Compare Your Footprint — Privacy Policy
Version: 1.0 | Date: April 2026
Published at: https://www.compareyourfootprint.com/privacy-policy/
Version Log
| Version | Date | Summary |
|---|---|---|
| 1.0 | April 2026 | Initial publication under CYF Impact Ltd. Covers platform users, employee survey respondents, employee profiles, website visitors, marketing contacts, and auditors. |
1 Who We Are
This Privacy Policy is published by the applicable CYF group entity acting as data controller for your personal data, as identified below.
For customers and users contracting with the UK entity (which is the default for all current customers):
CYF Impact Ltd
Registered in England and Wales (No. 16888001)
20-22 Wenlock Road, London, England, N1 7GU
Email: privacy@compareyourfootprint.com
As our group expands, customers in other jurisdictions will contract with the appropriate CYF group entity for their region, as identified in our Group Entity and Jurisdiction Schedule. The relevant entity is the data controller for those customers' personal data.
We are registered with the UK Information Commissioner's Office (ICO) as a data controller. Our ICO registration number is [insert ICO registration number].
2 The Three Roles We Play
Depending on how you interact with us, we may process your personal data in different capacities. Understanding which role applies to you determines your rights and who you should contact.
2.1 CYF as Data Controller
We are the data controller — meaning we decide how and why your personal data is used — in the following situations:
- Website visitors: when you visit compareyourfootprint.com
- Marketing and enquiries: when you contact us, sign up to our newsletter, or engage with our marketing
- Prospective customers: when you request a demo or trial
- Auditors: when you access our platform as an independent verifier under our Auditor Terms of Access
- Employee profiles: when you (as an employee of one of our customers) create a personal profile or use a one-time login link to store your commuting preferences in our platform
When we are the data controller, this Privacy Policy applies directly to you and you may exercise your rights directly with us.
2.2 CYF as Data Processor
We are a data processor — meaning we process personal data on behalf of and under the instructions of another organisation (the data controller) — in the following situations:
- Platform users: when you access and use the Compare Your Footprint platform as an employee or administrator of one of our business customers, your employer (our customer) is the data controller of your personal data. We process it only on their instructions and in accordance with our Data Processing Agreement.
- Employee survey respondents: when you complete a commuting or WFH survey through the platform at your employer's request, your employer is the data controller of that survey data. We process it on their behalf.
When we are a data processor, your primary rights sit with the data controller (your employer). If you have questions about how your employer uses your data, please contact them directly. We will cooperate with any legitimate request passed to us by the controller.
2.3 CYF as Sub-Processor
There are two situations in which CYF acts as a sub-processor — one step further removed from the data controller:
(a) White-label arrangements: Our platform is deployed by a partner organisation under their own brand. The partner's client (the end-client) is the data controller, the partner is the data processor, and we are a sub-processor acting under the partner's instructions. If you are interacting with a platform powered by our technology but branded differently, your data rights sit with that platform provider. Contact them directly.
(b) Consultant and agency arrangements: Where a consultant or agency uses the Compare Your Footprint platform on behalf of their own client, the chain is: the client (data controller) instructs the consultant (data processor) who uses CYF (sub-processor) to carry out the work. In these cases, your rights as an employee or data subject sit with the ultimate client organisation — the data controller — not with the consultant and not with CYF. Contact the organisation that instructed the consultant about their project if you have questions about how your data is used.
3 Personal Data We Collect and Why
3.1 Website Visitors
| Data | Why We Collect It | Lawful Basis | How Long We Keep It |
|---|---|---|---|
| IP address | Security, fraud prevention, analytics | Legitimate interests | 13 months |
| Browser type, device, operating system | Optimising website performance | Legitimate interests | 13 months |
| Pages visited, time on page, referral source | Understanding how the website is used | Legitimate interests | 13 months |
| Cookie data | As described in Section 9 | Consent (where required) / Legitimate interests | As described in Section 9 |
3.2 Marketing Contacts and Enquiries
| Data | Why We Collect It | Lawful Basis | How Long We Keep It |
|---|---|---|---|
| Name and email address | To respond to your enquiry or send you requested content | Legitimate interests / Contract performance | 3 years from last interaction, or until you unsubscribe |
| Organisation and job title | To understand your needs and tailor our communications | Legitimate interests | 3 years from last interaction |
| Marketing preferences | To send you relevant communications and respect opt-outs | Consent (for marketing emails) | Until withdrawn |
| Enquiry and correspondence content | To handle your request and maintain records | Legitimate interests | 3 years |
You can unsubscribe from marketing communications at any time using the unsubscribe link in any email we send, or by contacting privacy@compareyourfootprint.com.
3.3 Platform Users (CYF as Processor — Your Employer is Controller)
When you use the Compare Your Footprint platform as an employee or administrator of one of our business customers, we process the following on your employer's instructions:
| Data | Why We Process It | Retention |
|---|---|---|
| First name, last name, email address | Account creation and identification | Duration of employer's subscription plus up to 1 year in backup |
| Account credentials (hashed) | Secure platform access | Duration of employer's subscription |
| Usage data, login history, activity logs | Service delivery and security | Duration of employer's subscription |
Your rights for this data sit with your employer. If you want to access, correct, or delete this data, contact your employer's data protection contact. Your employer instructs us on what to do with your data.
3.4 Employee Survey Respondents (CYF as Processor — Your Employer is Controller)
When you complete a commuting or working-from-home survey through the platform at your employer's request, we process the following on your employer's instructions:
| Data | Why We Process It | Retention |
|---|---|---|
| First name, last name, email address | To send you the survey and identify your response | Deleted or anonymised within 30 days of survey close, unless you store a profile |
| Telephone number (if provided) | Alternative contact for survey distribution | As above |
| Postcode | To calculate commuting distance — used for calculation only, not retained as a location record | Deleted immediately after the calculation is complete, unless you store a profile |
| Commuting mode preferences | To calculate emissions from your commute | As above |
| Working-from-home frequency | To calculate emissions impact of remote work | As above |
Your rights for this survey data sit with your employer, who has instructed us to run the survey. Contact your employer if you have questions about how they use this data.
If you do not elect to store a profile, we delete or irreversibly anonymise all identifiable data within 30 days of the survey closing. Your anonymised, non-identifiable commuting data may be included in aggregated industry benchmarks — no individual can be identified from these outputs.
3.5 Employee Profiles — Direct Relationship With CYF
If you choose to create a personal profile or store your commuting preferences for future surveys (using our one-time login link or account registration), CYF becomes the data controller for your stored profile data, independently of your employer.
| Data | Why We Collect It | Lawful Basis | How Long We Keep It |
|---|---|---|---|
| Name and email address | To identify you and send login links | Consent | Until you withdraw consent or your profile is inactive for 24 months |
| Postcode (if stored) | To pre-populate future surveys | Consent | Until you withdraw consent or your profile is inactive for 24 months |
| Commuting mode preferences | To pre-populate future surveys and provide personalised carbon guidance | Consent | Until you withdraw consent or your profile is inactive for 24 months |
| WFH frequency | To pre-populate future surveys | Consent | Until you withdraw consent or your profile is inactive for 24 months |
Your rights for this profile data sit directly with CYF.
Profile data is managed entirely through self-service. Because your profile is based on your own consent and linked to your own authenticated account, only you can access, correct, or delete it — through your own login session (one-time link or account).
If your employer asks us to delete your individual profile data, we will direct them to ask you to action it through your own account. The only exception is where an employer is processing a formal data subject access request on your behalf with your written authorisation, in which case we will cooperate with the employer as your authorised representative.
You may at any time, through your own authenticated session or by contacting privacy@compareyourfootprint.com from the email address associated with your profile:
- withdraw consent and request deletion of your profile
- access the data we hold in your profile
- correct any inaccurate data
- receive a copy of your profile data in a portable format
We will honour deletion requests within 30 days. We automatically delete or anonymise profiles that have been inactive (no survey completed) for 24 months.
Important note on historical data: If you delete your profile, your identifiable data is removed. However, aggregated and anonymised outputs (such as industry benchmark reports) that were produced before your deletion request are not retroactively altered — they contain no individually identifiable information and do not constitute your personal data.
One-time login links expire within 24 hours of issue and are invalidated on use. You may request a new link at any time.
3.6 Auditors and Verifiers
| Data | Why We Collect It | Lawful Basis | How Long We Keep It |
|---|---|---|---|
| Name, email, organisation | To manage auditor access to the platform | Legitimate interests (audit integrity) | Duration of audit engagement plus 3 years |
| Timestamp of agreement to Auditor Terms | To evidence acceptance of access restrictions | Legal obligation / Legitimate interests | 6 years (standard contractual limitation period) |
4 Anonymised Data
Where we anonymise personal data — meaning we process it so that no individual or organisation can be identified, directly or indirectly, by any means reasonably likely to be used — the resulting anonymised data is no longer personal data and falls outside the scope of this Privacy Policy and of data protection law.
We use anonymised data to produce industry benchmarks, sector comparisons, and research outputs. This anonymisation is irreversible and meets the standard described in Recital 26 of the UK GDPR.
Once data has been anonymised, deletion requests cannot apply to it. If you delete your employee profile or your employer closes their account, we remove your identifiable data, but anonymised aggregate outputs already produced are not affected.
5 Who We Share Your Data With
5.1 Our Sub-Processors
We use the following third-party service providers to deliver our services. Each is bound by a data processing agreement with us and may only process personal data on our instructions.
| Sub-Processor | Activity | Location | Transfer Mechanism |
|---|---|---|---|
| Maze Digital Ltd | Software development and platform engineering (related group entity) | Malta (EU) | EU–UK adequacy decision |
| Stripe Inc. | Payment processing | UK / USA | Standard Contractual Clauses |
| Xero Ltd | Accounting software | New Zealand | UK adequacy regulations |
| Customer.io | Customer communications and marketing automation | USA | Standard Contractual Clauses |
| Freshworks Inc. (Freshdesk) | Customer support ticketing | USA | Standard Contractual Clauses |
| Aidaform | Web forms | Germany (EU) | EU–UK adequacy decision |
| Google LLC (Google Workspace) | Email, document storage, internal collaboration | USA | Standard Contractual Clauses |
| Anthropic PBC | AI processing (customer data not used for model training) | USA | Standard Contractual Clauses |
| OpenAI Inc. | Embedded AI processing (customer data not used for model training) | USA | Standard Contractual Clauses |
We maintain a current sub-processor list at https://www.compareyourfootprint.com/sub-processors/.
5.2 Other Disclosures
We may also share personal data with:
- Our professional advisors (lawyers, accountants, auditors) where necessary and subject to confidentiality obligations.
- Law enforcement and regulatory authorities where required by law or to protect our legal rights.
- Successor organisations in the event of a merger, acquisition, or sale of all or part of our business, subject to the incoming party assuming equivalent data protection obligations.
We do not sell personal data to third parties. We do not share personal data with advertisers.
6 International Data Transfers
We are based in the United Kingdom. Some of our sub-processors are located in countries outside the UK and the European Economic Area. Where we transfer personal data internationally, we ensure appropriate safeguards are in place as described in the sub-processor table in Section 5.1.
The EU–UK adequacy decision (allowing free flow of data between the UK and EU) is currently in force. If this decision were to change, we would implement alternative transfer mechanisms and notify affected customers.
7 Your Rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights in respect of personal data for which CYF is the data controller (see Section 2.1 and Section 3.5 for when this applies):
| Right | What It Means |
|---|---|
| Access | You may request a copy of the personal data we hold about you. |
| Rectification | You may ask us to correct inaccurate or incomplete personal data. |
| Erasure | You may ask us to delete your personal data where there is no longer a lawful basis for us to hold it. |
| Restriction | You may ask us to restrict processing of your personal data in certain circumstances. |
| Portability | You may ask for your personal data in a structured, commonly used, machine-readable format. |
| Objection | You may object to processing based on legitimate interests or for direct marketing purposes. |
| Withdraw Consent | Where we process your data on the basis of consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. |
To exercise any of these rights, contact us at: privacy@compareyourfootprint.com
We will respond within one calendar month. We may ask you to verify your identity before acting on a request.
If you are a platform user or employee survey respondent (Section 3.3 and 3.4): your rights sit primarily with your employer. Contact them in the first instance. We will cooperate with any request your employer passes to us.
8 How to Complain
If you are unhappy with how we have handled your personal data, please contact us at privacy@compareyourfootprint.com in the first instance and we will work to resolve your concern.
If you remain unsatisfied, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/
9 Cookies
We use cookies and similar tracking technologies on our website. A cookie is a small text file placed on your device.
9.1 Cookies We Use
| Category | Purpose | Examples | Consent Required |
|---|---|---|---|
| Strictly necessary | Essential for the website and platform to function. Cannot be disabled. | Session cookies, authentication tokens, security cookies | No — these are necessary |
| Analytics and performance | Help us understand how visitors use our site so we can improve it. | Google Analytics (Google LLC). We may use additional analytics platforms from time to time; our cookie consent notice is updated whenever new tools are added. | Yes — managed through our cookie consent form |
| Functional | Remember your preferences and settings. | Language preferences, accessibility settings | Yes |
| Marketing | Used to track visitors for remarketing and advertising purposes. | [Specify any remarketing pixels or advertising tools in use, or remove this row if not applicable] | Yes — managed through our cookie consent form |
9.2 Managing Cookies
We operate a cookie consent form on our website. When you first visit, you will be asked to consent to non-essential cookies by category. You can change your cookie preferences at any time using the cookie settings link in the footer of our website, or by clearing your cookies and revisiting.
You can also control cookies through your browser settings, though disabling certain cookies may affect website or platform functionality.
Our cookie consent form is updated whenever we add or remove analytics tools or tracking technologies. The consent form is the live, current record of exactly which cookies we use — if in doubt, refer to that rather than this policy.
10 Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, damage, or disclosure. These measures include:
- encryption of data in transit (TLS) and at rest
- access controls and authentication requirements (including support for two-factor authentication)
- regular security assessments
- sub-processor data processing agreements requiring equivalent security standards
- staff training on data protection obligations
No method of transmission over the internet is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and will notify affected individuals where required by law.
11 Retention Summary
| Data Category | Retention Period |
|---|---|
| Website analytics data | 13 months |
| Marketing contacts | 3 years from last interaction, or until unsubscribe |
| Enquiry and correspondence records | 3 years |
| Platform user data (as processor for customers) | Duration of customer subscription plus up to 1 year in backup |
| Employee survey data (no stored profile) | Deleted or anonymised within 30 days of survey close |
| Employee profile data (stored profile) | Until consent withdrawn or 24 months of inactivity (whichever is earlier) |
| Auditor access records | Duration of audit engagement plus 3 years; agreement timestamp retained 6 years |
| Financial and invoicing records | 7 years (legal requirement) |
| Backup and disaster recovery data | Up to 1 year after deletion from live systems |
When a customer closes their account, we provide a 10-day window to export data and then delete or anonymise User Content within the timeframes above. Anonymised data derived from any account is not subject to deletion and is retained indefinitely as it is no longer personal data.
12 Young People and Age Considerations
Platform and website (CYF as data controller): Our platform accounts and website are intended for individuals aged 16 and over. We do not knowingly collect personal data directly from anyone under 16 in our capacity as data controller. If we become aware that we hold personal data about an individual under 16 without an appropriate lawful basis, we will take prompt steps to address this, which may include seeking parental or guardian consent where required by applicable law, or deleting the data.
Employee surveys (CYF as data processor): Our platform may be used by our customers to run surveys among their employees, which may include employees under the age of 18 (for example, apprentices or young workers). In these cases:
- The customer (employer) is the data controller and is solely responsible for ensuring they have a lawful basis to collect data about their employees, including any employees under 18, and for complying with applicable employment and data protection law in their jurisdiction.
- CYF processes this data on the customer's instructions as a data processor and does not independently verify the age of survey respondents.
- Customers operating in jurisdictions where employees under 16 may be subject to additional data protection protections (for example, EU member states where Article 8 consent thresholds apply) must ensure their own compliance.
Employee profiles (CYF as data controller, consent basis): Profile creation relies on the individual's own consent. In jurisdictions where individuals under 16 (or under 13 in some cases) cannot give valid consent independently for digital services, we ask that individuals in those age groups do not create a profile without parental or guardian consent. If we become aware that a profile has been created by an individual below the applicable consent age without appropriate parental consent, we will delete the profile.
If you have concerns about age-related data processing, contact us at privacy@compareyourfootprint.com.
13 Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do:
- we will update the version number and date at the top of this page;
- for material changes (such as new purposes for using your data or new categories of data collected), we will notify customers by email with at least 30 days' notice;
- for minor clarifications and updates, publication of the new version is sufficient.
The most current version of this Privacy Policy is always available at https://www.compareyourfootprint.com/privacy-policy/.
14 Contact Us
For any questions about this Privacy Policy, to exercise your data rights, or to raise a data protection concern:
Email: privacy@compareyourfootprint.com
Post: CYF Impact Ltd, 20-22 Wenlock Road, London, England, N1 7GU
Attention: Data Protection — Privacy Enquiries
We aim to respond to all privacy enquiries within 5 Working Days and to complete substantive requests within one calendar month.
— End of Privacy Policy v1.0 —
Compare Your Footprint | compareyourfootprint.com