Applicability of this Privacy Policy

This Privacy Policy applies to Unwritten's climate and nature risk intelligence platform, including any associated applications (collectively, the "Services"), unwritten.co and any other Unwritten websites (collectively, the "Websites"), and other interactions you may have with Unwritten (e.g. customer support enquiries, events, etc.). If you do not agree with this Privacy Policy, do not access or use the Services, Websites, or any other aspect of Unwritten's business. For the avoidance of doubt, this is the only privacy policy that applies to Unwritten.

A separate agreement governs delivery, access and use of the Services (the "Customer Agreement"), including the processing of portfolio company, asset, climate and nature datasets submitted through Services accounts (collectively, "Customer Data"). The organisation that entered into the Customer Agreement (the "Customer" — typically your employer) controls its instance of the Services (its "Workspace") and any associated Customer Data. If you have questions about a specific Workspace's settings or privacy practices, please contact the Customer whose Workspace you use, rather than Unwritten directly, as we act as a processor of that data on the Customer's behalf and follow the Customer's instructions.

This Privacy Policy governs "Other Information" — Personal Data that Unwritten collects and controls directly, such as data about visitors to our Websites and about individuals ("Authorised Users") who register for or use the Services. Unwritten is the controller of Other Information.

Information we collect and receive

Unwritten collects and receives information through operating the Services and Websites, and through other interactions with Unwritten. This includes Customer Data (described above) and the following categories of Other Information:

• Account information.To create or update an account, You or Your employer (as our Customer) supply Us with a name, business email address, job title, employer/organisation name and password.
• Usage information.

  • Log data. As with most websites and technology services, our servers automatically collect information when You access or use the Websites or Services, including Your IP address, browser type and version, the pages You visit, the time and date of Your visit, time spent on those pages, and referring pages.
  • Device information. We collect information about devices accessing the Services, including device type, operating system, unique device identifiers and diagnostic data, particularly where the Service is accessed via a mobile device.
• Cookie information. Unwritten uses cookies and similar technologies on the Websites and Services.

  • Necessary/Essential cookies —required to authenticate users and enable core features.
  • Advertising cookies —use third-party advertising and retargeting cookies and pixels on the Websites (such as Google Ads, HubSpot, etc.). These are typically persistent, third-party cookies administered by our advertising partners, used to understand which pages You have visited and to show You relevant Unwritten advertising on other websites and platforms. Unlike the analytics cookies described above, advertising and retargeting cookies are not treated as "low-risk" under the UK's amended Privacy and Electronic Communications Regulations (PECR), and so continue to require Your prior opt-in consent via our cookie banner before they are set — the DUAA's relaxed consent rules do not extend to this category. You can withdraw consent at any time via Your browser settings. Where required by applicable US state law, use of these cookies may constitute a "sale" or "sharing" of personal information for cross-context behavioural advertising; see "US privacy rights" below for how to opt out, including via Global Privacy Control signals.
  • Analytics cookies —help us understand usage of the Service. Following the UK's amended Privacy and Electronic Communications Regulations (PECR) under the Data (Use and Access) Act 2025 ("DUAA"), certain low-risk cookies such as first-party analytics cookies may lawfully be used without prior consent, provided users are given a clear and effective way to opt out. Still, We continue to allow users to opt-out of non-essential cookies.
• Additional information provided to Unwritten.We also receive information You submit directly, such as messages sent through contact, demo-request or newsletter sign-up forms, support tickets, feedback, or communications at events.

We do not intentionally collect Special Category Data (e.g. data revealing health, religion, or biometric information) and ask that You do not submit it to Us unless specifically requested.

How we process your information and our legal bases for doing so

Customer Data is used by Unwritten in accordance with a Customer's instructions, the Customer Agreement, and as required by applicable law. Unwritten is a processor of Customer Data; the Customer is the controller.

Unwritten uses Other Information for the following purposes and legal bases under the UK GDPR and, where relevant, the EU GDPR:

Performance of a contract:

We process Account information and Usage information to provide, operate and maintain the Service, and to perform Our contract with You or Your employer.

Compliance with a legal obligation:

We process Other Information where necessary to comply with a legal obligation, including responding to valid requests from regulators or law enforcement.

Legitimate interests:

We rely on Our legitimate interests, or those of a third party, where they are not outweighed by Your interests or fundamental rights ("legitimate interests"). We use Account information, Usage information, Cookie information and additional information provided to Unwritten for the following legitimate interests:

• To provide, update, maintain and protect the Service, Websites and Our business, including preventing or addressing errors, security or technical issues, and analysing usage and trends.
• To develop and improve the Service, including its analytics.
• To investigate and help prevent security issues and abuse.
• To respond to enquiries, comments and support requests.
• For billing, account management and other administrative matters.
• To send service, technical and administrative communications, such as security notices — these are part of the Service and cannot be opted out of.
• To evaluate or conduct business transfers, such as a merger, divestiture, restructuring, or sale of assets, where Other Information is among the assets involved.
• To transfer, store or process information outside the UK or EEA, as necessary to provide, update, maintain and protect the Service — see "International data transfers" below.

In narrow, specified circumstances (such as safeguarding or crime prevention), We may also rely on the "recognised legitimate interests" basis introduced by the DUAA, which does not require a balancing test.

Consent:

We rely on Your consent to send marketing emails and other promotional communications about new features, product updates or events. You may withdraw consent and opt out of these at any time.

How we share and disclose information

This section describes how Unwritten may share and disclose Other Information. Customers determine their own policies for sharing Customer Data with third parties; Unwritten does not control how a Customer chooses to share or disclose it.

• The Customer's instructions.We may share Other Information in accordance with a Customer's instructions, the Customer Agreement, and applicable law.
• Service Providers.We may engage third-party companies to host, secure, analyse or otherwise support the Service and Our business.
• Professional advisers.We may share Other Information with lawyers, auditors, bankers and insurers who provide consultancy, legal, insurance or accounting services.
• Corporate affiliates.We may share Other Information with Our affiliates, who will be required to honour this Privacy Policy.
• Business partners.We may share Other Information with business partners to offer You certain products, services or promotions.
• During a change to Unwritten's business.If Unwritten engages in a merger, acquisition, financing, reorganisation, or sale of some or all of its assets, Other Information may be shared or transferred, subject to standard confidentiality arrangements. We will provide notice before Your Personal Data becomes subject to a different privacy policy.
• Aggregated or de-identified data.We may disclose or use aggregated or de-identified information for any purpose, such as to improve the Service.
• Law enforcement and regulators.We may disclose Other Information if we reasonably believe disclosure is required by applicable law, regulation, or legal process (e.g. a court order).
• To enforce our rights, prevent fraud and for safety.To protect the rights, property or safety of Unwritten, its users, or third parties, including to investigate suspected wrongdoing connected with the Service.
• With consent.We may share Other Information with third parties when We have Your consent to do so.

We do not sell Other Information for monetary consideration.

Data retention

Unwritten retains Other Information for as long as necessary for the purposes described in this Privacy Policy, including to provide the Service, provide customer support, comply with legal obligations, resolve disputes, and enforce Our agreements.

Security

The security of Personal Data is important to Us. We use technical and organisational measures designed to protect Other Information from loss, misuse and unauthorised access or disclosure, taking into account the sensitivity of the information and the current state of technology. Given the nature of internet-based communication, We cannot guarantee that information will be absolutely secure from intrusion by others.

Age limitations

The Service is intended for business professionals and is not directed at, nor knowingly used to collect Personal Data from, anyone younger than 18. If We learn We have inadvertently collected such data, We will delete it.

Changes to this Privacy Policy

Unwritten may change this Privacy Policy from time to time to reflect evolving laws, regulations, industry standards, or changes to Our Services or business. We will post changes to this page and update the "Effective" date above. If We make changes that materially alter Your privacy rights, We will provide additional notice, such as via email.

International data transfers

Your Personal Data may be transferred to countries other than the one in which You live, including the United States, where Our Service Providers are located.

• UK transfers.Where We transfer Personal Data outside the UK, We rely on an adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Since the DUAA came into force, such transfers are assessed against the UK's revised "data protection test" — whether protection in the destination country is not materially lower than under the UK GDPR — replacing the previous "essentially equivalent" standard.
• EEA transfers.Where We transfer Personal Data outside the EEA, We rely on adequacy decisions or the EU Standard Contractual Clauses, and, where the receiving party is certified, the EU-U.S. Data Privacy Framework. That Framework's validity is currently the subject of a pending appeal before the Court of Justice of the EU (Case C-703/25 P); We monitor developments and will update Our transfer mechanisms as needed.

Your rights

If You are in the UK. Under the UK GDPR, You have the right to access, correct, or delete Your Personal Data; restrict or object to processing; request data portability; and not be subject to decisions based solely on automated processing that significantly affect You — except in specified circumstances now permitted under Articles 22A–22D of the UK GDPR (introduced by the DUAA), subject to safeguards including a right to human review. Where We rely on legitimate interests to process Your Personal Data, You can object by contacting Us as described in "Contacting Unwritten" below.

You also have a statutory right, effective from 19 June 2026, to complain directly to Us about how We handle Your Personal Data (see "Contacting Unwritten").

If You are in the EEA or elsewhere. You have equivalent rights under the EU GDPR or other applicable law requiring a legal basis for processing, and may object to processing based on Our legitimate interests, or to direct marketing, at any time.

US privacy rights

This section provides additional detail for residents of California and other US states with comprehensive consumer privacy laws.

In addition to the information described above under "Information we collect and receive", We may collect the following categories of personal information for Our business purposes: identifiers/contact information; commercial information; internet or electronic network activity information; professional or employment-related information; and inferences drawn from the above.

Subject to certain conditions, You may have the right to request to know what personal information We hold, to delete or correct it, to opt out of any "sale" or "sharing," to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. Note that CCPA/CPRA's earlier exemptions for business-to-business and employment-related personal information expired on 1 January 2023, so professional contact details of a Customer's staff are within scope of these laws.

To make a request, contact Us at the details in "Contacting Unwritten" below. We will verify Your request using information associated with Your account and respond within the timeframe required by applicable law. You may also designate an authorised agent to act on Your behalf.

Data Protection Authority

Subject to applicable law, You have the right to lodge a complaint with your local data protection authority if You believe We have not adequately addressed your concern. If You are located in the European Economic Area, You may find your appropriate authority via the European Data Protection Board. If You are a resident of the United Kingdom, You may contact the UK regulator, the Information Commissioner's Office (ICO) — currently being restructured into the "Information Commission" under the DUAA.

Contacting Unwritten

Please contact Unwritten if You have any questions about this Privacy Policy or Our practices, or if You are seeking to exercise any of Your statutory rights. We will respond within a reasonable timeframe.

You can contact Us at support@unwritten.co