Privacy Policy

1. Introduction and who we are

This Privacy Policy describes how SGG Analytics Ltd (“CarbonQry”, “we”, “us”, “our”) collects, uses, discloses, and safeguards personal information in connection with our website at carbonqry.com, including the CarbonQry Carbon Intelligence Platform (the “Site”), and in connection with our business relationships with clients, prospective clients, and suppliers.

For the purposes of applicable data protection law, CarbonQry is the controller of the personal information described in this policy. Questions, requests, and complaints regarding personal information should be directed to support@carbonqry.com (see section 14).

This policy is intended to meet the transparency requirements of the data protection laws applicable to us and to our institutional audience, including the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), the EU and UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended (CCPA/CPRA). Jurisdiction-specific provisions appear in section 12.

2. Scope of this policy

This policy applies to personal information processed through the Site and in the ordinary course of our business (marketing, sales, client administration, and supplier management).

CarbonQry’s data products are outside the scope of this policy: our emissions datasets, analytics, and scores relate to publicly listed companies, are compiled from public corporate disclosures, regulatory filings, and licensed commercial datasets, and contain no personal information.

Where CarbonQry provides data services to a client under a written subscription or evaluation agreement, personal information of the client’s personnel (such as authorised user names and business email addresses) is processed as necessary to administer that agreement, and any specific data-handling terms in the agreement prevail over this policy to the extent of a conflict.

3. Personal information we collect

3.1 Information you provide to us

• Identity and business contact data - name, business email address, employer or firm, job title or role, and business telephone number, collected when you request access to the platform, request sample data or materials, attend a demonstration, or otherwise correspond with us.
• Account and credential data - for authorised platform users, the email address and authentication identifiers used to register and sign in. Authentication is operated by our identity provider (see section 6); CarbonQry does not store your password.
• Correspondence - the content of messages, requests, and feedback you send us, including through the “Request Access” form.
• Commercial relationship data - billing contacts, contract details, and records of the products and services your firm evaluates or subscribes to.

3.2 Information collected automatically

• Log and technical data - IP address, browser type and version, device and operating system identifiers, pages requested, referring page, and date/time stamps, recorded in standard web-server logs operated for security, capacity, and diagnostic purposes.
• Sign-in records - for authorised users, records of authentication events maintained by our identity provider, used for security monitoring and support.
• Cookies and analytics - strictly necessary and analytics cookies, as described in section 7.

3.3 Information from other sources

• Your firm - where your employer arranges access for you, we receive your name, business email, and role from the firm’s administrator or procurement contacts.
• Public and professional sources - in the course of business development we may record publicly available professional details (for example, from a firm’s website or professional networking profiles) of individuals in roles relevant to our services.

We do not intentionally collect, and ask that you do not submit, sensitive or special-category personal information (such as health, biometric, or political data) through the Site. We do not knowingly collect information from children; the Site is directed exclusively at business users.

4. Purposes of processing and legal bases

We process personal information for the following purposes. Where the GDPR or similar laws apply, the legal basis for each purpose is indicated; where Canadian law applies, we rely on consent (express or implied, as appropriate to the sensitivity and context) and on recognised statutory exceptions.

• Responding to enquiries and access requests - to evaluate and respond to requests for information, demonstrations, sample data, or platform access. Legal basis: legitimate interests; steps prior to entering a contract.
• Providing and administering the platform - to authenticate authorised users, provision and support accounts, and administer subscriptions and evaluations. Legal basis: performance of a contract; legitimate interests.
• Security and integrity - to monitor for, prevent, and investigate unauthorised access, misuse, licence breaches, and other threats to the Site and our data. Legal basis: legitimate interests; legal obligation.
• Business communications - to send service communications, and to send relevant commercial communications about CarbonQry products, research, and methodology developments to business contacts, subject to applicable anti-spam laws (including CASL and PECR) and always with the ability to opt out. Legal basis: legitimate interests; consent where required.
• Site improvement - to understand, through the analytics described in section 7, how the Site is used in aggregate, and to improve their content, performance, and design. Legal basis: legitimate interests.
• Compliance and legal claims - to comply with applicable law, regulation, and lawful requests, and to establish, exercise, or defend legal claims. Legal basis: legal obligation; legitimate interests.
• Corporate transactions - to evaluate and complete a merger, acquisition, financing, reorganisation, or sale of assets. Legal basis: legitimate interests.

We do not use personal information for automated decision-making that produces legal or similarly significant effects, and we do not use it to train models: CarbonQry’s emissions models are trained on corporate disclosure data, not on personal information.

5. How we disclose personal information

We do not sell personal information, and we do not share it for cross-context behavioural advertising. Disclosures are limited to:

• Service providers acting on our instructions (web hosting and infrastructure, identity and authentication services, analytics, and email and productivity services), each bound by contractual confidentiality and data protection obligations;
• Professional advisers - legal, accounting, audit, and insurance advisers, under professional or contractual duties of confidence;
• Authorities and courts - where disclosure is required or permitted by applicable law, regulation, legal process, or enforceable governmental request, or where necessary to protect the rights, safety, or property of CarbonQry, our clients, or others;
• Successors - a counterparty or successor entity in connection with an actual or contemplated corporate transaction, subject to customary confidentiality safeguards; and
• Your firm - for authorised users, subscription administrators at your firm may receive account information relevant to administering the firm’s agreement.

6. Our principal service providers

The Site is operated using a small number of established infrastructure providers, in the following categories: web hosting and infrastructure; identity and authentication services; analytics; and business email and productivity services. Our suppliers' identities are commercially confidential; each is bound by contractual confidentiality and data protection obligations appropriate to its role.

7. Cookies and similar technologies

The Site use the following categories of cookies and similar technologies:

• Strictly necessary cookies - session and security cookies required to operate the Site, maintain signed-in state for authorised platform users, and protect forms against abuse. These cannot be switched off through the Site.
• Analytics cookies - we use a third-party analytics service to understand, in aggregate, how visitors use the Site (pages viewed, approximate location, browser and device type, and how visitors arrive at the Site), which helps us improve their content and performance. The analytics provider sets its own cookies and processes the associated data on our behalf. You can control or disable cookies through your browser settings.

The Site does not use advertising cookies, remarketing, tracking pixels, social-media plug-ins, or fingerprinting technologies.

8. International transfers

Our service providers may store or process information in other jurisdictions, including the United States and the European Economic Area. Where personal information is transferred from a jurisdiction that restricts cross-border transfers, we rely on recognised safeguards, such as adequacy decisions or standard contractual clauses approved by the relevant authority, together with supplementary measures where appropriate. Details of the safeguards applied to a particular transfer are available on request.

9. Retention

We retain personal information only as long as reasonably necessary for the purposes described in this policy and to meet legal, accounting, and reporting obligations. As a guide: enquiry and business-development records are retained for a reasonable period after the last substantive contact; account records for the duration of the relevant subscription and for a limited period thereafter; web-server logs for a limited period; and contractual and billing records for the period required by tax and commercial law. Where litigation or an investigation is reasonably anticipated, relevant records are preserved until the matter concludes. When retention ends, information is deleted or irreversibly anonymised.

10. Security

We maintain technical and organisational measures appropriate to the nature and sensitivity of the information we hold, including encryption of data in transit (TLS), delegated authentication through an established identity provider rather than local password storage, and access limited to those who need it. No security programme eliminates all risk, and transmission over the internet is never completely secure; we encourage business users not to include confidential information in unsolicited correspondence.

In the event of a breach of security safeguards involving personal information that meets applicable notification thresholds, we will notify affected individuals and the relevant authorities as required by law and will maintain the records that the law requires.

11. Your rights

Subject to applicable law, you may have the right to: request access to the personal information we hold about you and information about how it is processed; request correction of inaccurate or incomplete information; request deletion; request a portable copy; object to or request restriction of certain processing (including direct marketing, which we will always stop on request); and withdraw consent where processing is based on consent, without affecting prior processing.

Requests should be sent to support@carbonqry.com. We may need to verify your identity before acting on a request, and we will respond within the period required by applicable law (one month under the GDPR, thirty days under PIPEDA, subject to permitted extensions). We will not discriminate against you for exercising any of these rights. If you are an authorised user under a firm’s subscription, some requests (for example, deletion of an active account) may need to be coordinated with your firm as the subscriber.

12. Jurisdiction-specific provisions

12.1 European Economic Area and United Kingdom

If you are in the EEA or the UK, the controller of your personal information is SGG Analytics Ltd. You have the rights described in section 11 under the GDPR/UK GDPR, and the right to lodge a complaint with your local supervisory authority or, in the UK, the Information Commissioner’s Office. Where we rely on legitimate interests, we have balanced those interests against your rights and will provide information about the balancing on request.

12.2 Canada

We comply with PIPEDA and applicable provincial private-sector privacy legislation. Our practices are based on the ten fair information principles, including accountability, limiting collection, and openness. You may address a challenge concerning compliance to our Privacy Officer at support@carbonqry.com; if you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.

12.3 California

In the preceding twelve months we have collected the categories of personal information described in section 3 (identifiers, professional information, internet activity) for the purposes described in section 4. We do not sell personal information and have not done so in the preceding twelve months; we do not share personal information for cross-context behavioural advertising; and we do not use or disclose sensitive personal information for purposes requiring a right to limit. California residents may exercise the rights in section 11, including through an authorised agent, and will not be discriminated against for doing so.

13. Changes to this policy

We review this policy periodically and update it to reflect changes in our practices, technology, or the law. The effective date and version number above identify the current revision. Material changes will be flagged prominently on the Site and, for authorised platform users, notified through the platform or by email. Earlier versions are available on request.

14. Contact us

Privacy enquiries, requests, and complaints:
SGG Analytics Ltd
Attn: Privacy Officer
support@carbonqry.com