Privacy Notice
This notice explains what personal data Aretia Climate collects, why we collect it, how we use it, and the rights you have over it. It applies to all users of the Aretia Climate platform and our public website.
1. Data Controller
The data controller responsible for your personal data is:
1000 N West Street, Wilmington, Delaware 19801, United States
Data Protection contact: legal@aretiaclimate.com
For all privacy-related enquiries · including exercising your rights · contact us at the address above. We aim to respond to all requests within five business days.
2. Personal Data We Collect
We collect only the personal data necessary to provide our services (data minimisation, ISO 27701 Section 7.4.5).
| Category | Data Elements | Source |
|---|---|---|
| Identity data | Full name, job title, employer | Provided by you at signup |
| Contact data | Email address, country | Provided by you at signup |
| Organisation data | Company name, sector, headcount, website | Provided by you at signup |
| Account credentials | Hashed password (bcrypt, never stored plaintext) | Provided by you |
| Platform usage data | Feature usage, report generation, session timestamps | Collected automatically |
| Climate & emissions data | GHG inventory figures, asset data, scenario inputs | Provided by you or your organisation |
| Payment data | Billing email, subscription tier (no card numbers · processed by Stripe) | Stripe, Inc. |
| Technical data | IP address, browser type, device type, error logs | Collected automatically |
| Cookie data | Session cookies, preference cookies (see Section 8) | Collected automatically |
We do not process special category data (GDPR Article 9) or data relating to children under 18.
3. Purposes and Legal Bases (ISO 27701 Section 7.2.1)
Every processing activity has a documented purpose and a lawful basis under GDPR Article 6.
| Purpose | Legal Basis | Detail |
|---|---|---|
| Account creation & authentication | Contract (Art. 6(1)(b)) | Required to provide access to the platform |
| Platform service delivery | Contract (Art. 6(1)(b)) | Running climate risk, emissions, and reporting tools |
| Subscription management & billing | Contract + Legal obligation (Art. 6(1)(b)(c)) | Processing payments and maintaining financial records |
| Customer support | Legitimate interests (Art. 6(1)(f)) | Responding to support requests and troubleshooting |
| Platform analytics & improvement | Legitimate interests (Art. 6(1)(f)) | Improving features and fixing issues; you may opt out |
| Security & fraud prevention | Legal obligation + Legitimate interests (Art. 6(1)(c)(f)) | Maintaining platform integrity and preventing abuse |
| Marketing communications | Consent (Art. 6(1)(a)) | Sending product updates and climate insights; withdraw any time |
| Legal compliance | Legal obligation (Art. 6(1)(c)) | Meeting regulatory requirements (GDPR, accounting, tax) |
| Anonymised research & benchmarking | Legitimate interests (Art. 6(1)(f)) | Aggregated, non-identifiable industry benchmarks |
4. Data Retention (ISO 27701 Section 7.6)
We retain personal data only as long as necessary for the purpose it was collected, or as required by law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account & profile data | 5 years after account closure | Contractual records |
| Climate & emissions data | Duration of subscription + 7 years | IFRS S2 audit trail requirements |
| Billing records | 7 years | UK/US financial regulation |
| Support correspondence | 3 years | Dispute resolution |
| Security / access logs | 2 years | Incident investigation |
| Marketing consent records | Until consent withdrawn + 3 years | Evidence of consent (GDPR Art. 7) |
| Anonymised analytics | Indefinite (not personal data) | Aggregated benchmarks only |
6. Security Measures (ISO 27701 Section 7.7 · ISO 27001)
Aretia Climate maintains an Information Security Management System (ISMS) aligned to ISO/IEC 27001:2022. Key technical and organisational measures include:
7. Your Rights (ISO 27701 Section 7.3 · GDPR Art. 12·22)
You have the following rights regarding your personal data. We respond to all valid requests within 30 days (extendable to 90 days for complex requests with notice).
9. Children's Data
The Aretia Climate platform is intended for professional use only. We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has provided data, contact us at legal@aretiaclimate.com and we will delete it promptly.
10. Changes to This Notice
We may update this Privacy Notice periodically to reflect changes to our practices or legal requirements. When we make material changes we will notify active users by email at least 30 days in advance and update the “Effective” date at the top. Continued use of the platform after the effective date constitutes acceptance of the updated notice.
Previous versions of this notice are available on request at legal@aretiaclimate.com.
11. Contact Us
1000 N West Street, Wilmington, Delaware 19801, United States
legal@aretiaclimate.com
UK residents may contact the Information Commissioner's Office (ICO).
This Privacy Notice was prepared in accordance with ISO/IEC 27701:2019 (Privacy Information Management), ISO/IEC 27001:2022 (Information Security Management), and the EU General Data Protection Regulation (GDPR) 2016/679. Version 1.0 · effective 19 June 2026.