Privacy Policy

1. Introduction

Impact Chain Ltd ("we", "us", or "our") is committed to protecting the privacy and security of the personal and organisational data of all individuals and companies who interact with our Platform. This Web Privacy Policy explains how we collect, use, store, protect, and share information when you visit our website or use the Impact Chain Platform. This policy applies to all Users of the Platform, including individual account holders, company representatives, Provider subscribers, Supplier subscribers, and Property Provider subscribers. We are a data controller under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018. This Policy explains how we collect and use your data when you use the Platform.

2. Who We Are

Impact Chain Ltd is a company incorporated in England and Wales. We operate a data aggregation platform that enables organisations in any industry or sector to create publicly discoverable Profiles, and enables Providers and other platform users to search, compare, and benchmark data across their networks and supply chains. Data Controller Contact:
Email: privacy@impactchain.co
Address: 21 New Road, Lewes, England, BN7 1YW
Company number: 17207834
Website: www.impactchain.co

3. What Data We Collect

3.1 Information You Provide

When you register, create a Profile, or interact with the Platform, we may collect:

• Account registration data: company name, company registration number, registered address, country of operation, and account type (Provider / Supplier / Property Provider);
• Contact information for account holders: name, job title, business email address, and telephone number;
• Billing information: company name, billing address, payment schedule election, and limited transaction information (such as the plan purchased, amount, date, and the last digits and type of payment method) received from Paddle. Payment card and bank details are collected and processed by Paddle, not by us, and we do not store them;
• Profile content: certifications, performance data, accreditations, audit results, location information, service descriptions, and any other data voluntarily added to a company Profile;
• Communications: correspondence you send to us via email, contact forms, or support channels; and
• Survey and feedback data provided voluntarily.

3.2 Information Collected Automatically

When you visit the Platform, we automatically collect certain technical data, including:

• IP address and approximate geographic location;
• Browser type, version, and operating system;
• Pages visited, time spent on the Platform, and navigation paths;
• Referring URL and search terms used to reach the Platform;
• Cookies and similar tracking technologies (see Section 9 below).

3.3 Information About Your Organisation

The Platform is designed for business use. Profile data entered by Users is intentionally public-facing and relates primarily to organisations, not individuals. We encourage Users to ensure that any personal data included in Profile content is kept to a minimum consistent with the purpose of the Profile.

4. How We Use Your Data

4.1 To Provide the Service

• To create and manage your account;
• To publish and maintain your company Profile;
• To enable search and discovery of your Profile by other Platform Users;
• To process subscription payments and manage billing across your elected payment schedule;
• To provide customer support and respond to queries.

4.2 To Improve the Platform

• To analyse usage patterns and identify opportunities to enhance features;
• To conduct benchmarking and generate insights (using anonymised or aggregated data);
• To test new features and resolve technical issues.

4.3 To Communicate With You

• To send administrative communications relating to your account, subscription, and payment schedule;
• To notify you of changes to the Platform, these Terms, or this Privacy Policy;
• To send product updates, insights, and relevant news (with your consent, and you may opt out at any time).

4.4 To Comply With Legal Obligations

• To comply with applicable UK and international data protection law;
• To respond to lawful requests from regulatory authorities or law enforcement; and
• To enforce our Terms and Conditions.

5. Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases to process your personal data:

• Contract performance: processing necessary to provide the Service you have subscribed to, including managing your elected payment schedule;
• Legitimate interests: improving the Platform, detecting fraud, and maintaining security — balanced against your rights and interests;
• Legal obligation: compliance with applicable law; and
• Consent: for marketing communications and non-essential cookies — you may withdraw consent at any time.

6. Public Profiles and Searchable Data

A core feature of the Impact Chain Platform is that company Profiles are publicly accessible and searchable. This is fundamental to the Platform's purpose: enabling Providers and other stakeholders to discover and evaluate performance across their networks. By creating a Profile on the Platform, your company acknowledges and agrees that:

• Your Profile, including credentials, certifications, service information, and location data, will be visible to other Platform Users and to the general public;
• Profile data may be indexed by search engines; and
• Providers subscribing to the Platform may search, view, and compare your Profile data as part of their evaluation, procurement, or partner selection processes.

We strongly advise Users not to include personal data in their publicly visible Profiles unless strictly necessary and appropriate.

7. Data Sharing and Disclosure

7.1 Within the Platform

Profile data is shared with other authenticated Platform Users, including Provider subscribers who search for and view Supplier or Property Provider Profiles. This sharing is integral to the Platform's function and is consented to by creating a Profile.

7.2 Service Providers

We share data with a limited number of trusted third-party service providers who assist us in operating the Platform, including:

• Cloud hosting and infrastructure providers;
• Paddle, our reseller and Merchant of Record, for payments, as described in section 7.2A;
• Email and communication service providers;
• Analytics providers (where data is anonymised or pseudonymised); and
• Security and fraud prevention services.

All service providers (other than Paddle, as described in section 7.2A) are bound by data processing agreements that require them to maintain appropriate security standards and to process data only as instructed by Impact Chain.

7.2A Paddle (Merchant of Record)

Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders. When you purchase a subscription, Paddle (Paddle.com Market Limited, or another Paddle group company named at checkout) collects and processes your payment, billing and contact details, and carries out fraud prevention, tax and regulatory checks, in order to take payment, issue invoices and receipts, collect and account for VAT and other taxes, and handle refunds and chargebacks. Paddle acts as an independent controller of that personal data for these purposes and is not our processor. Paddle's use of your data is governed by its own privacy notice, available at https://www.paddle.com/legal/privacy. We receive from Paddle only the limited transaction and account information we need to provide the Service, keep records and handle support requests.

7.3 Partner Organisations

Where we have partnership arrangements with third-party organisations or industry bodies, we may share aggregated, anonymised insights with such partners. We will not share identifiable personal or company data with partners without your explicit consent. As Impact Chain builds partnerships in particular sectors, we will publish a sector-specific addendum to this Policy listing the partner organisations concerned, the categories of data shared and the purposes of that sharing, and we will put appropriate data sharing agreements in place and keep our internal records of processing up to date. Any such addendum forms part of this Policy and applies to Users in the relevant sector.

7.4 Legal Requirements

We may disclose data where required by law, court order, or the request of a competent regulatory authority. We will, where lawful and practicable, notify affected Users of any such disclosure.

7.5 Business Transfers

In the event of a merger, acquisition, or sale of Impact Chain, User data may be transferred to the successor entity, subject to equivalent privacy protections. We will notify Users of any such transfer.

7.6 We Do Not Sell Your Data

Impact Chain does not sell, rent, or trade personal data or identifiable company data to any third party for marketing or commercial purposes.

8. Data Security

We take the security of your data extremely seriously. Given the commercially sensitive nature of the data held on the Platform — which may be relied upon by Providers in procurement and partner decisions — we apply robust, multi-layered security controls:

• All data transmitted to and from the Platform is encrypted using TLS/SSL protocols;
• Data at rest is stored in encrypted form using industry-standard encryption algorithms;
• Access to Platform infrastructure and databases is restricted to authorised personnel on a strict need-to-know basis, protected by multi-factor authentication;
• Regular penetration testing and vulnerability assessments are conducted;
• We maintain comprehensive audit logs of access to sensitive data;
• Our hosting infrastructure operates in certified UK/EU data centres with 24/7 monitoring, redundancy, and disaster recovery provisions;
• Staff with access to personal or company data are subject to confidentiality obligations and receive data protection training.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office ("ICO") within 72 hours and affected Users without undue delay, as required by the UK GDPR.

9. Cookies and Tracking Technologies

9.1 What Are Cookies?

Cookies are small text files placed on your device when you visit the Platform. They enable us to recognise your browser, remember preferences, and understand how Users interact with the Platform.

9.2 Cookies We Use

• Strictly necessary cookies: essential for the Platform to function — these cannot be disabled;
• Performance cookies: help us understand how Users interact with the Platform using anonymised analytics data;
• Functionality cookies: remember your preferences and settings to improve your experience; and
• Marketing cookies: where consent is given, these may be used to deliver relevant information and updates.

9.3 Cookie Consent

On your first visit to the Platform, you will be presented with a cookie consent banner. You may accept all cookies, reject non-essential cookies, or customise your preferences. You may update your cookie preferences at any time via the cookie settings link in the Platform footer.

10. International Data Transfers

Impact Chain operates primarily in the United Kingdom. Where we transfer personal data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, including:

• Transfers subject to UK adequacy decisions or equivalent international transfer mechanisms;
• Standard Contractual Clauses (SCCs) where applicable; and
• Data processing agreements with international providers that incorporate appropriate data protection safeguards.
• Paddle may process personal data outside the UK and European Economic Area in accordance with its own privacy notice and the safeguards described there; we do not control those transfers.

11. Data Retention

We retain data only for as long as necessary for the purposes described in this Policy, or as required by law. Specifically:

• Account and Profile data: retained for the duration of your subscription and for a period of 2 years after account closure, unless you request earlier deletion;
• Billing and transaction data (including payment schedule records): retained for 7 years as required by UK tax and financial record-keeping obligations;
• Paddle keeps its own records of payment data in accordance with its privacy notice and its legal obligations as Merchant of Record.
• Website analytics data: retained in anonymised/aggregated form indefinitely; and
• Correspondence and support records: retained for 3 years following resolution.

Upon account closure or your request, we will delete or anonymise your personal data, subject to any legal obligations to retain it.

12. Your Rights Under UK GDPR

As a data subject, you have the following rights regarding your personal data:

• Right of access: to request a copy of the personal data we hold about you;
• Right to rectification: to request correction of inaccurate or incomplete data;
• Right to erasure: to request deletion of your data, subject to our legal obligations;
• Right to restrict processing: to request that we limit how we use your data in certain circumstances;
• Right to data portability: to receive your data in a structured, machine-readable format;
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes; and
• Rights related to automated decision-making: to request human review of any significant automated decisions affecting you.

To exercise any of these rights, please contact us at privacy@impactchain.co. We will respond within one calendar month. You also have the right to lodge a complaint with the ICO at www.ico.org.uk.

13. Children's Privacy

The Impact Chain Platform is intended for business use only and is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor, we will take prompt steps to delete it.

14. Links to Third-Party Sites

The Platform may contain links to third-party websites and services. This Privacy Policy applies only to the Impact Chain Platform. We are not responsible for the privacy practices of third-party sites and encourage you to review their privacy policies before providing any personal data.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, the Platform, or applicable law. We will notify Subscribers of material changes via email at least 30 days in advance. The current version of this Policy will always be available on the Platform. Continued use of the Platform following any update constitutes acceptance of the revised Policy.

16. Contact and Complaints

If you have any questions, concerns, or complaints regarding this Privacy Policy or our handling of your data, please contact our Privacy team:

Impact Chain Ltd — Privacy

21 New Road, Lewes, England, BN7 1YW

Email: privacy@impactchain.co
Website: www.impactchain.co

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Website: www.ico.org.uk
Telephone: 0303 123 1113