Privacy policy

Last updated: 8 September 2025

1. Who we are and what this policy covers

EcoLedger is a trading name of Eco-Quantum Wealth Ltd, a company registered in England and Wales (Company No. 15923322) with its registered office at 167-169 Great Portland Street, 5th Floor, London W1W 5PF ("EcoLedger", "we", "us", "our"). We are the data controller responsible for the personal data described in this policy, except where section 2 states otherwise.

EcoLedger supplies a sustainability accounting and regulatory disclosure platform to businesses under annual subscription licences, together with related advisory and implementation services. This policy explains how we handle personal data when you visit our website at theecoledger.com and its subdomains, when you use our free tools, when you use the licensed platform, when you correspond with us, and when you or your organisation enter into or perform a contract with us.

We do not operate a consumer retail business. Our services are supplied to organisations and to individuals acting in the course of a business, trade or profession.

2. Our two roles: controller and processor

It matters which role we are acting in, because it determines who you deal with about your data.

We are the controller of personal data about visitors to our website and tools, prospective and current customer contacts, users who hold a platform account, and billing and correspondence contacts. This policy governs that data.

We are a processor of any personal data contained within the data a customer uploads to, or generates in, the licensed platform ("Customer Data"), for example names or contact details appearing in activity data, supplier records, evidence files or emissions inventories. We process Customer Data only on the documented instructions of the customer, under the data processing terms in the subscription licence agreement [DPA clause reference]. Where you are an employee, supplier or other contact of one of our customers and you wish to exercise your rights over data held in that customer's account, please contact that organisation. If you contact us, we will refer your request to them.

3. Personal data we collect

Depending on how you interact with us, we may collect and process:

Business contact data: name, job title, employer, business email address, business telephone number, business postal address and LinkedIn or other professional profile details.
Account and authentication data: username, hashed password, access credentials, module entitlements, role and permission settings, session and login records.
Contract and commercial data: the organisation you represent, the licence and modules purchased, order forms, statements of work, correspondence relating to scoping, renewal and support.
Billing and payment data: billing contact details, invoices, purchase orders, VAT and company registration details, payment status and transaction references. Card details are handled by our payment provider and are not stored by us.
Correspondence and support data: the content of emails, meeting requests, support tickets, scoping and demonstration call notes, and any information you choose to include in them.
Tool and enquiry data: information you enter into our free tools, including the Standards Tracker, the carbon calculator and the scope readiness check, together with any email address you give us to receive results or the Monday 5 digest.
Technical and usage data: IP address, device and browser type, operating system, referring page, pages viewed, features used, dates and times of access, and similar diagnostic and analytics data, including data collected through cookies and comparable technologies.

We do not seek to collect special category data as defined in the UK GDPR, and you should not submit it to us.

4. Where we obtain personal data

From you directly, when you complete a form, request a demonstration or working session, subscribe to the Monday 5, use a free tool, correspond with us, or use the platform.
From the organisation you work for, when it provides contact details in order for us to provision accounts, deliver services or issue invoices.
Automatically, through cookies, analytics and server logs when you use our website, tools or platform.
From third party sources, including business contact data providers, publicly available professional sources such as company websites, public registers and professional networks, and referrals from partners. Where we obtain your details this way, we use them only to make a relevant business to business approach, and we tell you where we got them if you ask.

5. Why we use personal data, and our lawful bases

Under the UK GDPR and the EU GDPR we must have a lawful basis for each purpose. Ours are as follows.

To negotiate, enter into and perform our contract with your organisation, including scoping sessions, provisioning accounts, delivering the platform and services, invoicing and support. Lawful basis: performance of a contract, or our legitimate interests in administering a contract with the organisation you represent.
To operate, secure and improve the platform, tools and website, including authentication, fault diagnosis, capacity planning and product development. Lawful basis: legitimate interests in running and improving a secure service.
To market our services to businesses, including sending the Monday 5 regulatory digest and other business to business communications, and running advertising campaigns. Lawful basis: consent where required, and otherwise our legitimate interests in promoting our services to relevant organisations.
To detect and prevent fraud, misuse and security incidents, and to protect our rights, our customers and our systems. Lawful basis: legitimate interests, and compliance with legal obligations.
To comply with legal and regulatory obligations, including accounting, tax, and responding to lawful requests from authorities. Lawful basis: legal obligation.
To establish, exercise or defend legal claims. Lawful basis: legitimate interests, and legal obligation where applicable.

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests or fundamental rights. You may ask us for further information about that assessment.

6. Marketing communications

We send business to business marketing by email, including the Monday 5 digest and information about our services. Every marketing email contains an unsubscribe link, and you can also opt out at any time by emailing info@theecoledger.com. Opting out of marketing does not stop service messages such as invoices, renewal notices, security notifications or messages about your account.

Where you are a sole trader or an unincorporated partnership, we will only send marketing email with your consent or where you have previously enquired about or purchased our services.

7. Cookies, analytics and advertising

Our website and tools use cookies and similar technologies. Strictly necessary cookies keep the site and your session working. Analytics and advertising cookies, including Google Analytics 4, Google Tag Manager and Google Ads, help us understand how the site is used and measure campaign performance, and are set only where you have consented through our cookie banner. You can change or withdraw your cookie preferences at any time using the banner or your browser settings. [Link to the cookie policy and preference centre.]

8. Who we share personal data with

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose it only as follows.

Service providers acting on our instructions, under written contracts that require them to protect it. These currently include providers of website and storefront hosting, application hosting, content delivery and storage, transactional email, customer relationship management, analytics and advertising measurement, accounting, and office and file storage. A current list of our sub-processors is available on request.
Payment and banking providers, to take payment and reconcile accounts.
Professional advisers, including our accountants, auditors, insurers and lawyers, where necessary and under a duty of confidentiality.
Authorities and third parties, where we are required to do so by law, to respond to valid legal process, or to establish, exercise or defend legal claims.
A purchaser or successor, in connection with a merger, acquisition, reorganisation or insolvency, subject to appropriate confidentiality protections.

Our website is hosted on the Shopify platform, and Shopify processes personal data relating to your visit in order to host and secure the site. Cloudflare and Netlify provide hosting, delivery and security for the platform and our free tools.

9. International transfers

Some of our service providers are located outside the United Kingdom and the European Economic Area. Where we transfer personal data to such a country, we rely on an adequacy decision where one applies, and otherwise on appropriate safeguards, being the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or the Standard Contractual Clauses themselves, together with any supplementary measures required. You may request a copy of the relevant safeguard by contacting us.

10. Retention

We keep personal data only for as long as we need it for the purposes set out above, and then delete or anonymise it. In broad terms:

Account and platform data is retained for the duration of the subscription and for [period] afterwards, unless the customer instructs deletion sooner under the subscription licence agreement.
Contract, invoicing and accounting records are retained for [six] years from the end of the relevant financial year, to meet statutory accounting and limitation requirements.
Marketing contact data is retained until you unsubscribe or after [period] of inactivity, whichever is sooner.
Website and analytics data is retained for [period].

Customer Data held in the platform is deleted or returned in accordance with the subscription licence agreement following termination.

11. Security

We maintain technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls and role based permissions, hashed credentials, logging, environment separation between staging and production, and restricted administrative access. No system can be guaranteed to be completely secure, and we ask that you keep your access credentials confidential and do not send sensitive information to us by unsecured channels.

12. Your rights

Subject to the conditions and exemptions in applicable law, you have the right to request access to your personal data, correction of inaccurate data, erasure, restriction of processing, portability, and to object to processing carried out on the basis of legitimate interests, including profiling. Where we rely on consent, you may withdraw it at any time, without affecting processing carried out before withdrawal. You also have the right to opt out of direct marketing at any time.

To exercise any of these rights, email info@theecoledger.com. We may need to verify your identity before we act, and we will respond within one month, which we may extend by up to two further months for complex requests, telling you if we do. Exercising your rights will not lead to any detriment.

Where the data in question sits in a customer's platform account, please see section 2.

13. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at info@theecoledger.com so that we can try to resolve it. You also have the right to complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office, ico.org.uk, telephone 0303 123 1113. If you are in the European Economic Area, you may complain to the supervisory authority in your country of residence, place of work or the place of the alleged infringement.

14. Children

Our website, tools and platform are directed at businesses and are not intended for children. We do not knowingly collect personal data relating to children. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Information for United States residents

We do not sell personal information, and we do not share personal information for cross-context behavioural advertising, as those terms are used in United States state privacy laws. Where those laws apply to you, you may have rights to know, delete, correct and obtain a portable copy of your personal information, and to appeal a decision we make about a request. Contact us at info@theecoledger.com to exercise them.

16. Changes to this policy

We may update this policy to reflect changes to our services, our processing or the law. We will post the revised version here and update the date at the top. Where a change is material, we will provide notice as required by applicable law.

17. Contact

Questions about this policy, our processing or your rights should be sent to info@theecoledger.com, or by post to Eco-Quantum Wealth Ltd, 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom.