Privacy Policy
Global Optimism Strategy Ltd ("we"/"us"/"our") are committed to protecting and respecting your privacy. This policy explains what personal data we collect when you use the Climate Plums community platform, why we collect it, who we share it with, how we use it, and how we protect it. If you have questions, please contact us at julia@globaloptimism.com.
Who we are
The Climate Plums community platform is operated by Global Optimism Strategy Ltd, a company registered in England and Wales. We work with Global Optimism Impact to collaborate on our joint goal of promoting climate advocacy. Please see the "Who do we share your data with" section below for more detail.
For the purposes of UK and EU data protection law, Global Optimism Strategy Ltd is the data controller — the organisation responsible for deciding how your personal data is used.
Contact: julia@globaloptimism.com
What information we collect
We may collect the following personal data directly from you when you use the Climate Plums platform:
- When you sign in, we verify that your email address appears on our alumni list
- When you create or update your profile: first name, last name, city, country, organisation, role, sector, retreat cohort year(s), a public contact email address (optional), and a profile photo (optional)
- When you register for a community event: your RSVP status
- When you participate in a forum: posts and replies you submit
- When you submit a community offering: your name, contact details, and the content of your offer
- When you contact us through our website or otherwise
We also collect limited technical data through the use of a strictly necessary sign-in cookie. See "Cookies and tracking" below. We do not collect financial information, passwords, or any special category data (such as health information, political views, or ethnicity).
How we collect, use and store personal data
We collect, use and store your personal data for the following purposes:
- To operate the platform — verifying you are a retreat alumni, enabling sign-in, and displaying your profile to other community members. Legal basis: legitimate interests (running a private alumni community for people who have attended a Global Optimism retreat).
- To display your profile in the member directory — only if you opt in by enabling "Share with community" in your profile settings. Legal basis: consent. You can withdraw this at any time in your profile settings.
- To send event and forum notifications — only when you have joined an event or forum. Legal basis: legitimate interests. You can opt out via the one-click unsubscribe link in any notification email.
- To record your consent — we store the date you first agreed to our data processing terms. Legal basis: legal obligation.
- For our own legitimate interests in monitoring usage of the platform and improving it, and promoting the work of Global Optimism Strategy Limited.
- Otherwise to comply with data protection laws.
If you do not want us to use your data in this way, please contact us at julia@globaloptimism.com.
Data Subject Access Request
You have the right to request access to the personal data we hold about you. If you wish to make a Data Subject Access Request (DSAR), please contact us at julia@globaloptimism.com. We will respond to your request within one month as required by applicable data protection laws.
Please note that we may require further information from you to verify your identity and ensure the security of your personal data. In certain circumstances we may be legally permitted to refuse your request, in which case we will inform you of the reasons for the refusal.
Who do we share your data with?
We do not sell or trade your personal data. We may need to share your data with companies that support the work that we do as our service providers, but when we do that, they are acting as our "data processor" only and they do not have any right to use your personal data for their own purposes.
| Service | Purpose | Data transferred | Location |
|---|---|---|---|
| Supabase | Database hosting (stores all member data) | All profile and activity data listed above | EU — Ireland |
| Resend | Transactional email (sign-in links, notifications) | Email address, name, notification content | EU |
| Vercel | Platform hosting and serverless functions | IP address, request logs | EU / UK |
We have a shared relationship with Global Optimism Impact Limited in pursuing our joint goal of promoting climate advocacy. If we share your data with Global Optimism Impact Limited, we will do so only where we consider it in our legitimate interests and where we have assessed that any risk to your data is low. Their privacy policy can be found at outrageandoptimism.org/privacy.
Security
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. All connections to the platform are encrypted via HTTPS. Your session token is stored in an HttpOnly cookie, meaning it cannot be accessed by JavaScript in the browser. Database access is restricted to authorised server-side code only. We limit access to your personal data to those who have a business need to know, and they will only process your personal data on our instructions subject to a duty of confidentiality.
Data retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. If you request deletion of your account, we will erase all of your personal data within 30 days, except where we are legally required to retain certain records.
If you no longer wish to receive notifications from the platform, you can opt out via the one-click unsubscribe link in any notification email, or by contacting us.
Your rights
You have a number of rights under data protection law in relation to your personal data. You have the right to:
- Request access to your personal data (see "Data Subject Access Request" above).
- Request correction of the personal data that we hold about you — you can update most of your data directly in your profile settings.
- Request erasure of your personal data in certain circumstances ("right to be forgotten").
- Object to processing of your personal data where we are relying on a legitimate interest as the legal basis for that particular use of your data.
- Request the transfer of your personal data to you or to a third party in a machine-readable format.
- Request restriction of processing of your personal data.
- Withdraw consent at any time where processing is based on consent (e.g. directory listing) — you can do this directly in your profile settings.
If you wish to exercise any of these rights, please contact us at julia@globaloptimism.com. We will respond within 30 days.
We aim to handle all data-related matters directly with you and address any concerns you may have. If you do not think that we have acted within the law, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
Cookies and tracking
The Climate Plums platform uses a single, strictly necessary cookie — cnlc_session — to keep you signed in. This cookie is:
- HttpOnly — not accessible to JavaScript in your browser
- Secure — transmitted only over encrypted HTTPS connections
- Set to expire after 365 days
This cookie does not track your browsing behaviour and is not used for advertising or analytics. No third-party tracking scripts or analytics tools are loaded on this platform.
As a strictly necessary cookie required for the service you have requested (secure sign-in), prior consent is not required for this cookie under the UK ePrivacy Regulations. However, you remain free to delete cookies from your browser at any time — doing so will sign you out of the platform.
Children
The Climate Plums platform is intended for adults aged 18 and over who have attended a Global Optimism retreat. We do not knowingly collect data from anyone under 18.
Transferring personal data outside the UK / EU
Countries outside the UK and the European Union may have a lower standard of protection for personal information than that required by UK and EU data protection laws. The personal data we collect may be transferred to, and stored, outside the UK or EU (including, for example, in the United States) and may also be processed by people or companies operating outside the UK or EU who work for us or one of our service providers.
In the event that we need to transfer personal data to a company based outside the UK or the EU, we do our best to ensure that the data is handled in line with UK and EU law by checking that the data is protected by appropriate contractual terms, including Standard Contractual Clauses where required.
Changes to this policy
If we make material changes to this policy, we will notify members by email before the changes take effect. The "Last updated" date at the top of this page will always reflect the current version.