1. Introduction

This privacy policy explains in detail the types of personal data we may collect about you when you interact with us. It also explains how we'll store and handle that data, and keep it safe.

We hope the following sections will answer any questions you have but if not, please do get in touch with us. It's also likely that we'll need to update this privacy policy from time to time so you're welcome to come back and check it whenever you wish.

When you are using the Pliosaur Energy website or the Carbon Footprint Calculator we use 3rd party vendors to store your data. Pliosaur Energy Ltd is the data controller for any data stored with Amazon Web Services (AWS).

2. Explaining the legal bases we rely upon

The law on data protection sets out a number of different reasons for which a company may collect and process your personal data.

Consent is required in specific situations, for example, when you tick a box to receive email newsletters or agree to share your emission data. When collecting your personal data, we'll always make clear to you which data is necessary for a particular service.

Contractual obligations in certain circumstances require us to collect and use your personal data. For example, if you download our software we'll use these details to deliver our product to you.

Legal compliance may justify our requirement by law to collect and process your data. For example, we can pass on details of people involved in fraud or other criminal activity affecting the company to law enforcement.

Legitimate interest can allow us to use your data in a way which might reasonably be expected as part of running our business and which does not materially impact your rights, freedom or interests.

Our website may contain links to content or other functionality provided by third parties which are outside our control and are not covered by our privacy policy. The operators of those websites may collect information about you in accordance with their privacy policy, which may differ from ours. We encourage you to read those providers' privacy policies on their websites. We do not accept any responsibility or liability for these policies.

Pliosaur Energy Ltd is governed by the laws of England and Wales. The courts of England and Wales shall have exclusive jurisdiction over any dispute arising out of your use of our services.

3. When do we collect your personal data

• When you create an account with us to use the Carbon Footprint Calculator.
• When you engage with us on social media.
• When you download or install one of our apps.
• When you contact us by any means with queries, complaints etc.
• When you choose to complete any surveys we send you.
• When you've given a third party permission to share with us the information they hold about you.
• When our Finance suppliers such as Stripe share information with us about the product you have purchased.

4. What sort of personal data do we collect

If you have a Carbon Footprint Calculator account with us: your name, address, email, telephone number, marketing preferences and for account verification purposes your date of birth and a response to a security question.

Details of your interactions with us. For example, we collect notes from our conversations with you, details of any complaints or comments you make, and how and when you contact us.

Copies of documents you provide to prove your age or identity where the law requires this.

Details of your visits to our websites or apps, and which site you came from to ours.

Information gathered by the use of cookies in your web browser.

We do not hold any payment card information as all payment transactions are processed by Stripe.

Your social media username, if you interact with us through those channels, to help us respond to your comments, questions or feedback.

5. Why do we use your personal data

We want to give you the best possible customer experience. One way to achieve that is to get the richest picture we can of who you are by combining the data we have about you.

The data privacy law allows this as part of our legitimate interest in understanding our customers and providing the highest levels of service. We apply this legislation to:

Process any orders that you make by using our services. If we don't collect your personal data during checkout, we won't be able to process your order and comply with our legal obligations.

Respond to your queries, refund requests and complaints. Handling the information, you sent enables us to respond. We may also keep a record of these to inform any future communication with us and to demonstrate how we communicated with you throughout.

Protect our business and your account from fraud and other illegal activities. This includes using your personal data to maintain, update and safeguard your account.

Send you communications required by law or which are necessary to inform you about our changes to the services we provide you.

Develop, test and improve the systems, services and products we provide to you.

Comply with our contractual or legal obligations to share data with law enforcement.

6. How we protect your personal data

We know how much data security matters to all our customers. With this in mind we will treat your data with the utmost care and take all appropriate steps to protect it. Access to your personal data is password-protected, and sensitive data such as payment card information is secured by 3rd parties. The vendors used are:

• Finance: Stripe
• Website hosting: Amazon Web Services
• Database hosting: Amazon Web Services

7. How long will we keep your personal data

Whenever we collect or process your personal data, we'll only keep it for as long as is necessary for the purpose for which it was collected.

At the end of that retention period, your data will either be deleted completely or anonymised, for example by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.

8. Who do we share your personal data with

Trusted third parties working on our behalf. Should this be necessary, here's the policy we apply to those organisations to keep your data safe and protect your privacy:

• We provide only the information they need to perform their specific services.
• They may only use your data for the exact purposes we specify in our contract with them.
• We work closely with them to ensure that your privacy is respected and protected at all times.(/p>
• If we stop using their services, any of your data held by them will either be deleted or rendered anonymous.

Third parties working for their own purposes:

• With your consent, given at the time you supply your personal data, we may pass that data to a third party for their direct marketing purposes.
• For fraud management, we may share information about fraudulent or potentially fraudulent activity. This may include sharing data about individuals with law enforcement bodies.
• We may also be required to disclose your personal data to the police or other enforcement, regulatory or Government body.

9. What are your rights over your personal data

You have the right to request:

• Access to the personal data we hold about you.
• The correction of your personal data when incorrect, out of date or incomplete.
• The deletion of the data we hold about you, in specific circumstances; for example, when you withdraw consent or object, and we have no legitimate overriding interest.
• A computer file in a common format (CSV or similar) containing the personal data that you have previously provided to us, and the right to have your information transferred to another entity where this is technically possible.
• Restriction of the use of your personal data, in specific circumstances, generally while we are deciding on an objection you have made.
• That we stop processing your personal data, in specific circumstances; for example, when you have withdrawn consent, or object for reasons related to your individual circumstances.
• That we stop using your personal data for direct marketing. (either through specific channels, or all channels).
• That we stop any consent-based processing of your personal data after you withdraw that consent.

In cases where we are processing your personal data on the basis of our legitimate interest, you can ask us to stop for reasons connected to your individual situation. We must then do so unless we believe we have a legitimate overriding reason to continue processing your personal data, such as administration of a commercial contract.

To protect the confidentiality of your information, we will ask you to verify your identity before proceeding with any request you make under this privacy policy. If you have authorised a third party to submit a request on your behalf, we will ask them to prove they have your permission to act.

10. How can you stop the use of your personal data for direct marketing

There are several ways you can stop direct marketing communications from us:

• In our apps, you can manage your preferences and opt out from one or all of the different push notifications by selecting or deselecting the relevant options during the registration process.
• Write to use at the address below.

Please note that you may continue to receive communications for a short period after changing your preferences while our systems are fully updated.

11. Contacting the Regulator

If you feel that your data has not been handled correctly, or you are unhappy with our response to any requests you have made to us regarding the use of your personal data, you have the right to lodge a complaint with the Information Commissioner's Office.

You can contact them by calling (0303-1231113). Or go online to (www.ico.org.uk/concerns)

12. Any questions

We hope this privacy policy has been helpful in setting out the way we handle your personal data and your rights to control it.

If you have any questions that haven't been covered, please contact us by:

• Email us at enquiries@pliosaurenergy.co.uk
• Or write to us at Pliosaur Energy Ltd, 34 Sally Hill, Portishead, North Somerset, BS20-7BH.

This notice was last updated on 20/03/2023.