Privacy Policy

1.Who we are

This policy is issued by COMPANY LEGAL NAME, trading as Metimo Auto (“Metimo”, “we”, “us”), a company registered in JURISDICTION under company number COMPANY NUMBER, with its registered office at REGISTERED ADDRESS. Where UK data protection law applies, we are registered with the Information Commissioner’s Office under registration ICO REG NUMBER.

For personal data described in this policy we act as a controller. For the business data your organisation uploads to run its carbon accounting, we generally act as a processor on your behalf — those arrangements are governed by our Data Processing Agreement.

Questions, requests or complaints: privacy@YOUR-DOMAIN. Our Data Protection Officer (where appointed) can be reached at dpo@YOUR-DOMAIN.

2.Scope and the laws we comply with

We aim to comply with data protection laws across every territory we serve, including the UK GDPR and Data Protection Act 2018, the EU GDPR, the Swiss FADP, the California Consumer Privacy Act as amended by the CPRA and comparable US state laws (Virginia, Colorado, Connecticut, Utah and others), Canada’s PIPEDA, and Australia’s Privacy Act. Where a specific right or disclosure is required by your jurisdiction, the strongest applicable standard is the one we apply.

3.The personal data we collect

You give us

• Account & identity data — name, work email, password (stored only as a salted hash), job title and role.
• Organisation data — company name, registered address, company registration number and your nominated ESG lead, captured at sign-up.
• Billing data — plan, quantities and billing contact. Card details are entered directly with our payment processor and are never stored on our systems.
• Support & correspondence — anything you send us by email or in-app.

We collect automatically

• Usage & device data — pages viewed, actions taken, approximate location derived from IP, browser and device type, and diagnostic logs.
• Cookies & similar — a small set of strictly-necessary items only; see the Cookie Policy.

Personal data within uploaded business data

Your emissions records are largely non-personal, but files you upload (invoices, staff FTE counts, contacts on a supplier record) may contain limited personal data. We process that only as your processor to provide the service — see the DPA. We do not ask for, and request that you do not upload, special-category data.

4.How and why we use it, and our lawful bases

• To provide the platform — create and secure your account, deliver the service. Basis: performance of a contract.
• To take payment — manage subscriptions, invoices and quantity changes. Basis: contract and legal obligation (tax/accounting).
• To secure and improve the service — monitoring, fraud and abuse prevention, debugging and analytics. Basis: legitimate interests in running a safe, reliable product, balanced against your rights.
• To communicate — service messages (always) and, where permitted, product updates. Basis: legitimate interests or consent, and you can opt out of marketing at any time.
• To meet legal obligations — respond to lawful requests and enforce our terms. Basis: legal obligation and legitimate interests.

We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not sell your personal data.

5.Who we share it with

We share personal data only with: service providers that process it on our behalf under contract (our sub-processors, e.g. hosting, database, payments); professional advisers; authorities where legally required; and a successor in the event of a merger, acquisition or reorganisation (with notice). Every processor is bound to use the data only on our instructions and to protect it.

6.International transfers

Some providers process data outside your country. Where we transfer personal data out of the UK, EEA or Switzerland, we rely on an adequacy decision where one exists, or otherwise on the Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary safeguards. Details of each provider’s region are in the sub-processor list.

7.How long we keep it

We keep personal data only as long as needed for the purposes above. Account data is kept for the life of your account and deleted or anonymised within N days of closure, except where we must retain records longer to meet legal, tax or accounting obligations (typically up to N years). Uploaded business data is retained and deleted per the DPA.

8.How we protect it

We use encryption in transit (TLS) and at rest, hashed passwords, role-based access control, least-privilege internal access, network isolation and audit logging. No system is perfectly secure, but we maintain measures appropriate to the risk and will notify you and any regulator of a qualifying personal-data breach within the timescales the law requires.

9.Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, to data portability, to withdraw consent, and to lodge a complaint with a regulator. In the US, this includes the rights to know, delete, correct and opt out of “sale” or “sharing” (we do neither) and not to be discriminated against for exercising them.

To exercise any right, contact privacy@YOUR-DOMAIN. We respond within the statutory period (one month under UK/EU GDPR; 45 days under US state laws), free of charge in most cases, after verifying your identity. You may use an authorised agent where the law allows.

10.Children

The platform is a workplace tool not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

11.Regional contacts and complaints

• UK: the Information Commissioner’s Office, ico.org.uk.
• EEA: your local supervisory authority. Our EU representative under Article 27 is EU REPRESENTATIVE NAME & ADDRESS; our UK representative is UK REPRESENTATIVE NAME & ADDRESS.
• California and other US states: exercise your rights via the contacts in section 9.

12.Changes to this policy

We may update this policy from time to time. Material changes will be notified in-app or by email, and the version and effective date at the top will change. Continued use after an update means you accept the revised policy.