Privacy Policy

1. Introduction

Green Culture Index ("we", "us", or "our") operates the website www.greencultureindex.com (the "Site"). We are committed to protecting your privacy and handling any personal data we collect in a transparent, fair, and lawful manner.

This Privacy Policy explains what data we collect, why we collect it, how it is used, and your rights in relation to it. It applies to all visitors to our Site and all individuals who participate in our sustainability workplace culture survey.

This policy has been prepared in accordance with:

• The EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679)

• The Irish Data Protection Act 2018

• The EU ePrivacy Directive (as implemented in Ireland via the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011)

If you are located outside the European Economic Area (EEA), additional protections may apply depending on your jurisdiction. We are committed to meeting internationally recognised privacy standards.

2. Who We Are (Data Controller)

For the purposes of GDPR, the data controller is:
Green Culture IndexWebsite: www.greencultureindex.com
‍
If you have any questions about this Privacy Policy or how your data is handled, you may contact us at: margaret.barrett@graysenrose.com.
‍
Note: If you are based in the EU/EEA or the UK, you have the right to lodge a complaint with your local supervisory authority. In Ireland, this is the Data Protection Commission (www.dataprotection.ie).

3. What Personal Data We Collect

3.1 Survey Responses

Our survey is designed to be anonymous. We do not ask for your name, employer name, or any other information that would directly identify you. Survey questions relate only to your personal experience of workplace culture and sustainability practices.

However, we do collect the following as part of survey participation:

• Country and industry sector (for aggregated benchmarking)

• General demographic information such as approximate company size or seniority level, where provided

• Optional email address, if you choose to provide it to receive survey results or updates

Where an email address is provided, this is treated as personal data and handled accordingly under this policy.
‍

3.2 Analytics Data (Google Analytics)

We use Google Analytics to understand how visitors interact with our Site. Google Analytics collects data such as:

• Pages visited and time spent on the Site

• Approximate geographic location (country/region level)

• Browser type, device type, and operating system

• Referral source (how you arrived at our Site)

This data is collected via cookies and similar tracking technologies. Google Analytics data is aggregated and does not identify you personally. Please see Section 6 (Cookies) for more details.
‍

3.3 Technical Data

Our web hosting provider may automatically log standard technical information such as your IP address, browser type, and access timestamps. This is collected for security and operational purposes and is not used for marketing.

4. Legal Basis for Processing

Under the GDPR, we are required to have a lawful basis for processing personal data. Our legal bases are as follows:

• Consent: Where you provide your email address voluntarily, or where you accept non-essential cookies (such as Google Analytics), we rely on your freely given, specific, and informed consent. You may withdraw this consent at any time.

• Legitimate Interests: We process technical and analytics data on the basis of our legitimate interest in understanding how the Site is used and improving our services, provided this does not override your rights and freedoms.

• Legal Obligation: We may process data where required to comply with applicable laws.

5. How We Use Your Data

We use the data we collect for the following purposes:

• To conduct and analyse anonymous survey research on workplace sustainability culture

• To produce aggregated, anonymised reports and benchmarking indices

• To send survey results or updates to individuals who have provided their email address and consented to receive communications

• To monitor and improve the performance and usability of our Site (via Google Analytics)

• To ensure the security and integrity of our Site

We do not use your data for automated decision-making or profiling. We do not use your data for advertising purposes. We do not sell your data to third parties.

6. Cookies and Tracking Technologies

Our Site uses cookies. A cookie is a small text file placed on your device when you visit a website. Some cookies are essential for the Site to function; others are used for analytics purposes and require your consent.

We use the following categories of cookies:

7. Third-Party Survey Platform

Our survey is hosted on Tally (also known as Tally Forms), a form-building platform operated by Tally BV, August Van Lokerenstraat 71, 9050 Ghent, Belgium (www.tally.so). When you complete our survey, you will be directed to the Tally platform interface. Tally acts as a data processor on our behalf and is bound by a Data Processing Agreement in accordance with GDPR.

Tally is a Belgium-based EU company that stores all form data on servers within the European Union and is fully GDPR compliant. The Tally platform may collect technical information (such as IP address and browser data) in accordance with its own privacy policy. We encourage you to review Tally's privacy policy and GDPR documentation:

• Tally Privacy Policy: https://tally.so/help/privacy-policy

• Tally GDPR information: https://tally.so/help/gdpr

We have configured our survey to collect only the data described in this policy. We do not instruct the platform to collect identifying information beyond what is described herein.

8. International Data Transfers

As we collect survey responses from individuals in multiple countries worldwide, your data may be processed in countries outside your own jurisdiction, including countries outside the EEA.

Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission

• Transfers to countries with an EU adequacy decision

• Compliance with applicable data transfer frameworks (e.g. EU-US Data Privacy Framework)

9. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

• Survey response data (anonymised): Retained indefinitely for research and benchmarking purposes, as it cannot be linked back to any individual

• Email addresses (where provided): Retained until you withdraw consent or unsubscribe, whichever is earlier

• Google Analytics data: Retained for 26 months in accordance with GA4 default settings

• Technical/server logs: Retained for up to 90 days for security purposes

10. Your Rights Under GDPR

If you are located in the EEA (including Ireland), the UK, or another jurisdiction with applicable data protection laws, you have the following rights:

• Right of Access: To request a copy of the personal data we hold about you

• Right to Rectification: To request correction of inaccurate personal data

• Right to Erasure: To request deletion of your personal data ("right to be forgotten")

• Right to Restriction: To request that we restrict processing of your data in certain circumstances

• Right to Data Portability: To receive your data in a structured, commonly used format

• Right to Object: To object to processing based on legitimate interests

• Right to Withdraw Consent: Where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing

Please note that because our survey is anonymous, we may not be able to identify or retrieve data attributed to a specific individual if no contact information was provided.

To exercise any of your rights, please contact us at: margaret.barrett@graysenrose.com.

You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC):

• Website: www.dataprotection.ie

• Phone: +353 57 868 4800

• Address: 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

11. Children's Privacy

Our Site and survey are directed at working professionals and are not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has submitted data to us, please contact us immediately and we will take steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the "Last updated" date at the top of this document. We encourage you to review this policy periodically.

Continued use of our Site after changes are posted constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact us at:

Green Culture Index
‍Email: margaret.barrett@graysenrose.com
Website: www.greencultureindex.com