Privacy policy

Climaera ("we", "us", "the company") is the data controller for the personal data we collect about you. This privacy policy explains what information we collect, how we use it, and what rights you have.

We process personal data in accordance with the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR).

1. What information we collect

We collect the following categories of personal data:

• Identification data: Name, email address, job title, and company name upon registration
• Usage and log data: Actions taken on the platform, login timestamps, and IP addresses
• Technical data: Browser type, device type, and operating system
• Payment data: Invoice information and payment history (card details are not stored by us, but by our payment provider)
• Communication data: Messages you send us via email or our support system
• Climate data: Emissions data, project information, and reports you create on the platform

Supplier contact information: When you invite a supplier into your supplier network, we register the name and email address of the contact person at that supplier. This information is provided by you as the customer, and is used solely to send the invitation and collect the supplier's climate documentation. It is otherwise processed under the same rights and retention principles as the rest of the information in this policy.

2. Purpose and legal basis

We process personal data for the following purposes:

3. Sharing of information

We do not share your personal data with third parties for their own marketing purposes. We may share information with:

• Sub-processors (data processors): Cloud infrastructure (Supabase/AWS), payment processor, email service, AI service provider for KlimaRåd (Anthropic) — all bound by data processing agreements
• Public authorities: Where we are legally required to
• A new owner in the event of a business transfer: With advance notice to you

4. Transfers to third countries

Some of our sub-processors may process data outside the EEA. Where this happens, we ensure a valid transfer mechanism is in place, typically Standard Contractual Clauses (SCCs) approved by the European Commission, or that the receiving country is recognized as providing adequate protection.

5. Retention period

We retain personal data for as long as necessary for the purpose it was collected for:

• Account data: For as long as the subscription is active, plus 90 days after termination
• Accounting data: 5 years under the Norwegian Bookkeeping Act
• Log data: 12 months
• Marketing communications: Until consent is withdrawn

6. Cookies

We use cookies to:

• Keep you logged in (necessary cookies)
• Remember your preferences (functional cookies)
• Analyze use of the service (analytics cookies, with consent only)

You can manage your cookie settings in your browser. Note that disabling necessary cookies may affect the functionality of the service.

7. Security

We use technical and organizational security measures to protect your personal data, including encryption in transit (TLS) and at rest, access control, and regular security reviews. No transmission over the internet is 100% secure; we cannot guarantee absolute security.

8. Your rights

Under the GDPR, you have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate information
• Erasure: Request that your data be deleted ("the right to be forgotten")
• Restriction: Request that processing be restricted in certain cases
• Data portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Withdraw consent: At any time, without affecting the lawfulness of prior processing

To exercise your rights, contact us at personvern@climaera.com. We will respond within 30 days.

9. Complaints to the supervisory authority

If you believe we are processing your personal data in violation of the GDPR, you have the right to file a complaint with Datatilsynet (the Norwegian Data Protection Authority). More information is available at datatilsynet.no.

10. Contact

Climaera is the data controller for your personal data. Get in touch with us:

This policy may be updated. We will notify you of material changes by email or a notice on the platform. See also our terms of use.