Privacy notice

Your privacy matters to us. This notice explains, in plain language, what information we collect, why we collect it and the choices you have.

Summary

We collect only the information we need to run your membership, or to follow up when you show interest: your email address, a display name, your country and region, payment references from Stripe and, if you use them, your messages, posts and groups. Your card and bank details are handled by Stripe; we never receive your full card or account number. In our app, the few cookies we use are strictly necessary for it to work, and we count visits and clicks anonymously, without cookies. Our website climatecurrent.eco asks your consent before it uses any measurement or advertising cookies; its cookie page, climatecurrent.eco/cookies, lists them. If you choose to appear on the map, your postcode is used once to place you on it; we store only the place shown on the map, never the postcode. If someone tells us about the lender you work for and gives us your details, we tell you who gave them to us. If you do not want contact, we delete your contact record at once and keep only the minimum needed to make sure we do not contact you again. You can access, correct or delete your information at any time by emailing [email protected].

Who we are

ClimateCurrent OÜ (registry code 17585921), Tornimäe tn 5, 10145 Tallinn, Estonia, is the controller of your personal data. You can contact us at [email protected].

What we collect, why, and our legal basis

Information Purpose Legal basis

Email address Your account, sign-in links, receipts and service emails Contract

Your email address, if you ask to hear when membership opens Telling you once when membership opens; we then delete it Consent

Your email address, if you ask to hear when ClimateCurrent opens, and, if you came through a member's link, whose link it was, so that you can join beside them Emailing you when it opens and, until then, every week with news. You can unsubscribe in one click; we then delete your address and keep only the minimum needed to honour your choice Consent

Your email address, if you agree to receive news and updates Sending you news and updates from ClimateCurrent, including when giving opens, until you switch this off in your account or unsubscribe Consent

If you ask us to keep your place: your email address, your country and region, and the monthly amount you chose Emailing you about your place at most three times: when it is kept, on the day giving opens with your choice filled in, and a month before your place ends. You agree to this when you press "Keep my place". If you also tick the box, our weekly newsletter. Unsubscribing in one click stops every email about your place; your place stays kept until it ends. On the same page you can also erase your place and your details at once Consent

If you keep your place: your own link, and the people who kept their place through it. If you came through someone's link and confirmed that: whose link it was Two purposes, each with its own basis. (1) Your link, given only once you confirm your email address with our code: helping us limit links created in bulk by automated sign-ups, and the same person claiming the same people twice — Legitimate interests (preventing abuse of the share links). (2) Counting it, once, for the person whose link you used, when you take part and they are a member (paid or free). They never see your email address or your amount Legitimate interests (letting people see what they set in motion)

Display name, country and region Your membership; your country determines your currency, and your region whether ClimateCurrent is available there Contract

Your place on the map (only if you turn it on) Showing you on the map near your postcode. We store the place shown on the map, not the postcode, and you can move your place or turn it off. When you turn it off, your light is removed from the public map within 24 hours Consent

Who introduced you, and whom you introduce Showing how the network grows. Anyone who opens your introduction link sees your display name there Contract

Groups you join Running the group. Other members of a group see the name you use in it Contract

Messages and posts you send Delivering them to the people you send them to Contract

Automated checks, blocks and reports Keeping the community safe Legitimate interests

Your name, work email address and role (owner or admin), if you manage a company's participation; your company's billing address, tax numbers and references, and the result of the official check of its VAT or tax number; the kind and last four digits of a saved card or bank account (the details themselves stay with Stripe) Running the company's participation: the dashboard, invoices, automatic payment and service emails Legitimate interests (running the agreement with your company)

If you accepted the company terms for your company: your name, your email address, the time, and the version of the terms Keeping proof of what your company agreed Legitimate interests (being able to show what was agreed)

Your work email address, if your employer gives it to us, and whether you joined, whether the invitation could be delivered, and whether you stopped your employer's invitations Sending you a personal invitation to the place your employer pays for, and running those places Legitimate interests (offering you the place your employer pays for; running the places we provide)

If you stopped your employer's invitations: a coded fingerprint of your address Keeping your stop in force after your address itself is deleted, also if your employer adds it again Legitimate interests (respecting your objection)

If you sign up a company: your name, work email address, your note and the company details you enter, and, if you came through a member's link, whose link it was Setting up your company, and recording who introduced it Legitimate interests (setting up a business customer and showing how the network grows); steps at your request before an agreement

If you tell us your company is interested: your name and work email address; if you give them, your role, phone number and a note; the company's name, country and region, number of people, the amount per person, the currency and whether monthly or once; and, if you give it, its VAT number and the result of the official check Contacting you about your company's interest, and filling in the start form for you if your company starts. Nothing of it is shown publicly Consent

Your work email address, if you tick the newsletter box when your company shows interest Sending you our news every week, until you unsubscribe in one click Consent

If you tell us about a lender: your name, email address and, if you give it, phone number; the organisation's name, type, country and website; whether you can introduce us, and how you know the person you name Contacting the organisation about financing climate projects, and contacting you about it. We tell the person you name that their details came from you Consent

If someone names you as a contact at a lender: your name and at least one way to reach you directly (work email address, phone number or LinkedIn profile) and, if they give them, your role and how they know you. Without a direct way to reach you, we record only the organisation and nothing about you Contacting you about financing climate projects. See "If someone gives us your details as a contact at a lender" Legitimate interests (finding finance for climate projects)

A company's name, logo, story, website and place on Teal Pages, and the name of the admin who added them Showing the companies that take part Legitimate interests (the company's and ours)

What you type in a location or address field (a town, street or address) Suggesting places, through Geoapify; we do not store the typed text Legitimate interests (helping you find your place quickly)

Stripe's confirmation that your card or bank account was checked when you joined (the details themselves stay with Stripe) Keeping ClimateCurrent a community of real people Legitimate interests

Stripe references and amounts Processing contributions and keeping accounting records Contract; legal obligation (Estonian Accounting Act)

The network address used when you join or ask for a sign-in link Preventing abuse, such as mass sign-ups; deleted after 24 hours Legitimate interests

We need your email address, display name and country for membership. On the interest and introduction forms, the required fields are marked; without them we cannot handle your request. Other fields are optional. We do not make any automated decisions about you that have legal or similarly significant effects.

If your employer gives us your address

Your employer may give us your work email address so that we can offer you a place it pays for. We received it from your employer, not from you. Your employer decides whether to give it to us; we decide everything we do with it, and each of us is responsible for its own part.

We use it to send you a personal invitation, because your employer asked us to. Your employer may choose to send the invitations later. Then your invitation goes out by itself 30 days after your employer gave us your address, or seven days after your employer's first payment if that is later. Your employer's admins can ask us to send it again; we send no reminders of our own. We never use your address for news or marketing unless you ask us to.

If you do not join, we delete your address 90 days after the first invitation, and it then also leaves your employer's list. If your employer removes you from its list, we delete it 90 days later, or at once if your invitation had not gone out yet. If your employer starts setting up its participation but does not finish, we delete your address 30 days after it was entered.

Every invitation has a link to stop invitations from that employer. If you stop invitations from your company, we stop sending them. We keep a coded fingerprint so that the stop stays, also if your company adds your address again. You can also object at any time by emailing [email protected].

What your employer sees. Your company dashboard does not reveal your private membership activity. Information you choose to share in the company group is visible to the members of that group. In detail:

For your address, your employer's admins see only "Joined" or "Not joined", and whether the invitation could be delivered. If you stop its invitations, they see "Not joined". They never see your own contributions, your other accounts and groups, or your messages outside the company group. If you join, you are a member of your company's group. Its members, including your employer's admins, see the name and colour you use there and what you post there. In your company group, colleagues see your light; you can switch this off for the group at any time. They see your Ripple in the group's total only if you choose to show your impact. Your company also shows what its team sets in motion together: the total Ripple of the colleagues who joined. It appears on your company's dashboard and on its public page, also when only one colleague has joined. If only a few colleagues joined, this total can say something about what the people you introduced give.

If you have questions about why your employer gave us your address, ask your employer. For everything we do with it, ask us.

If someone gives us your details as a contact at a lender

Someone who knows you may tell us about the organisation you work for, so that we can talk to it about financing climate projects. They may give us your name, role, work email address, phone number and LinkedIn profile, and say how they know you. We received these details from that person, not from you.

We use your details only to contact you about financing, and we always tell you who gave them to us:

If we have your email address, we tell you in our first email. If we have not written to you within 25 days, we send you a short email that says who gave us your details and where to read this notice, and nothing else.

If we have only your phone number or LinkedIn profile, we tell you the first time we contact you, and within 30 days.

If you do not want contact, use the link in our email, reply to us or email [email protected], and we delete your contact record at once and keep only the minimum needed to make sure we do not contact you again. You can also object at any time, as described under "Your rights".

What others can see

Your display name is shown to anyone who opens your introduction link. In a group, its members see the name you use in that group. If you join through your employer, see "If your employer gives us your address" for what your employer and your colleagues see. If you sign up a company after following a member's link, that member is recorded as your company's introducer, and your company's tonnes count in their Ripple. They see how many companies are in their network. If your company is on the public map, it stands out on their map as part of their network. They never see who signed your company up, or any amount of money. Your place on the map, if you turn it on, is visible to everyone. No name ever travels with your light on the map. If you turn it off, your light leaves the public map within 24 hours. Your messages in a group are seen by the members of that group. Private messages are seen only by the people in the conversation. If you join the public boards, your public name and Ripple for your place are published worldwide on those boards. If you turn on Discover People, your discovery profile and whether you appear in nearby lists on group maps follow the choices in your profile settings. If you post notes, public notes and notes shown on the map can be seen by other members or by anyone on the web, depending on the audience you choose. If you respond to an event, organisers and other members who are going may see the address or link you receive after you answer. If you tell us your company is interested, ask us to keep your place or tell us about a lender, none of it is shown publicly. We show only how many companies are interested and how many people are waiting. Everything else, including your email address and your contributions, is not shown to other members.

Cookies

In our app we only use cookies that are strictly necessary:

one to keep you signed in (cc_session; for 90 days after your last visit, or until you sign out); one that remembers whose introduction link you followed, so that you, or the company you sign up, join in the right place (cc_introduction; for 30 days); one that remembers which group link you followed (cc_group_invitation; for 30 days, or until you join); one that remembers the open group where you chose to take your place (cc_group_join; for 30 days, or until you join); one while you search for a group (cc_group_search; for one day).

Stripe sets its own cookies on its payment page to prevent fraud. Our app uses no cookies for measurement or advertising. Our website climatecurrent.eco asks your consent before it uses any; its cookie page, climatecurrent.eco/cookies, lists them.

A few small things are kept only in your browser and never used to follow you:

Until you close the tab: the country you chose while choosing, the masked email address shown while you confirm it, and a marker that keeps one dashboard tab in step. Until you clear your browser's data: on the dashboard, the notices you closed, whether we already offered the web app, and your last map view and map selection.

If you add ClimateCurrent to your home screen, the web app keeps a copy of our own static files and an offline page on your device. It holds no personal information and is replaced with each new version.

Anonymous counts

To learn what works in our app, we count visits and clicks anonymously, without cookies and without linking them to you.

Who we share your information with

We share your information only with the following:

Stripe processes payments and collects your card or bank details directly. For fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy policy. The technology provider that develops and runs the platform for us. Our hosting and network providers store the platform, send our emails and deliver the map. We use OpenAI's moderation service to check names, texts, messages, photos, and company logos and stories for harmful content when they are submitted; it receives only the text or the photo (without its location data), not who wrote or posted it. Official registers, to check a company's VAT or tax number: VIES, run by the European Commission and the EU member states, for EU VAT numbers, and the national register where one exists. We send only the number. We keep the answer as evidence for the invoice or, if your company has shown interest, with its entry. Our accountants, and public authorities where the law requires it. If your employer gives us your address, or you manage a company's participation, your company sees what the section "If your employer gives us your address" and the company terms describe. Your company is a separate controller of what it sees.

We do not sell your personal information.

International transfers

Some of these providers may process data outside the EU. Such transfers are covered by an adequacy decision of the European Commission or by its Standard Contractual Clauses. You can ask us for a copy.

How long we keep your information

Account information: for as long as you are a member. Messages, posts and group memberships: until you delete them or your account. Accounting records (Stripe references and amounts): seven years from the end of the financial year, as required by the Estonian Accounting Act. If you asked to hear when ClimateCurrent opens: until you unsubscribe or membership opens, and never longer than two years.

Company contacts. Your name, work address and role are kept while you manage your company's participation. When you are removed, we delete them. If you accepted the company terms, that record (your name, address, the time and the version) is kept as proof of what your company agreed. When you delete your account, your name and address in it are replaced by "Removed".

Company sign-up requests. If you start signing up a company but never use the code we send, we delete your request 90 days after you sent it.

Interest and introductions. If you tell us your company is interested, ask us to keep your place or tell us about a lender, but never use the code we send, we delete your request after 24 hours. Once confirmed, we delete your entry 12 months after the last change to it, or at once when you leave the list or ask us.

If your company starts, we delete at once the details we kept only for its interest: your role, phone number, note and the result of the VAT check. Your name and work email address, which your company needs, are then kept as described under "Company contacts". If you ticked the newsletter box, your newsletter subscription is separate: it continues until you unsubscribe in one click.

If you asked us to keep your place, we keep your entry, your choice, your own link and whose link you came through for 12 months from the day you asked us to keep it, and then delete them, unless you have joined by then. Changing your choice does not extend this. You can ask us to delete it at any time.

If someone named you as a contact at a lender and you do not want contact, we delete your contact record at once and keep only the minimum needed to make sure we do not contact you again. If we have no email address for you and have not told you about them within 30 days, we delete them then.

Company invoices and their evidence. Invoices, credit notes, the e-invoice files and the evidence of the VAT or tax check are accounting records: seven years from the end of the financial year.

Company logos and stories. These are shown only while the company takes part and its page is not hidden. When a logo is replaced or removed, the old picture is deleted. If we remove a page after a report, its logo, story and website are deleted six months after our decision. A company can ask us to remove its page altogether.

Reports and moderation. Reports, and what was reported, are kept for six months after our decision. Names and email addresses given with a report through our form are also kept for six months after our decision. The record of a decision and the reason we gave are kept for two years.

Measures under the community rules, such as a warning, a restriction or a suspension, are kept for two years.

Lookups by our team. When our team looks up an account to help someone or handle a report, the record of that lookup is kept for two years. After the account is deleted, the record keeps only the dates and a coded fingerprint of the address. That fingerprint is still personal data: it lets us recognise the same address again, but not read it back.

Network addresses. Joining and sign-in requests keep the network address for 24 hours, to limit abuse. Our load balancer keeps no access logs. If we switch them on to investigate an attack, they record the network address of each request and are deleted after 3 days. Our application logs contain no email or network addresses; they are kept for 90 days, with an archived copy for one year.

Backups. If we ever restore a backup, then before the service is switched back on we apply again everything you asked for since that backup was made: every erasure you confirmed, finished or not; every unsubscribe, stop and mail block; every removal of an address from an employer's list, and of a company contact.

After a restore, everyone is signed out. When you delete your account, we delete all information that identifies you, apart from those accounting records. Your position in the network of introductions remains, so that the connections of the people you introduced stay intact, but without your name, email address or other account details.

Employee addresses A company may give us its employees' work email addresses so we can offer them a place it pays for. If the company holds the invitations, they go out by themselves 30 days after the address was given, or seven days after the company's first payment if that is later. We delete an address 90 days after the first invitation if the invitation was never used, and 90 days after the company removes it; an address removed before its invitation went out is deleted at once. Addresses in a set-up the company does not finish are deleted 30 days after they were entered.

Waitlist We delete a waitlist entry after we send the one message when taking part opens where the person lives, or after 2 years if taking part has not opened yet.

Unfinished joining If you started to join but never took a place, we delete your details after 90 days without activity.

Request network addresses Joining and sign-in requests store the network address only to limit abuse. It is deleted after 24 hours.

Prepared downloads A download of your data that we prepare for you is removed after 24 hours.

Security

We take appropriate technical and organisational measures to protect your information. Backups and logs are kept for security and to restore the service, which is in our legitimate interests.

Children

ClimateCurrent is intended for adults, and we do not knowingly collect information from anyone under 18.

Your rights

You have the right to access your information and receive a copy of it, to have it corrected or deleted, to restrict or object to its use, and to withdraw your consent at any time (for example, to appearing on the map). To exercise any of these rights, email [email protected]. We will respond within one month.

Every email we send you, including our newsletters and every email about your interest or an introduction, has a one-click link to stop future emails. We delete the details we no longer need and retain only the minimum necessary to honour your choice or meet a legal obligation.

Where we process information you gave us automatically, on the basis of your consent or a contract, you can receive it in a structured, commonly used, machine-readable format and have it sent to another organisation where this is technically possible. Withdrawing your consent does not affect what we did with your information before you withdrew it.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee, or with the supervisory authority in your country.

If you live outside the EU

United Kingdom: you have the same rights under the UK GDPR and may complain to the Information Commissioner's Office (ico.org.uk). Switzerland: you have the same rights under the Federal Act on Data Protection and may complain to the Federal Data Protection and Information Commissioner. United States: we do not sell or share personal information. Other countries: the rights described above apply to you as well. Email [email protected].

We have appointed Prighter Ltd, 20 Mortlake High Street, London, SW14 8JN, United Kingdom, as our representative in the United Kingdom under Article 27 of the UK GDPR. If you are in the United Kingdom, you or the Information Commissioner's Office can contact Prighter about anything to do with our handling of your personal information.

Changes to this notice

If we make a material change to this notice, we will email members before it takes effect.