Privacy Policy
Global Optimism Impact Ltd ("we"/"us"/"our") are committed to protecting and respecting your privacy. This policy explains what personal data we collect when you use the Climate Plums community platform, why we collect it, who we share it with, how we use it, and how we protect it. If you have questions, please contact us at julia@globaloptimism.com.
Who we are
The Climate Plums community platform is operated by Global Optimism Impact Ltd, a company registered in England and Wales.
For the purposes of UK and EU data protection law, Global Optimism Impact Ltd is the data controller — the organisation responsible for deciding how your personal data is used.
Contact: julia@globaloptimism.com
What information we collect
We may collect the following personal data directly from you when you use the Climate Plums platform:
- When you sign in, we verify that your email address appears on our alumni list
- When you create or update your profile: first name, last name, city, country, organisation (optional), role (optional), sector (optional), retreat cohorts (optional), a public contact email address for use by others on the platform (optional), and a profile photo (optional)
- When you register for a community event: your RSVP status
- When you participate in a forum: posts and replies you choose to submit
- When you choose to submit a community offering: the content of your offer
- When you contact us through our website or otherwise
We also collect limited technical data through the use of a strictly necessary sign-in cookie. See "Cookies and tracking" below.
We do not collect financial information, passwords, or any special category data (such as health information, political views, or ethnicity).
Please note that should you choose to provide any personal data on our Climate Plums platform, this will be visible only to other individuals who have attended a Global Optimism retreat. The Climate Plums platform is intended only to be accessed by these individuals. Please note that all content posted will be subject to our User Agreement.
How we collect, use and store personal data
We collect, use and store your personal data for the following purposes:
- To operate the platform — verifying you are a retreat alumni, enabling sign-in, and displaying your profile to other community members. Legal basis: legitimate interests (running a private alumni community for people who have attended a Global Optimism retreat).
- To display your profile in the member directory — only if you opt in by enabling "Share with community" in your profile settings. Legal basis: consent. You can withdraw this at any time in your profile settings.
- To display your content on our forum (to the extent it includes any personal data) — only if you opt in by enabling "Share with community" in your profile settings. Legal basis: consent. You can withdraw this at any time in your profile settings.
- To send event and forum notifications — only when you have joined an event or forum. Legal basis: legitimate interests. You can opt out via the one-click unsubscribe link in any notification email.
- For our own legitimate interests in monitoring usage of the platform and improving it, and promoting the work of Global Optimism Impact Limited.
- Otherwise to comply with data protection laws.
If you have any questions about the above, please contact us at julia@globaloptimism.com.
Who do we share your data with?
We do not sell or trade your personal data. We may need to share your data with companies that support the work that we do as our service providers, but when we do that, they are acting as our "data processor" only and they do not have any right to use your personal data for their own purposes.
| Service | Purpose | Data transferred | Location |
|---|---|---|---|
| Supabase | Database hosting (stores all member data) | All profile and activity data listed above | EU — Ireland |
| Resend | Transactional email (sign-in links, notifications) | Email address, name, notification content | EU |
| Vercel | Platform hosting and serverless functions | IP address, request logs | EU / UK |
Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. All connections to the platform are encrypted via HTTPS. Your session token is stored in an HttpOnly cookie, meaning it cannot be accessed by JavaScript in the browser. Database access is restricted to authorised server-side code only. We limit access to your personal data to those who have a business need to know, and they will only process your personal data on our instructions subject to a duty of confidentiality.
Data retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. If you request deletion of your account, we will erase all of your personal data within 30 days, except where we are legally required to retain certain records.
If you no longer wish to receive notifications from the platform, you can opt out via the one-click unsubscribe link in any notification email, or by contacting us.
Data Subject Access Request
You have the right to request access to the personal data we hold about you. If you wish to make a Data Subject Access Request (DSAR), please contact us at julia@globaloptimism.com.
Please note that we may require further information from you to verify your identity and ensure the security of your personal data. In certain circumstances we may be legally permitted to refuse your request, in which case we will inform you of the reasons for the refusal.
Your rights
You have a number of rights under data protection law in relation to your personal data. You have the right to:
- Request access to your personal data (see "Data Subject Access Request" above).
- Request correction of the personal data that we hold about you — you can update most of your data directly in your profile settings.
- Request erasure of your personal data in certain circumstances ("right to be forgotten").
- Object to processing of your personal data where we are relying on a legitimate interest as the legal basis for that particular use of your data.
- Request the transfer of your personal data to you or to a third party in a machine-readable format.
- Request restriction of processing of your personal data.
- Withdraw consent at any time where processing is based on consent (e.g. directory listing) — you can do this directly in your profile settings.
If you wish to exercise any of these rights, please contact us at julia@globaloptimism.com. We will respond within 30 days.
We aim to handle all data-related matters directly with you and address any concerns you may have. If you do not think that we have acted within the law, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
Cookies and tracking
The Climate Plums platform uses a single, strictly necessary cookie — cnlc_session — to keep you signed in. This cookie is:
- HttpOnly — not accessible to JavaScript in your browser
- Secure — transmitted only over encrypted HTTPS connections
- Set to expire after 365 days
This cookie does not track your browsing behaviour and is not used for advertising or analytics. No third-party tracking scripts or analytics tools are loaded on this platform.
As a strictly necessary cookie required for the service you have requested (secure sign-in), prior consent is not required for this cookie under the UK ePrivacy Regulations. However, you remain free to delete cookies from your browser at any time — doing so will sign you out of the platform.
Children
The Climate Plums platform is intended for adults aged 18 and over who have attended a Global Optimism retreat. We do not knowingly collect data from anyone under 18.
Transferring personal data outside the UK / EU
Countries outside the UK and the European Union may have a lower standard of protection for personal information than that required by UK and EU data protection laws. The personal data we collect may be transferred to, and stored, outside the UK or EU (including, for example, in the United States) and may also be processed by people or companies operating outside the UK or EU who work for us or one of our service providers.
In the event that we need to transfer personal data to a company based outside the UK or the EU, we do our best to ensure that the data is handled in line with UK and EU law by checking that the data is protected by appropriate contractual terms, including Standard Contractual Clauses where required.
Changes to this policy
If we make material changes to this policy, we will notify members by email. The "Last updated" date at the top of this page will always reflect the current version.