Privacy Policy

1.1This policy explains how Murmurate Digital Limited ("Murmurate", "we", "us") collects and uses personal data, and how it handles your organisation's data, when you use the Murmurate platform, including its calculators, reports and supply-chain tools (the "Platform"). It forms part of our Terms of Use.

1.2Murmurate is a non-profit company limited by guarantee, incorporated in England and Wales (company number 17177523), with its registered office at Castleton Barn, Clifford, Hereford HR3 5HF, United Kingdom. We are the controller of the personal data you give us through the Platform. We are registered with the Information Commissioner's Office (registration number ZC232347).

1.3Questions or requests: info@murmurate.digital.

We do not ask for sensitive categories of personal data, and ask you not to enter any.

2.1In this policy, "personal data" means information about an identifiable individual, such as your sign-in details. "Organisation data" means the business information you enter and the results it produces. UK data protection law applies to personal data. We protect organisation data through the permissions and promises in this policy and in our Terms of Use.

The table above applies to personal data. We use organisation data only as set out in sections 4 to 7.

4.1You keep ownership of the data you enter into, or generate with, the Platform. We act on it only as set out in this policy.

4.2By using the Platform you allow us to process your data to provide, operate, support and secure it for you. You are responsible for making sure the data you enter is accurate, that you are entitled to enter it, and that you do not include personal data about other people beyond what is necessary.

5.1We do not sell, rent or license your personal data or your organisation data, and we do not use either for third-party advertising. The only exception is organisation data you choose to publish, send or share under section 5A or 5B.

5.2 We share your data only in these ways:

• Referring organisation. We share information with the programme or organisation that recommended the Platform only as you agree in section 6.
• Service providers. Companies that help us run the Platform, such as hosting, email, security, payment and sign-in providers (for example Google, if you choose to sign in with your Google account). They may use your data only on our instructions and under written terms.
• Anyone you choose. For example, if you use the Platform to export or share a report, or invite a supplier, we share what you ask us to and no more. This includes Equipoise Earth Ltd if you ask for support or join its community forum, which runs on its own site under its own privacy notice.
• Other organisations on the Platform. If you choose to share data with another organisation that uses the Platform, we make it available to that organisation as you set out. See section 5B.
• Disclosure platforms and connected services. If you choose to publish or send your organisation's footprint to a disclosure platform, or to use one login for the Platform and a connected service such as Mycelium, we send what the choice screen tells you. See sections 5A and 6.
• Authorities and advisers. Where the law requires, or to protect our rights, or to our professional advisers under a duty of confidence.
• A successor. If the Platform or our organisation is reorganised or transferred, your data may pass to the successor on terms that protect it as set out in this policy.

5.3We may share anonymised, aggregated statistics that cannot identify you or your organisation with partners and publicly.

5A.1You can choose to publish your organisation's footprint, or send it to a disclosure platform. A disclosure platform is a service where footprints are published, reported or shared, run by us or by another organisation. An example is the public disclosure platform run by Mycelium Network Ltd. Others, such as sustainability reporting schemes, may be added later. This happens only if you switch on a separate option for each destination and for the data you select. It is never switched on by default and never a condition of using the Platform. We do not publish or send information that identifies an individual unless that person chooses.

5A.2Before you switch on a destination, we tell you its name and operator, what will be sent (the data sets and periods), whether it will be public, what it will do with the data, including whether it makes the data available to others through data products or APIs, and where its terms and privacy notice are. Choosing one destination never switches on another. If we add a destination later, nothing is sent to it until you choose it, and we tell you in the Platform that it is available.

5A.3You can see what is published or sent, change the selection, and turn any destination off at any time in your account settings. When you do, we stop sending, leave the data out of future data products, and ask the operator to stop using and delete what we sent. Copies already delivered to others before then may remain with them.

5A.4A destination's own terms apply to the data it holds. We list the destinations you can currently choose in your account settings.

5B.1You can choose to share selected data with another organisation that uses the Platform, for example a supplier or a customer. You choose the organisation, the data and, where offered, for how long. The organisation can see only what you share, and may use it only for the purpose for which you shared it, under our Terms of Use.

5B.2We do not share your data with another organisation unless you ask us to. You can stop sharing at any time in your account settings. Copies already seen or downloaded before then may remain with that organisation. If shared data includes personal data, such as a named contact, the organisation receiving it is responsible for it and must handle it in line with data protection law.

5B.3If another organisation shares data with you, you may use it only for the purpose for which it was shared, and you must stop when it stops sharing.

6.1Beyond section 5, we will use or share your data in the following ways only if you tick a separate box to agree. Each box names who will receive the data and why:

• sharing your organisation profile and results with a named programme partner, so it can support you and show your progress;
• receiving updates from a named partner organisation;
• allowing a named organisation to contact you about its services;
• receiving news and offers from us about our other products and services;
• letting us use your data to develop and improve our other platforms;
• one login for the Platform and Mycelium. Mycelium is a service run by Mycelium Network Ltd, a UK company. You can sign in to the Platform with your Mycelium login, or sign in to Mycelium with your Platform login, and reach the same account. The first time you do this, we show you what will be shared (your name, work email address and sign-in status) and ask you to confirm. Mycelium is a separate controller and handles the details it holds under its own privacy notice. If you decline, nothing is shared and the two stay separate;
• sending your organisation's data to a disclosure platform. Each destination is a separate choice, as set out in section 5A. We send only the organisation profile and footprint data sets and periods you select. You can see what has been sent, change your selection, or turn it off at any time. We do not include information that identifies individuals unless you choose to; and
• sharing data with another organisation on the Platform, as set out in section 5B.

6.2These choices are never ticked by default and never a condition of using the Platform. You can change them at any time in your account settings. Withdrawing consent does not affect what we did before. When you withdraw, we tell the recipient, and it must stop using your data for that purpose and delete it.

6.3Choices that concern personal data are consents under data protection law. Choices that concern only organisation data are permissions you give us, and we honour them in the same way.

Unless you have given the separate consent described in sections 5A, 5B or 6, or it is anonymised and aggregated, we will not:

• use your data for marketing, advertising, profiling or sales prospecting;
• disclose it to anyone else except as described in section 5;
• use it to train, fine-tune or evaluate any machine-learning or AI model; or
• use it to develop products or services other than the Platform.

8.1We store your data in the European Economic Area, in Stockholm, Sweden, with our database provider Supabase, which hosts it on Amazon Web Services. Some of our providers, including Supabase, are US companies whose staff may access data for support purposes. Where personal data can be accessed from outside the UK or EEA, we make sure a lawful safeguard is in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

10.1We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access limited to those who need it, and regular testing. No system is completely secure. If a breach is likely to put you at risk, we will tell you and the Information Commissioner's Office as the law requires.

11.1We use essential cookies and similar browser storage to make the Platform work, including keeping your work on your device if you are not signed in, and set non-essential cookies, such as analytics, only if you agree. You can change your choice at any time using the cookie settings. Our Cookie Policy has the details.

11.2We do not currently respond to Do-Not-Track browser signals, because no uniform standard exists. If one is adopted that we must follow, we will describe it here.

12.1You can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to our use of it, and transfer it to you or another provider in a usable format. You can withdraw any consent at any time. Contact us at the address in section 1.3. We will reply within one month.

12.2If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

12.3If we withdraw the calculator offered to you through a referring programme, we will give you at least three months' written notice and the chance to retrieve your data and results.

12.4If you have linked your sign-in with Mycelium, requests about the sign-in details it holds should be sent to Mycelium.

13.1The Platform is for businesses and organisations, and for people aged 18 or over. We do not knowingly collect data from children. If we learn that we have collected personal data from someone under 18, we will deactivate the account and delete the data.

14.1We may update this policy. We will post the new version here and tell you about significant changes by email or in the Platform. If a change would use your data in a new way that needs your consent, we will ask for it first.

Murmurate Digital Limited
Castleton Barn
Clifford
Hereford HR3 5HF
United Kingdom
Email: info@murmurate.digital