Privacy Policy

Confianx Inc. (Confianx)

Last updated: 1-June-2025

1. Introduction

Confianx ("Confianx", "we", "us", or "our") operates a digital platform that provides neutral infrastructure for energy, carbon, and operational data processing, traceability, and evidence management (the "Platform").

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data and other information when you access or use our website or Platform.

By using the Platform, you acknowledge that you have read and understood this Privacy Policy.

2. Scope of This Policy

This Privacy Policy applies to:

• Visitors to our website
• Registered users of the Platform
• Authorised third parties (e.g. auditors, financial institutions) granted access by users

This Privacy Policy does not apply to third-party services, systems, or websites integrated with or linked from the Platform.

3. Nature of the Platform (Important Clarification)

Confianx is a business-to-business (B2B) infrastructure platform.

Most data processed through the Platform relates to buildings, assets, systems, and operations, rather than to identifiable individuals.

Where personal data is processed, Confianx acts primarily as a data processor / service provider on behalf of its organisational customers, unless otherwise stated.

4. Information We Collect

4.1 Account and Contact Information

• Name, business email address, organisation name
• User role and access permissions
• Support and communications records

4.2 Operational and System Data

• Energy, carbon, and performance data
• Meter, IoT, BMS, and system metadata
• Asset, building, and project identifiers

This data is generally non-personal, unless combined with identifiable individuals.

4.3 Usage and Log Data

• Login timestamps and access logs
• User activity records
• Configuration, calculation, and version history

4.4 AI and Analytics Metadata

• Baseline configurations and model parameters
• Scenario simulations and outputs
• Audit trails and versioned computation records

4.5 Website and Cookie Data

• IP address, browser type, device information
• Session cookies and basic analytics data

5. Data Processing Activities

The following table describes how we process different categories of data:

Data Category

Purpose

Legal Basis (GDPR)

Retention

Account Information (name, email, role)

User authentication, access control, communications

Contract performance (Art. 6(1)(b))

Duration of account + 12 months

Operational Data (energy, IoT, BMS)

Platform services, M&V calculations, reporting

Contract performance (Art. 6(1)(b))

Per contract terms

Usage Logs (access logs, activity)

Security, audit trails, compliance

Legitimate interest (Art. 6(1)(f))

24 months

Cookie Data (analytics, preferences)

Site improvement, personalisation

Consent (Art. 6(1)(a))

Per cookie expiry (max 12 months)

Waitlist / Lead Data (email, role)

Pre-registration interest, product updates

Consent (Art. 6(1)(a))

Until withdrawal or 24 months

AI / Analytics Metadata

Baseline modelling, energy savings verification

Contract performance (Art. 6(1)(b))

Per contract terms

6. How We Use Information

Confianx uses information to:

• Provide, operate, and maintain the Platform
• Enable secure data processing, traceability, and reproducibility
• Support audit-ready record keeping and evidence sharing
• Improve system performance, security, and reliability
• Communicate service updates and operational notices
• Comply with legal, regulatory, and security obligations

Confianx does not sell personal data.

7. Legal Basis for Processing (EU & UK)

Where applicable, Confianx processes personal data based on:

• Performance of a contract
• Legitimate interests in operating a secure B2B platform
• Compliance with legal obligations
• User consent (where required by law)

8. Data Sharing and Disclosure

Confianx may share data:

• With authorised users and third parties granted access by the data owner
• With service providers supporting hosting, security, and infrastructure
• Where required by law, regulation, or lawful government request

Confianx does not share personal data for targeted advertising or marketing purposes.

9. Multi-Party Access and Data Governance

• Organisational customers control access permissions
• Confianx does not determine how shared data is interpreted or relied upon
• Confianx does not validate conclusions drawn by auditors, banks, or other third parties

Users remain responsible for their own governance, disclosure, and compliance obligations.

10. International Data Transfers

Important Disclosure

Your data is transferred to and stored in the United States (AWS North Virginia Region). This transfer is conducted under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs) to ensure data protection.

Confianx operates globally. Data may be processed or stored in jurisdictions outside your country of residence, including regions with different data protection laws.

Where required, Confianx implements appropriate safeguards, including contractual protections, technical security measures, and organisational controls, to ensure lawful cross-border data transfers.

11. Data Retention

• Data is retained according to platform configuration or contractual terms
• Historical and versioned records may be preserved for traceability purposes
• Personal data may be deleted or anonymised upon request, where legally permitted

Confianx is not responsible for external data retention or archival requirements imposed by regulators or contracts.

12. Data Security

Confianx implements reasonable technical and organisational measures to protect data, including:

• Access controls and authentication mechanisms
• Encryption in transit and at rest (where applicable)
• Logging, monitoring, and incident response procedures

No system is completely secure, and Confianx cannot guarantee absolute security.

13. Your Rights

Depending on your location, you may have rights under applicable data protection laws, including:

EU/UK Data Subject Rights (GDPR / UK GDPR / UK Data Protection Act 2018)

Right

Description

How to Exercise

Right of Access

Request a copy of all personal data we hold about you

Email info@confianx.io

Right to Erasure

Request deletion of your personal data ("right to be forgotten")

Email info@confianx.io

Right to Portability

Receive your data in a structured, machine-readable format

Email info@confianx.io

Right to Object

Object to processing based on legitimate interests or direct marketing

Email info@confianx.io

Right to Rectification

Correct inaccurate or incomplete personal data

Email info@confianx.io

Right to Restrict Processing

Limit how we process your data in certain circumstances

Email info@confianx.io

We will respond to all valid requests within 30 days (or 1 calendar month as required under GDPR). You also have the right to lodge a complaint with your local Data Protection Authority (e.g. the ICO in the UK, or your EU member state supervisory authority).

United States (e.g. California)

• Right to know what personal data is collected
• Right to request deletion
• Right to opt out of sale or sharing (note: Confianx does not sell personal data)

Australia

• Right to access and correct personal information

Japan, South Korea, Hong Kong

• Rights of access, correction, and deletion under local law

Saudi Arabia

• Rights under the Saudi Personal Data Protection Law (PDPL)

Requests may be submitted using the contact details below.

14. Cookies and Tracking Technologies

Confianx uses cookies and similar technologies for:

• Strictly Necessary: Essential cookies for site functionality and security (always active)
• Analytics: Help us understand how visitors use the site (requires consent)
• Marketing: Used for targeted advertising (requires consent)
• Functional: Enhanced features and personalisation (requires consent)

No third-party analytics or tracking scripts are loaded until you provide explicit consent via our cookie banner. You may manage your cookie preferences at any time through the banner or your browser settings.

We respect the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we will treat it as a request to reject all non-essential cookies.

15. Children's Data

The Platform is not intended for individuals under the age of 18.

Confianx does not knowingly collect personal data from minors.

16. Changes to This Policy

Confianx may update this Privacy Policy from time to time.

Material changes will be communicated through the Platform or website.

Continued use of the Platform constitutes acceptance of the updated Privacy Policy.

17. Contact Information

For privacy-related questions or requests:

Privacy Officer

Confianx Inc.

info@confianx.io