Privacy notice

Last updated [DATE]

This notice explains how [LEGAL ENTITY], trading as Climate Sprints, handles personal data collected through climatesprints.com. We are the data controller.

What we collect

Information you give us

Through the sign-up form: first name, last name, company name (optional), email address, the categories you select, and anything you write in the free-text field. Through our scheduling link: your name, email, and the details you supply when booking. Through direct correspondence: whatever you choose to send us.

Information collected automatically

If you accept analytics cookies, Google Analytics 4 collects usage data including pages viewed, approximate location derived from IP address, device and browser type, and referring source. Analytics do not run until you consent, and you can withdraw consent at any time.

Our hosting provider processes technical logs, including IP addresses, for security and to deliver the site. This happens regardless of cookie choices and is necessary for the site to function.

Why we use it, and on what basis

• To reply to you and to discuss a possible engagement. Legitimate interest in responding to an enquiry you initiated, and steps taken at your request prior to a contract.
• To send you the updates you selected. Your consent, withdrawable at any time.
• To understand how the site is used. Your consent to analytics cookies.
• To keep the site secure and available. Legitimate interest in operating and protecting the service.
• To meet legal and accounting obligations. Compliance with a legal obligation.

Who processes it

We use a small number of service providers, each acting on our instructions under a data processing agreement:

• Cloudflare — hosting, content delivery, security.
• Loops — storage of contact details and delivery of email you have asked for.
• Google Analytics 4 — site analytics, only with your consent.
• Calendly — scheduling, if you book a call.
• [EMAIL PROVIDER] — business correspondence.

We may also disclose personal data to professional advisers, or where required by law or to establish or defend legal claims.

International transfers

We are based in the United States and several of our providers are as well. If you are in the European Economic Area, the United Kingdom or Switzerland, your personal data will be transferred outside your jurisdiction. Those transfers rely on the European Commission’s Standard Contractual Clauses, the UK Addendum where applicable, or the EU–US Data Privacy Framework where the provider is certified. You may request details of the safeguards in place.

[Confirm with counsel whether an Article 27 EU/UK representative is required. It generally is where a US controller offers services to, or monitors, individuals in the EU or UK. Given the outbound programme to European allocators, assume yes until told otherwise.]

How long we keep it

• Mailing list — until you unsubscribe or ask to be removed, and for a short period afterwards to honour the request.
• Enquiries that do not become engagements — [24 months] from last contact.
• Client records — for the term of the engagement and as long afterwards as tax, accounting and limitation periods require.
• Analytics — per the retention period configured in GA4, currently [14 months].
• Security logs — per our hosting provider’s standard retention.

Your rights

Depending on where you live, you may have the right to access the personal data we hold about you; correct it; have it deleted; restrict or object to how we use it; receive it in a portable format; withdraw consent at any time without affecting processing already carried out; and not be subject to decisions made solely by automated means. We do not make automated decisions that produce legal or similarly significant effects.

If you are in the EEA, UK or Switzerland you may also lodge a complaint with your supervisory authority. If you are a California resident you have rights under the CCPA/CPRA including access, deletion, correction and to know what is collected. We do not sell or share personal information as those terms are defined under that law, and we will not discriminate against you for exercising any right.

To exercise any right, write to [PRIVACY EMAIL]. We will respond within the period the applicable law requires, and within one month for requests under the GDPR.

Cookies

The site sets no non-essential cookies until you choose. The banner offers a genuine choice, analytics tags do not load unless you accept, and you can change your decision at any time from [link to cookie settings]. Strictly necessary cookies used for security and to remember your cookie choice are always active.

Children

This site is directed at professional audiences and is not intended for anyone under 16. We do not knowingly collect personal data from children.

Changes

We may update this notice. Material changes will be reflected in the date above, and where the law requires it we will contact you.

Contact

[PRIVACY EMAIL]
[LEGAL ENTITY, REGISTERED ADDRESS]