Privacy Notice

This notice sets out how Environmental Finance Limited trading as Finance Earth (Finance Earth) is committed to protecting the privacy and security of your personal data (“personal information”). This notice gives individuals information on how their personal information (i.e. information which directly or indirectly identifies you) is processed.

Personal data is any “information” relating to a natural living person (“data subject”) that can be used to, directly or indirectly, identify that person.

Personal data includes specific identifiers such as a name, an identification number, location data or an online identifier.

Personal data also includes more sensitive information defined as “Special Category” information that is not allowed to be processed without specific protective measures in place.

This includes information about a person’s:

• Racial and ethnic origin;
• Political opinions
• Religious or philosophical beliefs;
• Trade union membership;
• Genetic data;
• Biometric data;
• Physical or mental health or condition (via medical records, health data);
• Sex life or sexual orientation;
• It may also include personal data relating to criminal convictions and offences

We collect personal data that you may provide voluntarily, for example, when using our website and completing online forms to contact us, subscribing to a newsletter, applying for funding, subscribing to receive marketing communications from us, participating in surveys, registering for events that we are organising.

We may collect and process the following personal data:

• Contact details (name, address, telephone number and email address)
• Tax information
• Nationality, passport, or other identification documents
• Information on investigations, litigation, court proceedings, civil liabilities, or criminal convictions against you
• Where permitted, information received from credit reference agencies, fraud prevention agencies and from other public sources such as Companies House
• Job title, job level or job function, role
• Data on the company you work for, including regulatory details – e.g. FCA authorisation information on the company and its regulated individuals
• Demographic information, such as industry, country, postcode, preferences, and interests
• Information relating to events captured through event-related forms, such as dietary restrictions, hotel and flight information, registration/participation status, media interview attendance, previous event experience and gender
• Information on how you use our website, e.g. how many times you visit, the duration of your visit, the pages you view, videos you watch, files you download, links you click
• Information on the device(s) you use to visit our website, e.g. whether you are using a computer, a tablet or a smartphone, your screen resolution, your operating system, your browser, your IP address, server log file information
• Your basic profile information, this is determined by your selections when you first arrive on our website e.g. your country of location and visitor type
• Your preferences, e.g. funding you have told us you are interested in, pages you have bookmarked
• Your interactions with our marketing communications, e.g. whether an email has been opened and/or clicked
• Contractual details, including information we have collected as part of the products and services we provide to you
• Financial information, such as payment-related information
• We may in some circumstances monitor and/or record telephone conversations and electronic transactions

Directly

We may collect personal data directly from you. This may be when you use our website, complete marketing or application forms provided directly while doing business or investing with us, participating in surveys, registering for our events, or applying for a job. We may also record phone calls for our mutual protection, compliance with regulations and/or to improve our customer service standards.

Indirectly

We may also collect your personal data indirectly, from someone other than yourself. This could be information:

• From a third-party (e.g. A company we have ongoing relationships with)
• From publicly available sources (social media platforms, the electoral register)
• From recruitment agencies
• From our background check provider
• Credit reference agencies
• From the Disclosure and Barring Service (DBS)
• From your named referees
• From another company that you have been introduced to us by
• Employers
• Direct and indirect service providers, such as vendors providing AML and sanctions checking databases

The person providing the information will be asked to warrant that they will only do so in accordance with applicable data protection laws and they will ensure that data subject(s) have been informed that their information may be shared in certain circumstances. They will also ensure that data subject(s) have been made aware of the fact that we will hold information relating to them and that it may be used for any of the purposes set out in this Privacy Notice, and where necessary that they will obtain consent to our use of the information.

We will use your personal data in the following way where it is considered that such processing is required by statute or under the rules of our regulators such as the Financial Conduct Authority, the Information Commissioner or has a lawful basis under the UK-GDPR:

• Identity verification
• The provision of products and/or services to clients or investors in our funds
• To administer our business relationship and maintain contractual relations
• Archiving documents (electronic and paper based)
• Detecting and preventing fraud and/or money laundering
• Statistical analysis and assessment
• Communicating with you
• For accounting and tax purposes
• For marketing and business development
• To comply with our legal and regulatory obligations
• To establish, exercise or defend legal rights
• To administer and manage our website, including to confirm and authenticate your identity, and prevent unauthorised access to restricted areas of our site
• To personalise and enrich your browsing experience by displaying content (including targeted advertising) that is more likely to be relevant and of interest to you
• To analyse the data of visitors to our site and site traffic information
• To capture metrics about the journey of users within our site
• To determine the company, organization, institution, or agency that you work for or with which you are otherwise associated
• To develop our business and services
• To provide you with marketing communications
• To conduct benchmarking and data analysis (for example, regarding usage of our site and demographic analyses of visitors of our site)
• To understand how visitors use the features and functions of our site
• To monitor and enforce compliance with applicable terms of use
• To enable teams managing events to coordinate their email campaigns and event notifications more effectively
• To allow for event and webinar sign-up
• To allow for content download and lead capturing
• To allow services and information to be delivered effectively to you
• For any other purpose for which you provided information to us

We will only share your personal data with others who have a legitimate need to access your personal data for the purposes set out in this Privacy Notice or if we are required to do so by law, regulation or as allowed under UK-GDPR.

Where personal data is being processed by a third party on our behalf, we will have contractual arrangements in place to protect the data in line with the applicable data protection laws and regulation.

Who will we share your personal data with?

We will only disclose your information to:

• Our companies, third-party suppliers, contractors, and service providers for the purposes listed under section 5 of this Privacy Notice.
• Selected third parties, to contact you with details of the services they provide, only where you have expressly opted-in or consented to the disclosure of your personal data for this purpose.
• To anyone providing a service to our Funds or acting as Fund agents (which may include the distributor, the investment manager, and companies within their group of companies, the administrator and its or their sub-contractors), as data processors, for the purposes of providing services to the Fund and on the understanding that they will keep the personal data confidential.
• Regulatory authorities, government agencies (e.g. HMRC), law enforcement agencies, credit reference agencies, data verification and tracing agencies, fraud prevention agencies (please refer to section 6.2 of this Privacy Notice for further information), as well as our professional advisors etc.
• Other third parties:
• In the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets.
• In the event that a third party acquires, or is interested in acquiring, all or part of our assets or shares, or that succeeds us in carrying on all or a part of its business, whether by merger, acquisition, reorganisation or otherwise.

In all cases, we require third parties to respect the security of your data and to treat it in accordance with the law. All our third-party service providers and other entities in the group are required to take appropriate security measures to protect your personal data.

Fraud Prevention

Personal data may be shared with fraud prevention agencies who will use it to prevent fraud, money laundering and other financial crimes and to verify your identity.

If false or inaccurate information is provided and fraud is identified, details will be passed to fraud prevention agencies. Law enforcement agencies may access and use this information. We may also share information about you with other organisations and public bodies, including the police and we may check and/or file your details with fraud prevention agencies and databases.

We may also check the details of other parties related to your contract, including verification of identity. This includes beneficiaries, trustees, settlors, third-party premium payers, executors or administrators of your estate, parties with power of attorney and any other beneficial owner.

If fraud is detected, you could be refused certain services, finance, or employment. Further details of how your information will be used by us and these fraud prevention agencies can be found by accessing these links:

• CIFAS – cifas.org.uk/fpn
• National Hunter – nhunter.co.uk/privacypolicy

We and other organisations may also access and use this information to prevent fraud and money laundering, for example, when:

• Checking details on applications for credit and credit related or other facilities
• Managing credit and credit related accounts or facilities
• Recovering debt
• Checking details of job applicants
• Checking sources of income and tax details

We and other organisations may access and use from other countries the information recorded by fraud prevention agencies.

The personal data that we, or third-party suppliers, delegates or agents collect, may be transferred for processing or storage at a destination outside the UK or the EU.

We will take all reasonably necessary steps to make sure that your data is handled with care, and in accordance with the relevant data protection laws and regulations that ensure your personal data is given the same level of protection as would be required under UK or EU GDPR regulations.

We will only transfer your data to a recipient outside the UK or EU where:

• The transfer is based on standard data protection clauses adopted or approved by the UK’s Information Commissioner’s Office or the EU’s Data Protection Commission
• The transfer is to a territory that is deemed ‘adequate’ by the UK or EU, or;
• The recipient is subject to an approved certification mechanism and the personal data is subject to appropriate safeguards.

Most of your data will be stored electronically in secure systems with access controls in place which are monitored on an ongoing basis. In certain situations, we may store hard copies of your data in secure, onsite filing cabinets.

We strive to maintain the reliability, accuracy, and completeness of all personal data we hold about you and protect the privacy and security of the information we obtain in the course of our business at all times. We have implemented appropriate physical, technical and organisational security measures, that are designed to safeguard the information from loss, misuse, unauthorised access, destruction or damage, alteration, and improper disclosure.

We also have onsite confidential waste bins that are used for the destruction of personal or sensitive hard copy documents. We have put in place policies and procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

We update and test security technology on an ongoing basis as well as train our employees about the importance of confidentiality and maintaining the privacy and security of your information.

It is important that you inform us of any changes to your contact details or other personal data so that we have the most up-to-date information about you. Please get in touch with us using the contact details in section 12 of this Privacy Notice.

It is our policy to retain personal data only for as long as it is needed for the purposes described in section 5 of this Privacy Notice. We are obliged to retain certain information to ensure accuracy, to help maintain quality of service, and for legal, regulatory, fraud prevention and legitimate business purposes.

The standard retention period for business related records is six years. Legal requirements may sometimes impose a longer retention period for specific types of records. For example, in relation to contracts these must be held for the period during which a legal claim could be made in respect of the contract.

For job applicants, if you are successful the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment plus six years following the end of your employment. If you are unsuccessful at any stage of the process, the information you have provided until that point will be retained for 12 months from the closure of the recruitment.

You have a number of rights, under data protection law, in relation to your personal data as follows:

The right to be informed – You have the right to be informed about why we are collecting your personal data. You should expect to know (a) the identity and contact details of the controller and their representative; (b) why and how your data is being processed; (c) if your data will be shared or passed on; (d) how long your data will be stored; and (e) what your rights are.

The right of access – This is commonly known as Data Subject Access Request (”DSAR”). This enables you to request, at any time, a copy of the personal data we hold about you as well as other supplementary information that will help you understand how and why we are using your personal data, and to check that we are processing it lawfully.

The right to rectification – This enables you to ask us to have any inaccurate or incomplete personal data, we hold about you, corrected, though we may need to verify the accuracy of the new information you provide to us. For incomplete personal data, this may involve providing us with a supplementary statement to the incomplete data. This can be done verbally or in writing addressed to the DPA.

The right to erasure/to be forgotten – This enables you to ask us to delete or remove your personal data where one of the following grounds applies (a) The data is no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) you withdraw the consent on which the processing is based and where there is no other legal ground for the processing; (c) you object to the processing and there are no overriding legitimate grounds for the processing; (d) the personal data has been unlawfully processed; (e) the personal data needs to be erased for compliance with a legal obligation or (f) the personal data has been collected in relation to the offer of information society services. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. It’s important to note that this is not an absolute right, so it only applies in certain circumstances.

The right to restrict processing – This enables you to ask us to suspend the processing of your personal data. When processing is restricted, we are permitted to store the personal data, but not use it. It is important to note that this is not an absolute right, so it only applies in certain circumstances.

The right to object – You have the right to object to the processing of your personal data in certain circumstances. You have an absolute right to stop your data being used for direct marketing, however in other cases where the right to object applies, we may be able to continue processing if we can demonstrate a compelling legitimate reason for doing so.

The right to data portability – You can request the transfer of your personal data that you have provided to us, to you, or to a third party you have chosen. We will provide your data in a structured, commonly used and, machine-readable format.

The right to object to automated decision making, including profiling – You have the right not to be subject to a decision based solely on automated processing. Processing is “automated” where it is carried out without human intervention and where it produces legal effects or significantly affects you. Automated processing may also include profiling. We will only carry out this type of processing if (a) the processing is necessary to fulfil a contract with you; (b) it is authorised by domestic law applicable to us acting as a data controller; or (c) you provided explicit consent.

There are certain circumstances in which your rights may not apply.

You are not required to pay any charge for exercising your rights. If you wish to make a request or make a complaint, please contact us using the details in section 13 of this Privacy Notice. We have one calendar month to respond to you, this may run from the date we are able to confirm your identity, or if your request is complex, or you make more than one, the response time may be extended to a maximum of three calendar months.

We may contact you to inform you of products and services we and other affiliates may provide, but only if you have provided us with explicit consent to use your data for this purpose. We may also use your personal data to respond to enquiries for the request of information.

If you wish to unsubscribe from marketing emails will provide a convenient method to discontinue electronic communications by clicking on an “unsubscribe” link tick box in your email. Alternatively, you can contact us at enquiries@finance.earth to unsubscribe.

If you have any enquiries, requests or complaints about the processing of your personal data by us, please contact us using any one (or more) of the following:

Address: The Compliance Department, Environmental Finance Limited, W106 Vox Studios, 1-45 Durham Street, London, SE11 5JH

Email: enquiries@finance.earth

If you are not satisfied with our response, you can raise a complaint with the relevant supervisory authority for General Data Protection Regulation. We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority so, please contact us in the first instance.

United Kingdom – Information Commissioner’s Office

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Website: https://www.ico.org.uk

Phone: 0303 123 1113