is a list of these providers, what we use them for, and links to their privacy policy.

Clerk

• What we disclose on your behalf - your name, email address, and organisation.
• Why we share this information - for Customers, we provide this information to create a user account on your behalf to access our Platform securely. After we provision your account, you will be able to view and update your account information from through the Platform.
• Privacy policy: https://clerk.com/legal/privacy

Legal obligations and security

ClimateAligned may share your personal information only in specific cases not mentioned in our Privacy Policy, such as: (i) with your permission; (ii) when legally required, like with a subpoena or court order; (iii) to ensure someone's safety or to protect our Application from threats like spam or hacking; or (iv) to defend our rights or those of our users.

Updating personal information we hold

To keep your information accurate, current, and complete, please contact us as specified below. We will take reasonable steps to update any information in our possession that you have previously submitted via the Application.

Contact us at privacy@climatealigned.co if you wish to update or delete the information we hold about you.

How long do we keep your Personal Information?

General retention periods

We retain your personal information for only as long as required to provide you with our services.

We also will retain personal information that we've collected from you where we have an ongoing legitimate business need to do so (for example, to comply with applicable legal, tax or accounting requirements). Furthermore, we cannot delete information when it is needed for the establishment, exercise or defence of legal claims (also known as a "litigation hold"). In this case, the information must be retained as long as needed for exercising respective potential legal claims.

Once we no longer need your data for business or legal reasons, we will delete it.

Data security and integrity

ClimateAligned prioritises keeping your personal data safe. We have implemented strong security measures to protect against unauthorised access, loss, or disclosure of your data. Access is strictly limited to those with a legitimate need for it. We will inform you if a data breach takes place. We also ensure that any third parties handling your information meet our security standards. However, remember that no internet or email transmission is completely secure, so be cautious about the information you send via email.

Your California privacy rights

If you are a California resident, California Civil Code Section 1798.83 permits you to request in writing a list of the categories of personal information relating to third parties to which we have disclosed certain categories of personal information during the preceding year. To make such a request, please contact us at privacy@climatealigned.co.

Notice to Nevada consumers

We do not sell your personal information within the scope of, and according to the defined meaning of, a "sale" under NRS 603A.

Additional information for Users in the EEA and the UK

European Representative

Regarding Article 27 of the General Data Protection Regulation (GDPR), ClimateAligned has appointed the European Data Protection Office (EDPO) as its GDPR representative in the EU. You can contact EDPO regarding matters pertaining to the GDPR by:

• Using EDPO's online request form at https://edpo.com/gdpr-data-request/
• Writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium.

UK Representative

Regarding the UK GDPR, ClimateAligned has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR:

• Using EDPO's UK online request form at https://edpo.com/gdpr-data-request/
• Writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom.

Contact us

If you have any questions about this Privacy Policy, please contact us at privacy@climatealigned.co.