Privacy Policy

Last updated: 6 May 2026 · Effective: 6 May 2026

1. Who We Are

Tao Climate Limited ("we", "us", "our") operates Tao Climate Scope, a SaaS sustainability reporting platform. This Privacy Policy explains how we collect, use, and protect personal data when you use Scope. It applies specifically to the Scope product at scope.taoclimate.com.

For data you enter as a subscriber (company emissions data, sustainability figures), you are the Data Controller and we act as your Data Processor. We process that data solely on your instructions per our Terms of Service.

2. Data We Collect

Category	What We Collect	When
Account data	Name, work email address, company name, role	When you create an account or submit a lead form
Subscription & billing data	Billing name, billing address, email for receipts. Card details are processed by Stripe - we never see or store full card numbers.	When you subscribe
Emissions & company data	Scope 1, 2, and 3 emissions figures, energy use data, headcount, turnover, sector, business travel records	When you use the platform
Usage data	Pages visited, features used, time on platform, browser type, approximate location (country), referrer URL	During platform use (with consent for analytics)
Communication data	Email address and message content when you contact us	When you contact support
Consent records	Record of your agreement to our Terms and Privacy Policy at checkout	At subscription

We do not collect special categories of personal data (health, racial or ethnic origin, political opinions, biometric data, etc.).

3. How We Use It

• Account & subscription management: Provisioning your account, processing payments, sending receipts, managing renewals and cancellations.
• Dashboard and report generation: Displaying your emissions data in the Scope dashboard, generating VSME-aligned PDF reports, and (if enabled) publishing your public sustainability dashboard.
• Customer support: Responding to your enquiries and resolving issues.
• Platform improvement: Aggregated, anonymised analytics on how features are used - no individual profiling.
• Industry benchmarking (aggregate only): Computing anonymised sector benchmarks from de-identified data. This data cannot identify you or your company.
• Legal and compliance: Meeting our legal obligations under Irish and EU law, including accounting and tax requirements.
• Service communications: Notifying you of updates to Terms, planned maintenance, or important service changes.

We do not use your data for advertising, and we do not sell it to third parties.

4. Legal Basis for Processing

Processing activity	Legal basis (GDPR Art. 6)
Providing the Service, account management, payment processing	Contract performance (Art. 6(1)(b))
Analytics cookies and usage tracking	Consent (Art. 6(1)(a)) - only after you accept
Security, fraud prevention, aggregate platform improvement	Legitimate interest (Art. 6(1)(f))
Retaining financial records, VAT records	Legal obligation (Art. 6(1)(c))

5. Third Parties

• Stripe, Inc. - Payment processing and subscription management. Stripe processes your billing details under its own Privacy Policy and is PCI DSS compliant. Tao Climate receives payment confirmation and billing metadata, but not full card details.
• Render (hosting infrastructure) - Our application server and database are hosted on Render's platform. Data is hosted in EU data centres. Render's Privacy Policy applies to infrastructure-level processing.
• Neon (database infrastructure) - Our PostgreSQL database is hosted on Neon. Data remains within EU regions.
• Google Analytics - Loaded only with your consent for analytics. IP anonymisation is enabled. See Google Privacy Policy.
• Google Fonts - Font files served via Google CDN. Google may log your IP. No consent required for technically necessary fonts.

We do not share your Customer Data (emissions figures, company information) with any third party except as necessary to provide the Service (e.g., hosting infrastructure).

6. Data Retention and Deletion

Data type	Retention period
Account and emissions data	Retained for the lifetime of your subscription, then 30 days post-cancellation for export. Deleted thereafter.
Billing records	7 years (Irish Companies Act accounting obligations)
Support communications	Until your query is resolved, or up to 2 years
Analytics data	14 months (Google Analytics default)
Consent records	7 years (for legal compliance)

To request early deletion of your personal data, contact support@taoclimate.com with "Data Deletion Request" in the subject line. Note: billing records must be retained for the statutory period regardless of deletion requests.

7. International Transfers

Your data is primarily processed within the European Economic Area (EEA). Where third-party providers (such as Stripe) transfer data outside the EEA, they do so under standard contractual clauses or equivalent safeguards approved by the European Commission.

8. Your Rights

Under GDPR, you have the right to:

• Access - request a copy of the personal data we hold about you
• Rectification - request correction of inaccurate or incomplete data
• Erasure ("right to be forgotten") - request deletion of your personal data (subject to legal retention obligations)
• Data portability - receive your data in a structured, machine-readable format
• Restriction of processing - request that we restrict how we process your data
• Object to processing - object to processing based on legitimate interests
• Withdraw consent - withdraw any consent you have given (this will not affect the lawfulness of processing prior to withdrawal)

To exercise any right, email support@taoclimate.com. We will respond within 30 days. We may need to verify your identity before processing your request.

9. Cookies

Scope uses the following types of cookies:

• Strictly necessary: Session authentication cookies and your cookie consent preference. These do not require consent.
• Analytics (consent required): Google Analytics cookies, loaded only after you click "Accept." These track usage patterns to help us improve the product.

You can manage your cookie preferences at any time via the "Cookie Settings" link in the footer. See our general Cookie Policy for full details.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email at least 14 days before they take effect. The "Last updated" date at the top will always reflect the current version.

11. Contact and Complaints

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Irish Data Protection Commission:

• Website: dataprotection.ie
• Email: info@dataprotection.ie