LAST UPDATED 5 May 2024

Privacy Policy

1. Scope and General Information

This Privacy Policy describes the practices of GHGmetric, Inc. (“GHGmetric”, “we”, “us”, or “our”) concerning individuals’ persona information that we may collect via or use in conjunction with our website at https://www.ghgmetric.org/ (or other of our websites that link to this Privacy Policy, collectively referred to as our “website”), or our apps or any other products and services that we offer, that refer or link to this Privacy Policy.

More specifically, this Privacy Policy is provided to inform you about certain features of our privacy practices, including the following topics:

• What personal information we collect from and about you, how it is used and with whom it may be shared
• Choices that may be available to you regarding your personal information
• Rights you may have to access, correct, delete or take other actions in connection with personal information about you that we hold

Please review this Privacy Policy to understand our personal information practices, and as you review, please keep in mind the following points:

• Updates. We may change this Privacy Policy from time to time to reflect changes in our personal information practices. We will notify you of any material changes by updating the “Last Updated” date above to reflect when revisions are published.  We may also provide notification by other means that we reasonably believe will reach you.
• Additional privacy disclosures. In addition to this Privacy Policy, we may use other means to describe our collection and use of personal information in privacy disclosures specific to any of our products or services. If any such product- or service-specific disclosures are in conflict with this Privacy Policy, then the other information will control over this Privacy Policy.

‍

2. Personal Information GHGmetric Collects and How We Collect It

a. Information you provide to us. We may collect personal information that you provide to us directly, including identity information (your name), contact information(email, phone number or postal address), professional information (company and title) or other information that you provide to us, which you will be aware of at the time. We may collect personal information from you in a variety of circumstances, including the following:

• When you use and submit information via our website, apps or other products or services
• When you sign up to receive updates from us through a contact form on our website
• When you communicate with us, via email or otherwise, including feedback and inquiries
• When you participate in one of our surveys or other events

b. Information we collect automatically. We also collect personal information automatically when you interact with our website, apps or other products and services. This information may be provided by your device or browser, or we may record any actions that you take while interacting with our products and services. This information may include your device or browser type, operating system, Internet Protocol (“IP”) address, domain name, referring/exit pages, date/time stamp and duration of your use of our products and services, and other clickstream data. We use this information to analyze trends, administer our website, gather demographic information about our user base as a whole, and help us develop and tailor our products and services to our users’ needs.

c. Cookies and similar tracking technology. Like most websites and online services, we use cookies, pixel tags and similar tracking technologies in order to collect information automatically, as described above, and to improve your experience of our website, apps and other products and services.   For further information about our use of cookies please see our cookies policy, which is available here.

d. Data from your employer: If your employer creates an account for you on the GHGmetric app, they will provide us with your name, email address and work title.

e. Data from third parties: We may also collect information about you from publicly available sources (including social media platforms like LinkedIn) that is provided to us via third party tools.

‍

3. How We Use Your Personal Information

a. To operate GHGmetric products and services, including administrative purposes, and to deliver information you have requested from us. We may use your personal information set out in paragraphs (a) to(d) in section 2 above to:

• Identify you as an authorized user of our products and services
• Send you a welcome email to verify ownership of the email address provided when you signed up to receive updates, and other administrative information about your business relationship with us
• Operate, maintain, and improve our products and services and conduct our business
• Respond to communications you submit to us, including sending any information you request regarding GHGmetric products and services
• Process payments and similar transactions

b. To develop our business. We may use your personal information set out in paragraphs (a) to(d) in section 2 above to:

• Further develop and add to our products and services, including by analysing user engagement with our products and services

c. For safety and security purposes. We may use your personal information set out in paragraphs (a) to(d) in section 2 above to:

• Protect, investigate and deter any fraudulent, unauthorized or illegal activity in connection with our products and services, and to protect our and others’ safety, property and legal rights
• Comply with our legal and industry obligations

d. To market our products and services. We may use your personal information set out in paragraphs (a) and(e) in section 2 above to:

• Send you information about promotions, upcoming events, and other news about products and services offered by us, or newsletters, offers or similar materials, and to tailor such marketing materials to your interests
• Pursue our marketing interests, such as direct marketing and research and development, including research to better understand our customer sand markets relevant to our business

e. Anonymous information. We may use personal information to create anonymous data by aggregating, anonymizing or de-identifying such personal information, so that the resulting data does not identify and could not reasonably be linked to specific individuals, households or devices. We may use and disclose this anonymous data to analyse and develop our products and services and improve website navigation or app design, or for any other lawful purpose.

‍

4. Legal Basis for Processing

Where you are resident in the EU or EEA – or in a jurisdiction subject to EU/EEA data protection laws, or one subject to data protection laws aligned with those of the EU/EEA, such as the UK – the legal bases on which we collect, process and transfer your data in the manner described above are (i) where it is in our legitimate interests to do so, or (ii) to comply with our legal and regulatory obligations.  We will only process your personal data for the purposes of our legitimate interests where we are of the view that to do so would not constitute an unwarranted interference with your own interests or fundamental rights and freedoms.

We set out more detail below in relation to the legal basis for our processing by reference to each of the purposes for processing set out in section 3.

a. To operate GHGmetric products and services, including administrative purposes, and to deliver information you have requested from us.

• Our legal basis for processing your personal data in these circumstance is that it is necessary for the purposes of our legitimate interests.
• The legitimate interests for which we process your personal data include our legitimate interests in:

(i) offering our services to your employer

(ii) responding to queries from users and supporting use of our products

(iii) conducting our business in a responsible and commercially prudent manner

• The legitimate interests also include your employer’s legitimate interest in receiving our services.

b. To develop our business.

• Our legal basis for processing your personal data in these circumstance is that it is necessary for the purposes of our legitimate interests.  
• The legitimate interests for which we process your personal data include our legitimate interests in:

(i) developing and improving our products and services

(ii) conducting our business in a responsible and commercially prudent manner

(iii) pursuing our corporate and social responsibility objectives

c. For safety and security purposes.

• Our legal basis for processing your personal data in these circumstance is that it is necessary for the purposes of our legitimate interests, and in order to comply with our legal obligations.
• The legitimate interests for which we process your personal data include our legitimate interests in:

(i) protecting our business from fraudulent, unauthorized or illegal activity

(ii) to protect our safety, property and legal rights

(iii) protecting other users of our services

(iv) conducting our business in a responsible and commercially prudent manner

(v) preventing, investigating or detecting theft, fraud or other criminal activity

d. To market our products and services.

• Our legal basis for processing your personal data in these circumstance is that it is necessary for the purposes of our legitimate interests.
• The legitimate interests for which we process your personal data include our legitimate interests in marketing our products and services.

e. Anonymous information.

• Our legal basis for processing your personal data in these circumstance is that it is necessary for the purposes of our legitimate interests.  
• The legitimate interests for which we process your personal data include our legitimate interests in:

(i) developing and improving our products and services

(ii) conducting our business in a responsible and commercially prudent manner

(iii) pursuing our corporate and social responsibility objectives

‍

5. How We Disclose Your Personal Information to Third Parties

We may disclose your personal information as described below and as described elsewhere in this Privacy Policy. All personal information described in section 2 above may be disclosed to each category of recipient listed below, unless specifically stated otherwise.

a. Service providers. We may share your personal information with third-party service providers that provide services to GHGmetric that support the operation and management of our products and services or our business operations, such as IT infrastructure, auditing, insurance, legal advice. These third-party service providers are required to use your personal information only to provide the products and services that have been requested by GHGmetric.

b. Your Company. If you use our products or services through your employer or a company, your name, role and work email address are accessible to your employer through GHGmetric.

c. Affiliates. We may share your personal information with parent and subsidiary companies, joint venturers, or other companies under common control with us, in which case we will require those recipients to honor this Privacy Policy.

d. Legal compliance. We may share personal information as we believe necessary or appropriate to comply with applicable laws and regulations, including to cooperate with law enforcement; to protect our or others’ rights, privacy, property or safety, as by making and defending legal claims; to detect, deter or take action against illegal, unauthorized, fraudulent or otherwise harmful activities, and activities that violate our policies; or for other legal reasons. These obligations may arise from laws, regulations, or orders or requests from authorities outside your country of residence.

e. In connection with a sale or other business transaction. We may disclose or transfer business assets, which may include your personal information, in connection with a business transaction (or potential business transaction),such as a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock(including in connection with any bankruptcy or similar proceedings), including any for due diligence purposes related to such a transaction. Disclosures made in connection with a business transaction will be made in accordance with applicable law.

f. With your consent. We may share your personal information with other parties with your consent or when you choose to share such information.

No sharing with third parties for their direct marketing purposes. It is our policy not to provide your personal information to third parties for those third parties’ direct marketing purposes without your consent.

‍

6. How Long We Maintain Personal Information

We may retain personal information for as long as it is necessary or permitted in light of the purpose(s) for which it was obtained, and as permitted under applicable law. The criteria used to determine our retention periods include:

• Our continuing business relationship with you or your company;
• Our legitimate business need for the personal information;
• Any legal obligations to retain information; and
• Whether retention is advisable to protect our or others’ rights, safety or property, or to detect or prevent fraud or other illicit activities.

As a general guide, if it is not deleted at an earlier point, all data is considered for deletion after a maximum of 7 years.

‍

7. International Transfers

As such, your personal information is hosted and accessed from the U.S.A.  Where your employer sets up your GHGmetric account it will transfer personal information to us in the U.S.A. in accordance with applicable data protection laws.  In order to ensure that this transfer complies with the requirements under EU law, we enter into EU Commission approved standard contractual clauses, as appropriate to the transfer. If you would like more information please contact us using the information provided in the ‘contact us’ section below.

‍

8. Your Choices

You have certain choices concerning our use of your personal information, described here.

a. Opt-out of marketing communications: You may opt out of marketing communications from us at any time by following the opt-out or unsubscribe instructions provided within our marketing communications, or by emailing us at [email protected]. Please note that if you opt out of marketing communications, we may continue to send you necessary information about our business relationship or other transactions that you may have with us.

b. Cookies. Your internet browser may be configured to reject or disable cookies, as described in documentation for your browser. Please understand, however, that rejecting or disabling cookies may affect or interfere with your experience of our products and services, or your ability to access areas or functions of our website.  For further information about our use of cookies or other tracking technologies, described at (c) and (d) below, please see our Cookies Policy, available here.

c. Google Analytics. We use Google Analytics to help analyse how users use our website. Google Analytics uses Cookies to collect information, such as how often users visit our website, what pages they visit, and what other sites they used prior to coming to our website. We use the information we get from Google Analytics to improve our website and help us further develop our products and services. In general, we do not link the information generated through the use of Google Analytics with your personal information. Although Google Analytics plants a persistent cookie on your device to identify you as a unique user the next time you visit our website, the cookie cannot be used by anyone but Google. Google’s ability to use and share information collected by Google Analytics about your visits to our website is described in Google’s privacy policy available at https://policies.google.com/privacy. You can opt out of Google Analytics’ collection and processing of your data by using Google tools available at https://tools.google.com/dlpage/gaoptout.

d. Do not track. We do not currently respond to “do not track” or similar signals that users may configure in their browsers, in part because there is not currently a strong consensus around their use. For more information about “do not track” signals, please visit https://allaboutdnt.com/.

e. Exercising rights and making inquiries concerning your personal information.

Depending on your place of residence and applicable laws, you may have certain rights with respect to personal information about you, such as the following rights, which may apply in certain circumstances and subject to certain restrictions:

• Right to access the data – You may have the right to request a copy of the personal information that we hold about you, together with other information about our processing of that personal information.
• Right to rectification – You may have the right to request that any inaccurate information that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
• Right to erasure – You may have the right to request us to delete personal information that we hold about you. This is sometimes referred to as the right to be forgotten.
• Right to restriction of processing or to object to processing – You may have the right to request that we no longer process your personal information for particular purposes, or to object to our processing of your personal information for particular purposes.
• Right to data portability – You may have the right to request us to provide you, or a third-party, with a copy of your personal information in a structured, commonly used machine readable format.
• Right to withdraw your consent – Where our processing of your personal information is based on you having provided your consent, you have the right to withdraw such consent.

Please note that these rights are not absolute, and are subject to certain restrictions and exemptions.  For example, the right to erasure of personal information will not apply where we have a legitimate reason to continue to hold such data.

If you wish to exercise rights that you may have under applicable law or make similar inquiries, please email us at [email protected] and make clear your place of residence. Please understand that we may take reasonable steps to confirm your identity and to confirm that you hold any rights that you wish to exercise. If you do not provide information sufficient to verify your identity, we may, in some circumstances, be unable to carry out your request.

Please also understand that we may hold information about you on behalf of one of our clients. In those cases, we may not be able to accommodate your request to exercise rights, and we will direct you or your request to the business that controls the personal information.  In those circumstances, we are not the controller of your personal data and queries should be directed to the client organization.

f. Complaints

If you are resident in the EU or EEA, or otherwise subject to EU/EEA data protection laws, you have the right to make a complaint at any time to the relevant data protection supervisory authority. A list of all data protection supervisory authorities and their contact details is available here, which will help you identify the appropriate supervisory authority for your complaint. Similarly, residents of the UK have a right to make a complaint at any time to the UK Information Commissioner’s Office (ICO). (Residents of other jurisdictions may have similar rights to make a complaint to their local data protection supervisory authorities.)

‍

9. Information Security

We take reasonable precautions designed to protect your personal information that we hold, including applicable organizational, technical, and physical measures.

Please understand, however, that risks to security are inherent and inevitable in all digital information technologies and any transfer of information via the internet, and we cannot guarantee the security of your personal information.

Please also understand that if you are provided with an online account or login credentials, the security of your login and personal information is your responsibility as well. Do not share your login credentials or give others access your account.

‍

10. Third-Party Sites and Services

Our products and services may contain links to other websites, applications or other services that are of interest. We do not have any control over these third-party sites or services, and once you leave our website, or our products and services, we are not and cannot be responsible for the protection and privacy of any information which you provide to third parties. You should exercise caution and review any privacy policies applicable to the third-party sites and services in question.

‍

11. Contact Us

GHGmetric is located at United Kingdom, and it is the company responsible for the collection, use, and disclosure of your personal information under this Privacy Policy.

If you have any comments or questions about this Privacy Policy or our privacy practices, please contact us by email at [email protected].