SUSTAINFINITY
Privacy Policy
Sustainfinity
Effective Date: 1 September 2020
1. Introduction
Sustainfinity is a corporate sustainability management and reporting platform developed by InnoEM.
This Privacy Policy explains how INNOEM LTD ("InnoEM", "Sustainfinity", "we", "us" or "our") collects, uses, stores, shares and protects personal data when individuals visit our websites, use the Sustainfinity platform, communicate with us, participate in surveys administered through the platform or otherwise interact with our services.
INNOEM LTD is registered in England and Wales under company number 17383897, with its registered office at Parade Enterprise Centre, Office 2, Chester, CH1 5HN, United Kingdom.
This Privacy Policy applies to www.sustainfinity.com, app.sustainfinity.com and other Sustainfinity services that refer to this Policy.
Depending on the context, Sustainfinity may act either as a data controller or as a data processor.
When we determine the purposes and means of processing personal data, for example in relation to website visitors, account administrators, prospective customers and our own business contacts, we generally act as the data controller.
When a customer organization uses Sustainfinity to collect, upload, manage or analyse personal data relating to its employees, stakeholders, suppliers or other individuals, we generally process that data on behalf of the customer and act as a data processor. In such cases, the customer organization remains responsible for determining the purposes and lawful basis of the processing.
2. Personal Data We Collect
Depending on how you interact with Sustainfinity, we may collect the following categories of personal data.
Account and identification information: name, surname, username, job title, department, organization and other account information.
Contact information: business email address, telephone number and other contact information you provide.
Organization information: company name, business unit, facility, role and organizational relationship.
Account and authentication information: login information, authentication records and information necessary to maintain the security of your account.
Technical and usage information: IP address, browser type, operating system, device information, login history, activity logs, pages viewed, feature usage and similar technical information.
Communications: messages sent through our contact forms, support requests, emails, meeting records and other communications with us.
Commercial and billing information: subscription information, purchased services, billing details, transaction records and information required for invoicing.
Survey and stakeholder information: information submitted through stakeholder engagement, SDG alignment, materiality assessment or similar surveys administered through Sustainfinity.
Customer Content: information, documents, datasets, sustainability metrics, carbon accounting data, reports, evidence files and other materials uploaded or submitted to the platform by customer organizations and their authorized users.
Cookie and similar technology data: information collected through cookies and similar technologies as described below.
We ask customers not to upload personal data that is unnecessary for their use of the Services and not to submit special category or sensitive personal data unless there is a legitimate need and an appropriate legal basis for doing so.
3. How We Use Personal Data
We may process personal data for the following purposes:
-
to create and administer Sustainfinity accounts;
-
to authenticate users and protect accounts and the platform;
-
to provide, operate, maintain and improve the Sustainfinity platform;
-
to provide stakeholder analysis, sustainability management, KPI tracking, carbon accounting, reporting and related functionality;
-
to provide artificial intelligence assisted features requested by users;
-
to provide technical support, customer service, training and consulting services;
-
to respond to enquiries and demonstration requests;
-
to administer subscriptions, contracts, payments and invoicing;
-
to communicate with customers regarding the Services, security, operational matters and service updates;
-
to analyse platform performance and improve functionality and user experience;
-
to detect, prevent and investigate fraud, misuse, security incidents and technical problems;
-
to comply with legal, regulatory, accounting and tax obligations;
-
to establish, exercise or defend legal claims; and
-
where permitted by applicable law, to provide information about Sustainfinity products, services, events or relevant business developments.
4. Legal Bases for Processing
Where the UK GDPR, EU GDPR or similar legislation applies, we process personal data on one or more of the following legal bases:
Performance of a contract: where processing is necessary to provide the Services or take steps requested before entering into a contract.
Legitimate interests: where processing is necessary for our legitimate business interests, including operating and securing the Services, providing customer support, improving our products and conducting appropriate B2B communications, provided those interests are not overridden by the rights and interests of individuals.
Legal obligation: where processing is necessary to comply with applicable law, regulation, court order, tax, accounting or other legal requirements.
Consent: where consent is required by applicable law, including for certain marketing activities or non-essential cookies and similar technologies.
Where Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") applies, personal data is processed in accordance with the processing conditions provided under the KVKK and other applicable legislation.
Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
5. Customer Data and Our Role as Data Processor
Organizations using Sustainfinity may upload or collect personal data through the platform.
In relation to such Customer Data, the relevant customer generally acts as the data controller and Sustainfinity acts as a data processor or service provider acting on the customer's instructions.
The customer is responsible for ensuring that it has an appropriate legal basis for collecting and processing Customer Data, providing any required privacy notices and obtaining any required permissions or consents.
Where required, the processing of Customer Data may be governed by a separate Data Processing Agreement ("DPA") between Sustainfinity and the customer.
Requests concerning Customer Data should normally be directed to the organization that collected or submitted the data. Where appropriate, we will assist our customers in responding to data subject requests in accordance with applicable law and our contractual obligations.
6. Artificial Intelligence Assisted Features
Certain Sustainfinity features use artificial intelligence technologies to assist with tasks such as analysis, strategy development, carbon footprint reporting and sustainability report generation.
Information submitted to these features may be processed using technology and infrastructure provided by third-party service providers acting on our behalf.
AI-generated outputs may be based on Customer Content and other information supplied through the platform.
Sustainfinity implements reasonable contractual, organizational and technical safeguards for personal data processed through these functions.
Users should avoid submitting unnecessary personal data or sensitive information to AI-assisted functions.
AI-generated content must be reviewed by appropriately qualified users before it is relied upon, published or used for regulatory, assurance or decision-making purposes.
7. Sharing of Personal Data
We do not sell personal data.
We may share personal data with service providers and other recipients where necessary for legitimate business and operational purposes, including:
-
cloud hosting and infrastructure providers;
-
IT, cybersecurity and authentication providers;
-
analytics and website technology providers;
-
communication and customer support providers;
-
payment, accounting and invoicing providers;
-
professional advisers, auditors and consultants;
-
artificial intelligence and data processing service providers;
-
government authorities, regulators, courts or law enforcement authorities where required by law; and
-
potential buyers, investors or successor entities in connection with a merger, acquisition, restructuring or sale of all or part of our business.
Service providers that process personal data on our behalf are required to process such information only for authorized purposes and subject to appropriate confidentiality and data protection obligations.
8. International Data Transfers
Sustainfinity operates internationally and may process personal data in the United Kingdom, Türkiye, the European Economic Area and other jurisdictions in which our service providers operate.
Where personal data is transferred internationally, we take steps required under applicable data protection laws to protect that information.
Depending on the relevant jurisdiction and transfer, these safeguards may include adequacy regulations or decisions, approved standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, standard contracts or other appropriate safeguards recognized under the KVKK, or another legally recognized transfer mechanism.
9. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected.
Retention periods depend on factors including:
-
the nature and sensitivity of the information;
-
the duration of the customer relationship or account;
-
the purposes for which the information is processed;
-
contractual requirements;
-
applicable limitation periods;
-
security and dispute-resolution requirements; and
-
legal, tax, accounting and regulatory obligations.
Customer Data is normally retained for the duration of the relevant customer relationship and is deleted, anonymized or returned in accordance with the applicable agreement and our retention procedures, unless continued retention is required by law.
10. Cookies and Similar Technologies
Our websites and platform may use cookies, local storage and similar technologies for purposes including authentication, security, remembering user preferences, website functionality, analytics and performance measurement.
Cookies that are strictly necessary for the operation and security of the Services may be used without consent where permitted by law.
Where applicable law requires consent for analytics, advertising or other non-essential technologies, such technologies will be used on the basis of the user's consent.
Users can manage available cookie preferences through our cookie consent mechanism and, where applicable, through their browser settings.
Additional information about individual cookies and technologies may be provided through our cookie settings interface.
11. Marketing Communications
Where permitted by applicable law, we may send business communications concerning Sustainfinity products, services, events and relevant developments.
Where consent is legally required, such communications will only be sent with the required consent.
You may unsubscribe from marketing communications at any time by using the unsubscribe mechanism in the communication or by contacting us.
Service-related and administrative communications, such as account, security or contractual notices, are not marketing communications and may continue where necessary to provide the Services.
12. Data Security
We implement reasonable technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss, destruction or misuse.
These measures may include access controls, authentication mechanisms, encryption where appropriate, logging, backups, security monitoring and organizational access restrictions.
However, no electronic transmission, storage or information system can be guaranteed to be completely secure.
Customers and users are responsible for maintaining the confidentiality of their credentials and for promptly notifying us if they suspect unauthorized access to an account.
13. Your Rights
Depending on your location and the law applicable to the processing of your personal data, you may have rights including the right to:
-
request information about whether and how your personal data is processed;
-
access your personal data;
-
request correction of inaccurate or incomplete personal data;
-
request deletion or erasure of personal data;
-
request restriction of processing;
-
object to certain processing activities;
-
withdraw consent where processing is based on consent;
-
request data portability where applicable;
-
request information about recipients to whom personal data has been disclosed;
-
object to certain decisions based solely on automated processing where applicable; and
-
submit a complaint to a competent data protection authority.
These rights are subject to the conditions and exceptions provided by applicable law.
Where the KVKK applies, data subjects may also exercise the rights provided under Article 11 of the KVKK.
14. Regulatory Complaints
Depending on your location and applicable law, you may have the right to lodge a complaint with a competent supervisory authority.
This may include the UK Information Commissioner's Office ("ICO"), the Turkish Personal Data Protection Authority ("KVKK Authority"), an EU/EEA data protection authority or another competent authority.
We encourage individuals to contact us first so that we can attempt to address their concerns.
15. Children's Privacy
Sustainfinity is a business-to-business platform and is not intended for use by children.
We do not knowingly seek to collect personal data directly from individuals under the age of 18 through account registration.
16. Third-Party Websites and Services
Our Services may contain links to third-party websites or integrate with third-party services.
This Privacy Policy does not govern independent processing carried out by third parties acting as separate data controllers. We recommend reviewing the privacy information provided by those third parties.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our Services, processing activities, technology or applicable law.
The current version will be published on our website together with its effective date.
Where required by law or where changes materially affect individuals' rights, we will provide additional notice.
18. Contact Us
For questions, requests or concerns regarding this Privacy Policy or the processing of personal data, please contact:
INNOEM LTD
Sustainfinity
Parade Enterprise Centre, Office 2 Chester, CH1 5HN United Kingdom
Email: info@sustainfinity.com