Privacy Policy

FutureTracker · Environmental and Social Impact Monitor Limited

Effective date: 30 July 2026

1. Who we are and what this policy covers

Environmental and Social Impact Monitor Limited (trading as “FutureTracker”) (“FutureTracker”, “we”, “us” or “our”) is a company registered in Guernsey 66486 with its registered office at First Floor, Harbour Court, Les Amballes, St Peter Port, Guernsey, GY1 1WU.

We operate the website at www.futuretracker.com (the “Website”) and the FutureTracker platform (the “Platform”) — a cloud application that organisations use to measure, manage and report their environmental and sustainability performance, including greenhouse-gas (carbon) emissions.

This privacy policy explains how and why we collect, store, use and share (“process”) personal information when you visit the Website, use the Platform, or otherwise interact with us (together, the “Services”). We process personal information in accordance with the Data Protection (Bailiwick of Guernsey) Law, 2017 and, where applicable, the UK GDPR and the EU GDPR.

If you do not agree with our policies and practices, please do not use the Services. Questions or concerns? Contact us at support@futuretracker.com.

2. Our role: controller and processor

We act in two different capacities, and your rights are exercised differently depending on which applies:

  • As a controller — for personal information about visitors to the Website, people who register accounts on the Platform (account and profile data), marketing contacts, and people who correspond with us. This policy describes that processing in full.

  • As a processor — for the data and documents a customer organisation uploads into the Platform (“Customer Content”), such as activity data and supporting evidence files. We process Customer Content on the instructions of the customer organisation under our Data Processing Agreement.

  • If your personal information appears in another organisation’s Customer Content (for example, because your employer uses FutureTracker and its uploads mention you), that organisation is the controller of that information. Please direct any questions or requests to that organisation; we will support it in responding.

3. What information we collect

3.1 Information you provide to us

  • Account and profile data — name, business email address, job title, the organisation you belong to and your role within it (for example administrator or contributor), and sign-in credentials. Passwords are handled by our managed authentication provider and are stored only in hashed form; we never see or store them in plain text.

  • Communications — support requests, feedback, survey responses and other correspondence with us.

  • Marketing preferences — your choices about receiving marketing from us.

3.2 Customer Content uploaded to the Platform

Organisations use the Platform to record sustainability data. On behalf of your organisation we store and process:

  • Sustainability activity data — for example electricity, gas and heat consumption, vehicle fuel and mileage, business travel, employee commuting, waste, water, refrigerants, and purchased goods and spend records.

  • Supporting evidence documents — utility bills, invoices, receipts, spreadsheets and similar records uploaded as evidence. These may incidentally contain personal information, such as employee or supplier names, contact details, addresses, vehicle registrations or travel details.

  • Organisation and site information — facility names, sites and locations, and reporting periods.

  • We do not seek to collect sensitive (special-category) personal information. Data relevant to sustainability measurement (for example commuting patterns) should be collected and uploaded by your organisation in line with its own policies and privacy notices.

3.3 Information collected automatically

When you use the Services we automatically collect certain technical information, including:

  • Log and usage data — IP address, browser type and settings, pages and features used, date/time stamps, error reports and similar diagnostic information.

  • Device data — device type, operating system, language preferences and system configuration.

  • Approximate location — country-level location inferred from your IP address.

We collect some of this information using cookies and similar technologies — see section 8.

We do not buy personal information from third parties. Data submitted through our online forms and data-collection integrations is provided by you or your organisation.

4. How we use your information

We process personal information to:

  • provide, operate and secure the Website and Platform, including creating accounts, authenticating users and applying organisation- and role-based access;

  • calculate emissions and other sustainability metrics from the data supplied, using published emission conversion factors;

  • extract data from uploaded documents using AI-assisted processing (see section 5);

  • administer accounts and send service and administrative communications (for example changes to our terms or features);

  • respond to support requests and feedback;

  • monitor, analyse and improve the Services, including through aggregated and de-identified usage analytics;

  • keep the Services safe, including fraud and abuse prevention;

  • send marketing communications about our products and services, in line with your preferences — you can opt out at any time (see section 13);

  • comply with legal obligations and, where necessary, protect someone’s vital interests.

  • We do not sell personal information, and we do not use Customer Content for advertising.

5. AI-assisted document processing

The Platform includes features that read uploaded files (for example spreadsheets, utility bills and invoices) and extract activity data from them — such as dates, quantities, units and amounts — so that your organisation does not have to key it in manually. This extraction uses machine-learning services provided by our cloud infrastructure provider (currently Google Cloud Vertex AI).

  • Extracted data is staged for human review: a person in your organisation reviews and approves it before it is committed to your organisation’s records.

  • Our AI service providers act as sub-processors under contract. They are not permitted to use your data to train their general-purpose AI models, and they do not retain it beyond what is needed to perform the processing.

  • The Platform does not make automated decisions that have legal or similarly significant effects on individuals.

If you have questions about this processing, contact us at support@futuretracker.com.

6. Legal bases for processing

Where the Data Protection (Bailiwick of Guernsey) Law, 2017, the UK GDPR or the EU GDPR applies, we rely on the following legal bases:

  • Performance of a contract — to provide the Services to you and your organisation, and to take steps at your request before entering into a contract.

  • Legitimate interests — to operate, secure, analyse and improve the Services, to communicate with business contacts about our products and services, and to prevent fraud — balanced in each case against your interests, rights and freedoms.

  • Consent — where required, for example for certain cookies or marketing. You can withdraw consent at any time; withdrawal does not affect processing carried out before it.

  • Legal obligation — where processing is necessary to comply with law, for example cooperating with a regulator or law-enforcement body.

  • Vital interests — where necessary to protect someone’s life or safety.

7. When and with whom we share personal information

We share personal information with service providers who help us run the Services, under contracts that restrict what they may do with it:

We may also share personal information:

  • with our professional advisers (lawyers, accountants, insurers) where necessary;

  • in connection with a merger, acquisition, financing or sale of all or part of our business (a “business transfer”);

  • where required by law, regulation, legal process or enforceable governmental request; and

  • at your direction or with your consent.

We do not sell personal information to third parties.

8. Cookies and analytics

A cookie is a small file placed on your device by a website. We use cookies and similar technologies (including browser local storage) as follows:

  • Essential — the Platform stores authentication tokens in your browser to keep you signed in and to secure your session. These are necessary for the Platform to work. On the Website, our hosting provider (Squarespace) sets an essential security cookie (“crumb”, session only, used to protect forms against cross-site request forgery) and, once you make a choice in the cookie banner, cookies recording your preferences (“ss_marketingCookiesAllowed” and “ss_performanceCookiesAllowed”, expiring after 30 days. These are necessary to operate the Website and honour your choices.

  • Analytics — we use Google Analytics 4 on the Website to understand how it is used. The Google Analytics cookies we use are:

Most browsers accept cookies automatically, but you can usually set your browser to decline them. Declining cookies may prevent parts of the Services from working. No uniform Do-Not-Track standard has been adopted, so we do not currently respond to DNT browser signals.

9. International transfers

Your information may be stored and processed in Guernsey, the United Kingdom, the European Economic Area and the United States by us and by the providers listed in section 7. Guernsey benefits from a European Commission adequacy decision. Where personal information is transferred to a country that has not been found adequate (for example the United States), we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum. Copies of the relevant safeguards are available on request.

10. How long we keep information

  • Account information — for as long as your account is active, plus a limited period afterwards to handle queries and meet legal obligations.

  • Customer Content — for the duration of the customer organisation’s subscription. On termination it is deleted or returned in accordance with our agreement with that organisation (see the Data Processing Agreement), subject to residual copies in backups that are deleted on a rolling cycle.

  • Legal retention — we keep records longer where tax, accounting or other law requires it.

  • We may retain aggregated or anonymised data that no longer identifies any person. When we have no ongoing legitimate need to keep personal information, we delete or anonymise it, or — if that is not immediately possible (for example, backup archives) — we isolate it from further processing until deletion is possible.

11. How we keep information safe

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS) and at rest, per-organisation segregation of Platform data enforced by database access rules, role-based access controls, least-privilege administrative access, and logging and monitoring. Our cloud infrastructure providers maintain independently certified security programmes (including ISO/IEC 27001 and SOC 2).

No transmission over the internet or storage technology can be guaranteed 100% secure, so we cannot promise that unauthorised third parties will never defeat our security. The Website may link to other sites; we are not responsible for their content or privacy practices.

12. Information about minors

The Services are intended for business use by adults. We do not knowingly collect data from, or market to, anyone under 18. By using the Services you represent that you are at least 18 years old. If you believe we hold data about someone under 18, contact us at support@futuretracker.com and we will delete it.

13. Your privacy rights

Depending on where you are located, you may have the right to:

  • request access to, and a copy of, your personal information;

  • request correction of inaccurate information, or erasure;

  • restrict or object to processing of your personal information;

  • data portability;

  • withdraw consent at any time, where processing is based on consent; and

  • opt out of marketing at any time, using the unsubscribe link in our emails or by contacting us. We may still send you non-marketing service messages.

To exercise any right, email support@futuretracker.com. We will verify your identity and respond in accordance with applicable law (generally within one month). You can also review and update your profile information directly in the Platform. If your request concerns personal information contained in another organisation’s Customer Content, we may refer the request to that organisation (see section 2).

If you believe we are processing your personal information unlawfully, you have the right to complain to a supervisory authority: in Guernsey, the Office of the Data Protection Authority (www.odpa.gg); in the UK, the Information Commissioner’s Office (ico.org.uk); in the EEA, your local data protection authority (a list is available at https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm).

14. Additional regional information

California residents

California Civil Code Section 1798.83 (“Shine The Light”) permits California residents to request information about disclosure of personal information to third parties for their direct marketing purposes. We have not disclosed or sold personal information to third parties for business or commercial purposes in the preceding twelve months, and we do not sell personal information. California residents may exercise rights to know, delete and correct, and will not be discriminated against for doing so, by contacting us at the details below. An authorised agent may act for you if they provide proof of valid authorisation.

Canada

Where Canadian privacy law applies, we process personal information with your express or implied consent, except where the law permits or requires otherwise. You may withdraw consent at any time.

15. Changes to this policy

We may update this policy from time to time. The updated version will show a revised effective date and applies as soon as it is published. If we make material changes, we will notify you by a prominent notice on the Website or Platform, or by email.

16. How to contact us

Email: support@futuretracker.com

Post: Environmental and Social Impact Monitor Limited, First Floor, Harbour Court, Les Amballes, St Peter Port, Guernsey, GY1 1WU.

To review, update or delete the personal information we hold about you, contact us at the address above or use your profile settings in the Platform.