Who we are

FourTwoThree aims to simplify climate action by making critical climate data visible, actionable, and shareable for every business. K423 LIMITED, hereafter referred to as "FourTwoThree" or "we", is a company registered in England and Wales at Office 7 35-37 Ludgate Hill, London EC4M 7JN with company number 15722467. As part of our services, we may process personal data and are committed to respecting and protecting the privacy of the data we handle. This privacy notice (the "Privacy Notice") provides information about how FourTwoThree processes your data and outlines your rights.

Who this Notice applies to

This Privacy Notice applies to the personal data of clients, customers, and suppliers of FourTwoThree. It does not cover employees, consultants or job applicants.

Where we may collect your personal data from

FourTwoThree may collect your personal data at different times and from different sources. What we collect about you will depend on how you interact with us and the reason we need to collect it. We will only collect and process your personal data where we have a lawful basis to do so. We mainly collect personal data about you from the following sources or in the following circumstances:

• From affiliates, subsidiaries or acquired businesses,
• From your interactions with our website(s), social media or other digital channels,
• From email and other digital correspondence or subscriptions,
• Via video or audio calls and other verbal communications,
• When you enquire about or use our products or services,
• When you provide products or services to us,
• From third parties or business partners from whom we purchase, license, or otherwise receive data,
• From publicly available sources, both online and offline,

What Personal Data we may collect

FourTwoThree may collect following personal data from you:

Business Contact Information: Such as, your name, business email address, phone number, business postal address, and other contact details. Professional Information: Such as, your job title, business name, industry sector, country or location, and information relevant to our service or relationship with you. Correspondence: Information that you choose to provide to us in emails, paper communications, electronic messages, and other forms of communication. Audio and Visual Data: Such as, recordings or photographs we have taken of you at meetings, events, or forums that you attend. Technical Data: Such as, information from your website visits or social media interactions with FourTwoThree, which may include IP addresses and engagement metrics. Sanction and Know Your Customer Checks: Details we are required to obtain from you to complete our compliance checks.

FourTwoThree does not typically seek to collect or process personal data which may be classed as sensitive or special category such as data relating to race or ethnic origin, religious beliefs, criminal record, physical or mental health or sexual orientation. Should we need to process or collect any sensitive or special category data, we will make this clear to you at the point of collection and request your consent if it is required. Furthermore, we do not seek to collect or process data on children. Please do not provide us with this type of data without our express permission.

How we may use your personal data and our legal basis for doing so

FourTwoThree relies on certain legal bases when we collect personal data, and we collect the personal data for various purposes. The table below outlines how we use the data and the legal basis for each use.

Purpose	Legal Basis used
To market our services	Consent (where you opt-in to receive marketing from us) Legitimate Interest (where you have engaged with us or our services and we have good reason to believe you will be interested in hearing more about our services)
To provide our services to you	For the performance of a contract
To develop and provide our services	Consent Legitimate interest For the performance of a contract
To reply to communications when you contact us	Legitimate Interest For the performance of a contract (if we have a contractual relationship with you)
To administer our business	For the performance of a contract Compliance with a Legal or Regulatory obligation Legitimate interest
To enable us to manage and secure our website and services	Consent Legitimate Interest Compliance with a Legal obligation
To sell our business or procure investment	Legitimate Interest
To comply with the law or other legal/regulatory obligations	Compliance with a Legal obligation

Who we may share your Personal Data with

FourTwoThree may share your personal data with the following categories of third parties:

• Affiliates or subsidiaries when required to deliver our services,
• Service providers and sub-contractors to help deliver our services, subject to our contracts with them to only process your personal data under our instruction,
• Background checking or "know your customer" providers or services to help us comply with our legal and regulatory obligations,
• Business partners (with your permission or when required to deliver our services),
• Any organisation who seeks to invest in or purchase our businesses to ensure our business can be continued following the investment or purchase, and/or
• Regulators, Authorities, Enforcement Agencies and other third parties where we believe that such disclosure is reasonably necessary to comply with an applicable law or regulation or if we determine that for purposes of national security, law enforcement, or other issues of public importance, disclosure is lawful, necessary or appropriate.

FourTwoThree does not sell, rent or lease personal data except for the purposes outlined in this Privacy Notice.

International Transfers

FourTwoThree processes data from individuals worldwide. To support our global operations, our systems and service providers may also be located internationally, which means your personal data may be transferred to countries outside your own.

When transferring your personal data internationally, we will ensure that your rights and data security are protected with appropriate safeguards to comply with applicable data protection laws. These safeguards may include:

EU, UK or Swiss safeguards which apply to the transfer of personal data from these countries to another country which has not been deemed adequate by the appropriate regulator including the EU Standard Contractual Clauses, International Data Transfer Agreements or relevant Addendums to the EU Standard Contractual Clauses, Ensuring a US based third party is certified to the Data Privacy Framework and complies with any relevant standards or contractual obligations required to comply with applicable data protection laws, and/or Ensuring that similar agreements or safeguards which may be required under other applicable laws are in place where personal data is being transferred internationally.

Individual Privacy Rights

FourTwoThree acknowledge that, depending on where you are in the world, you may have rights related to your personal data, which are often referred to as data subject rights. Please keep in mind that the law is complicated and depending on where you live and the particular circumstances these rights will not always be available to you all of the time.

Your rights may include:

• To have access to personal data we are processing about you
• Correcting or completing incorrect or incomplete personal data
• The right to be forgotten (also known as the right to erasure or deletion)
• The right to object to our use of your personal data
• The right to restrict our use of your personal data
• The right to transfer your personal data to a third party
• If we have gained your consent for the processing of your data, you have the right to withdraw that consent

If you are seeking to exercise any of these rights, please contact us using the details in the "Contact Us" section below. Please note that we may need to request further information to verify your identity before we can fulfil any of your rights under data protection law.

You also have the right to lodge a complaint with a supervisory authority for the country that you live in. However, if you are considering making a complaint, we would like the opportunity to see if we can resolve your complaint before you contact your supervisory authority. If you have a complaint, please contact us using the details in the "Contact Us" section below.

If you are based in England and Wales your supervisory authority is the Information Commissioner's Office, if you are based in the EU, you can find your relevant supervisory authority here.

Retention

FourTwoThree shall keep personal data only for a period necessary to fulfil its intended purposes, maintain our relationship with you, and/or meet legal or regulatory obligations. Once those purposes are satisfied, FourTwoThree will securely destroy or, if we have a lawful basis to do so, anonymize your data according to the applicable regulations and standards.

For further information on our retention periods, please contact us using the details in the "Contact Us" section below.

If FourTwoThree anonymise your data, so that it can no longer be associated with you, we may keep it in perpetuity for our own uses, such as to improve our services or complete analytics.

Security

FourTwoThree take the confidentiality and security of all the data we process very seriously. We are constantly reviewing and developing our security policies, processes and systems to take account of new threats and risks which appear.

FourTwoThree security standards may include:

• Physical and/or logical access to our locations and systems
• Technological controls include user authentication including multifactor authentication, antivirus programs, firewalls and the use of strong encryption.
• Systems are monitored and where possible, data is physically or logically separated.
• We aim to exceed industry "good practice" standards to support and promote the maintenance of a robust information security management system.

Contact Us

Please feel free to reach out to us if you would like to exercise your data subject rights or obtain further information regarding our processing of personal data.

You can contact us on contact@fourtwothree.io