Privacy Policy

This policy explains how Skoot Eco Group Ltd ("Skoot", "we", "us") collects and uses personal data when you use the SkootEco MARC carbon-assessment platform (the "Service"). We are the data controller.

Registered company: Skoot Eco Group Ltd, company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS]. ICO registration [ICO REGISTRATION NUMBER]. Privacy contact: [privacy@skoot.eco].

What we collect

• Account data — your name and email address. Sign-in (including your password and session) is handled by Skoot Core, not stored by this platform.
• Assessment data you provide — organisation details (name, sector, size, financial year end), the answers you give during an assessment, files you upload (spreadsheets and PDF documents such as energy bills and invoices), and your conversation with the Marc assistant.
• Emissions results — the carbon figures we calculate from your inputs and the reports generated from them.
• Payment data — when you buy a report, payment is processed by Stripe. We receive confirmation and limited metadata (amount, status, a customer reference); we do not receive or store your full card details.
• Usage & diagnostics — with your consent, analytics and error-diagnostic events (see our Cookie Policy). Without consent we do not set analytics cookies.

How and why we use it (lawful bases)

• To provide the Service — run assessments, calculate emissions, generate and deliver reports, manage your account. Basis: performance of a contract.
• To take payment and send transactional email (receipts, report-ready and review reminders). Basis: contract / legitimate interests.
• To secure and improve the Service — error diagnostics, fraud and abuse prevention. Basis: legitimate interests.
• Analytics — understanding usage. Basis: consent (withdrawable at any time).
• Legal retention — see "Data retention after account deletion" below. Basis: legal obligation / legitimate interests / legal claims.

Who we share it with (processors)

We use trusted providers who process data on our behalf under contract:

• Stripe — payment processing.
• Resend — transactional email delivery.
• PostHog — product analytics and error diagnostics (consent-gated).
• Cloudflare R2 — encrypted storage of generated report files.
• Railway — application hosting and the PostgreSQL database.

We do not sell your personal data. Some providers are based outside the UK/EEA; where that is the case, transfers are protected by UK-approved safeguards (e.g. the International Data Transfer Agreement / Addendum or adequacy regulations).

Your rights

Under UK GDPR you can:

• Access & portability — download your data any time from Settings → Your data → Download my data.
• Rectify — correct your details in Settings.
• Erase — delete your account in Settings → Danger zone (subject to the retention below).
• Restrict / object to certain processing, and withdraw analytics consent at any time.
• Complain to the Information Commissioner's Office (ico.org.uk).

Data retention after account deletion

When you delete your account, we immediately and permanently remove your user profile — your name and email address, and end your active session.

If you previously generated a carbon report through the platform, we retain the associated organisation and assessment records — including the methodology, the calculated emissions, and the attestation signature (the name and email recorded at the moment the report was generated) — for seven years from the date of your most recent report. These records are de-linked from your login, but because a report names its signatory they are not fully anonymised. We do not retain your account login, settings, or any data unrelated to a report.

We rely on this period under Article 17(3)(e) UK GDPR (establishment, exercise or defence of legal claims), aligned with the six-year limitation period in the Limitation Act 1980 (rounded to seven to cover late discovery and insurance run-off). The clock runs from the last report on the account; if no report was ever generated, the records are deleted seven years from account deletion. After the window, deletion is automatic.

You can request earlier deletion by contacting us, but we may decline where a specific legal claim is reasonably foreseeable or in progress.

Security

Data is encrypted in transit, access is restricted, and report files are served only through authenticated, payment-checked routes. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

Children

The Service is for businesses and is not directed at anyone under 18.

Changes

We may update this policy; material changes will be reflected in the "Last updated" date above and, where appropriate, notified to you.

Contact

Questions or requests: [privacy@skoot.eco], Skoot Eco Group Ltd, [REGISTERED ADDRESS].