Combatting Carbon Privacy Policy & Data Protection

1. Who We Are

Name: Combatting Carbon Limited

Address: 32 Pembroke Avenue, Wirral, CH46 0TP

Phone Number: 0151 364 2468

Email: contact@combattingcarbon.com

Website: www.combattingcarbon.com

2. The Type of Personal Information We Collect

Combatting Carbon is comprised of two platforms / interfaces:

• Our Greenhouse Gas emissions reporting platform, in partnership with SwiftCase.

• Combatting Carbon Travel Tracker, a mobile application to support companies in collecting and reporting vehicle travel emissions.

2.1 Combatting Carbon Reporting Platform

If you are a company we do business with, to onboard your company we will process some personal data,

as well as collecting information on your emissions activities and how your company operates. These emissions activities will be in line with the Greenhouse Gas Protocol Scopes 1, 2 and 3 emissions.

We may process the following personal data to facilitate our business relationship with the company you represent and set you up on our platform:

• Employee data (employee names and email addresses).

• Contact details (email addresses, full name, title, and telephone numbers).

• Company vehicle information (if relevant and necessary).

• Location data utilising GPS tracking (for tracking vehicle mileage to support our greenhouse gas emissions calculations) using our Combatting Carbon Travel Tracker.

• Vehicle registrations.

• Website analytics.

2.2 Combatting Carbon Travel Tracker

The Combatting Carbon Travel Tracker allows the company you represent to track travel and transport

emissions, utilising GPS location tracking. Our Travel Tracker is downloadable onto any smartphone via the Apple or Android Store.

All employees who download this application get their own individual login, accessed using their own unique password. To set employee accounts up, we will initially generate their individual, unique password for their first-time login. The User is then free to change and set their own personal password.

The personal information we need to set up a User on our Travel Tracker application is:

• Employee data (name and email address).

• Vehicle registrations — for us to allocate company vehicles to individual employee accounts.

• Location data utilising GPS tracking — to capture total mileage for journeys logged. A journey will only be locked, and GPS tracking initiated, once the individual employee has accepted and started the journey tracking themselves.

Journey and travel data is sent directly to our Combatting Carbon Reporting Platform (SwiftCase) and logged as emissions data. This data is then used by the company you represent to understand the magnitude of their travel emissions split across the company. We will not use this data for ourselves or share it with any third-party companies.

Our Combatting Carbon Travel Tracker application is limited to over 18's only.

3. How We Get the Personal Information and Why We Have It

Most of the personal information we process is provided to us directly by you for one of the following

reasons:

• For us to be able to support your company with undertaking accurate greenhouse gas emissions calculations.

• For us to be able to set up individual employee accounts on our Combatting Carbon Reporting Platform

(SwiftCase) and Combatting Carbon Travel Tracker Application for employees to access their individual accounts.

• To set up your company and employee details on our Combatting Carbon Travel Tracker Application for your company to be able to gather data on your travel emissions.

To undertake our services, we will need to gather data directly from the company you represent as well as any third-party companies (e.g. suppliers) that we identify as a 'Data Source' to be able to calculate your emissions activities.

If we receive any personal information indirectly from third-party individuals or companies, the initial contact will have been set up by yourself (or the company you represent) and it will only ever be used for your (the company you represent) use.

We may use an Application Programming Interface (API) to collect and report on your data. Depending on your company's requirements, there are two options for us to collect this data:

• You (or the company you represent) send the data directly to us via an API request — relevant documentation to do this will be provided by us.

• We use a Public Facing API and 'poll' your (or the company you represent's) system for the relevant data, collecting it on your behalf at set intervals.

If we were to use a Public Facing API, there would be no requirement to collect any personal information — we would only be after the relevant data to be able to undertake our emissions calculations on behalf of the company you represent.

We will not share your personal information with any third-party organisations or individuals.

We use the information you have given us to:

• Facilitate our business relationship with the company you represent.

• Communicate with the business you represent.

• Calculate greenhouse gas emissions on your company's behalf — this is the only use of any relevant personal information.

• Support your company's own internal and external reporting requirements — any data stored on our platform is for your company to use as you prefer.

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

• (a) Your consent. You may withdraw consent at any time by contacting contact@combattingcarbon.com.

• (f) Legitimate interest.

4. How We Store Your Personal Information

Combatting Carbon has partnered with SwiftCase to deliver our services. Any data we collect as a company `to deliver our services is stored on the SwiftCase platform.

4.1 How We Store Your Data on the SwiftCase Platform

The following information on data storage refers to the SwiftCase platform and, in turn, our Combatting Carbon Reporting Platform.

4.1.1 Security Measures

We take the protection of your data very seriously. Your personal information is stored on secure servers that use state-of-the-art security measures, including encryption, firewalls, and access controls designed to guard against unauthorised access, alteration, disclosure, or destruction.

4.1.2 Data Hosting

The data you provide is hosted on servers within the UK. We ensure our hosting services use the latest security technology and comply with the highest data protection regulations.

4.1.3 Data Encryption

All data is encrypted during transit and at rest, using industry-standard encryption protocols from the point of entry to our systems and as it is stored.

4.1.4 Access Control

Access to your data within SwiftCase is limited to authorised personnel who require it to provide services or maintain the platform. All staff with access are trained on data protection best practices.

4.1.5 Data Retention and Deletion

Your data is retained only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Upon termination of our services or at your request, we delete your personal information securely, purging it from our servers and overwriting any backups. If an employee ceases employment with the company you represent, once we are informed, we purge our data.

4.1.6 Regular Audits

We review our data storage policies and practices to ensure ongoing compliance with current data protection laws, with security measures subject to regular audits.

4.1.7 Compliance with Data Protection Laws

We adhere to the UK GDPR and other relevant data protection laws, and ensure any third-party service providers meet a similarly high standard of data protection.

4.1.8 Notification of Breaches

In the unlikely event of a data breach, we have a robust breach notification system in place and will notify affected individuals and any applicable regulators as required by law.

4.1.9 Updates to Our Storage Practices

Our data storage practices align with technological advancements and regulatory changes. Any changes will be communicated to you through an updated version of this privacy policy.

5. Your Data Protection Rights

Under data protection law, you have rights including:

Right of access. You have the right to ask us for copies of your personal information.

Right to rectification. You have the right to ask us to rectify personal information you think is inaccurate, or complete information you think is incomplete.

Right to erasure. You have the right to ask us to erase your personal information in certain circumstances.

Right to restriction of processing. You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Right to object to processing. You have the right to object to the processing of your personal information in certain circumstances.

Right to data portability. You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at contact@combattingcarbon.com if you wish to make a request.