Privacy Policy

This privacy policy explains how Terrea Services Limited (“Térrea”, “we”, “us”, or “our”) collects, uses, stores, and protects your personal data. It applies to people who use our carbon accounting platform and website at terrea.earth (the “Service”), people who communicate with us, and people we contact in their professional capacity about our services. If we contacted you at work without you having asked us to, see section 11, Business outreach.

Terrea Services Limited is a company registered in England and Wales (company number 16167772) with its registered office at 66 Paul Street, London, England, EC2A 4NA, United Kingdom.

We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Account information

When you create an account, we collect your name, email address, organisation name, and role. Authentication is handled by our identity provider, Clerk.

Carbon and emissions data

You may upload or connect data relating to your organisation's carbon emissions, including energy consumption, fleet vehicle usage, fuel purchases, and other environmental data necessary for emissions calculations.

Financial data

If you connect accounting integrations (such as Xero), we access transaction data including dates, descriptions, amounts, and vendor information to categorise expenses for carbon reporting purposes. We do not store payment card details — payments are processed securely by Stripe.

Usage data

We collect information about how you interact with the Service, including pages visited, features used, and actions taken. This data is collected via Vercel Analytics only when you have consented to analytics cookies.

Cookies and tracking data

We use cookies to manage consent preferences and, with your permission, to collect analytics data. See Section 9 for details on our cookie categories.

• Providing the carbon accounting service, including calculating greenhouse gas emissions using published emission factors
• Generating compliance reports (SECR, PPN 06/21, Carbon Reduction Plans)
• Categorising expenses to identify carbon-relevant activities
• Improving the accuracy and features of the Service
• Communicating with you about your account, the Service, and important updates
• Ensuring the security and integrity of the Service

We process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Service you have subscribed to
• Legitimate interests: Improving the Service, ensuring security, conducting analytics, and contacting businesses about our services (where this does not override your rights). See section 11 for how this applies to business outreach
• Consent: For analytics cookies, optional tracking tools, and marketing communications where the law requires consent (see section 11)
• Legal obligation: Where we are required by law to process or retain certain data

We share your data with the following third-party service providers, each acting as a data processor on our behalf:

• Clerk — Authentication and user management
• Convex — Database and backend infrastructure
• Vercel — Hosting and analytics (consent-gated)
• Stripe — Payment processing
• Xero — Accounting data integration (user-initiated connection only)

The providers we use for business outreach, and their roles, are set out in section 11.

We do not sell your personal data. We may share anonymised, aggregated data for research or benchmarking purposes where individual organisations cannot be identified.

Some of our service providers are based in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place. Depending on the provider and the country, this means relying on UK adequacy regulations, or on a transfer mechanism issued by the Information Commissioner's Office (ICO), being the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. The ICO issues these mechanisms; it does not approve individual providers. This section also covers the providers we use for business outreach. You can ask us for a copy of the safeguards that apply to a transfer.

We retain your personal data for as long as your account is active and as necessary to provide the Service. Upon account closure or deletion request, we will delete your personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as maintaining financial records).

Carbon emissions data and reports may be retained in anonymised form for benchmarking purposes after account deletion.

Records about business contacts we have approached are retained as described in section 11.

Under the UK GDPR, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data
• Restriction: Request that we limit how we process your data
• Portability: Request your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time via the consent preferences on our website

Objecting to direct marketing: where we use your personal data to market our services to you, your right to object is absolute. If you tell us to stop, we will stop, and we do not weigh your objection against our own interests.

To exercise any of these rights, please contact us at contact@terrea.earth. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use a consent management tool (c15t) to let you control which cookies and similar technologies are used on this website and in the application. Nothing optional is set until you make a choice. The table below lists what we measured on this website and in the application on 3 September 2026.

You can change or withdraw your choices at any time using the “Cookie preferences” link in the footer of this website, which reopens the preferences dialogue. Withdrawing consent stops the optional tools from that point; it does not remove data already collected, which you can ask us to delete under Section 8.

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security reviews and monitoring
• Secure development practices aligned with industry standards

We contact people in their professional capacity about carbon reporting. This section explains how we handle personal data for that outreach, including where we obtained your details when you did not give them to us directly.

Data we use

Your name, job title, employer, work email address, business telephone number where available, publicly available professional information such as a company website page or a public professional profile, information about where we obtained your details, and our outreach history with you, including message delivery, replies, and opt-outs.

We also keep the notes we use to judge whether our services are relevant to your organisation. These include the role we believe you hold in a carbon reporting decision, and any publicly reported event, such as a published tender requirement or reporting obligation, that prompted us to make contact.

We do not use open tracking or link tracking in our outreach email, so we do not record whether you opened a message or clicked a link.

We do not intentionally collect or use special category data (such as data about health, race, religion, political opinions, or trade union membership) for outreach.

Where we obtain your details

We obtain business contact details from Instantly, LinkedIn, company websites, and other publicly available professional sources. Company websites and public professional profiles such as LinkedIn are publicly accessible sources. Instantly is a third-party provider of business contact data rather than a public source. We record the source of a contact record where it is reasonably possible to do so, and we will tell you what we hold about the source if you ask.

Why we use it

• Identifying businesses that our services may be relevant to
• Contacting those businesses about carbon reporting services, by email, by LinkedIn message, or by telephone
• Responding to enquiries and replies
• Managing follow-ups
• Preventing unwanted contact, by keeping a record of objections and opt-outs
• Measuring delivery, replies, and opt-outs

Lawful basis

Our lawful basis under the UK GDPR is legitimate interests (Article 6(1)(f)). Our legitimate interests are offering relevant services to businesses that may need carbon reporting, and developing prospective customer relationships. For most of this processing we do not rely on your consent.

Our marketing messages are also governed by the Privacy and Electronic Communications Regulations (PECR), which work differently. PECR calls these messages “electronic mail”, and that term is broad: as well as email, it covers other messages that are stored electronically, including direct messages sent on LinkedIn. Everything in this paragraph therefore applies to our LinkedIn messages in the same way as to our email.

Most of the businesses we contact are corporate subscribers under PECR, such as companies and limited liability partnerships, and PECR does not require their consent for these messages. Sole traders and some partnerships are treated as individuals under PECR, so we send them marketing messages only where they have consented or where the soft opt-in conditions are met. If we cannot tell whether contact details belong to a corporate subscriber, we treat them as belonging to an individual. Where PECR requires your consent, that consent is also our lawful basis under the UK GDPR for sending you the message.

PECR treats marketing calls differently from marketing email. Before we make a marketing call, we screen the number against the Telephone Preference Service, the Corporate Telephone Preference Service, and our own do-not-call list. We do not call a number that fails those checks. On the call we identify ourselves and Térrea, and we display the number we are calling from.

Who we share it with

We use providers that support contact sourcing, email delivery, customer relationship management, hosting, security, and suppression. These include Instantly (contact sourcing and outreach email delivery), HubSpot (our customer relationship management system, which holds our record of business contacts and our outreach history with them), Google Workspace (our business email), and Microsoft Teams (the telephone service we call from). Depending on the service and how it is used, a provider may act as our processor or as a separate controller in its own right, so we do not describe them all as processors.

Processing outside the UK

Some of these providers may process personal data outside the UK. The safeguards we rely on are described in section 6.

How long we keep it

We review prospect records within 12 months of obtaining them or last using them, and we delete or anonymise records we no longer need.

If you object or opt out

If you object or opt out, we stop marketing to you. We keep only the minimum information needed to make sure we do not contact you again, such as your email address on a suppression list, and we do not use that information for any other purpose. We keep that suppression record for as long as we carry out direct marketing, because deleting it would let us contact you again by mistake.

Your rights

You have the right to access the personal data we hold about you, to have it corrected, to ask us to delete it (subject to the limited exceptions the law allows, such as the suppression record described above), and to ask us to restrict how we use it. You also have the right to object to our use of your data.

Your right to object to direct marketing is absolute. If you tell us to stop using your personal data for direct marketing, we will stop, and we do not weigh your objection against our own interests.

To exercise any of these rights, or to ask us to stop contacting you, email contact@terrea.earth. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Automated decisions

We filter and prioritise prospect lists to decide which businesses our services may be relevant to, and which person in an organisation is most likely to own carbon reporting. That judgement affects whether we contact you and what we say. A person reviews it before we make contact. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significant effects.

We may update this privacy policy from time to time. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, by email. The “last updated” date at the top of this page indicates when this policy was last revised.

If you have any questions about this privacy policy or how we handle your data, please contact us:

Terrea Services Limited
66 Paul Street, London, England, EC2A 4NA
Email: contact@terrea.earth
Company number: 16167772

Representative in the European Union

We have no establishment in the European Union, so under Article 27 of the GDPR we have appointed a representative there. People in the EU and EU supervisory authorities may contact our representative on any matter relating to our processing of personal data, instead of or as well as contacting us directly:

Culturia S.L.
Calle del Prado 7, 6D, 28014 Madrid, Spain
Attention: Germán Mori León
Email: gmori@culturia.es