Privacy Policy — Impakter Index

The Impakter Index is a public-interest sustainability research and information platform owned and operated by Klimado GmbH.

The Index collects, analyses and publishes information concerning companies' environmental, social and governance (ESG) practices. Its assessments are intended to inform public understanding and support sustainability research.

The Impakter Index does not issue certifications or accreditations and does not provide investment advice or financial services.

This Privacy Policy explains how we process personal data when visitors use index.impakter.com, when we conduct sustainability research and when individuals contact us.

The data controller responsible for processing personal data through the Impakter Index is:

Depending on how the Index is used, we may process the following categories of personal data.

3.1 Website access and technical data

When visitors access the Index, our technical infrastructure may process information necessary to deliver and secure the website, including IP addresses, requested resources, access timestamps and technical connection information.

Such information may appear in application or infrastructure logs.

3.2 Analytics data

With the visitor's consent, we use PostHog EU Cloud to collect anonymous pageview analytics.

Our current configuration:

• Records pageviews only.
• Does not use PostHog cookies.
• Does not create visitor person profiles.
• Has session recording disabled.
• Has automatic event capture disabled.
• Has IP and geolocation lookup disabled.

PostHog analytics are not activated before the visitor chooses to allow analytics.

3.3 Public company research information

The Index researches publicly available information about companies, including sustainability policies, ESG disclosures, certifications, commitments and reported outcomes.

Public sources may contain information about identifiable individuals, such as company representatives, employees or professional contacts.

We may process such information where relevant to legitimate sustainability research and publication purposes.

3.4 Communications and correction requests

When individuals contact us or submit a correction request, we may process their name, email address, organisation, message and supporting documents or links.

This information is used to review the request, respond and maintain appropriate records of the decision.

We process personal data for the following purposes:

Website operation and security

To deliver the website, maintain technical functionality, prevent misuse and investigate security incidents.

Legal basis: Article 6(1)(f) GDPR — legitimate interests in operating and protecting the website.

Sustainability research and publication

To collect, verify, analyse and publish information relevant to corporate sustainability practices.

Legal basis: Article 6(1)(f) GDPR — legitimate interests in sustainability research and public information, subject to applicable balancing requirements and legal protections.

Optional website analytics

To understand how the website is used and improve its functionality.

Legal basis: Article 6(1)(a) GDPR — consent.

Enquiries and correction requests

To respond to communications, investigate factual disputes and maintain accurate published information.

Legal basis: Article 6(1)(f) GDPR, or Article 6(1)(c) GDPR where processing is necessary to comply with a legal obligation.

Where applicable, additional protections concerning freedom of expression and journalistic purposes may apply under relevant law.

The public Index does not require visitor registration or login.

It uses the following browser-storage technologies.

Analytics consent preference

This local-storage item remembers whether a visitor has accepted or declined analytics.

It remains in the browser until cleared or changed.

Optional PostHog analytics

These local-storage items support anonymous pageview analytics.

They are used only after the visitor gives consent and remain until consent is withdrawn or the relevant browser storage is cleared.

Appearance preference

This local-storage item remembers the visitor's light- or dark-mode preference.

It remains until cleared.

The applicable consent classification of this preference storage is under review.

Managing consent

Analytics are optional and disabled by default.

Visitors can decline analytics without losing access to the public Index.

Consent can be changed or withdrawn at any time through Analytics Settings, accessible from the website footer.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The Impakter Index uses automated tools to assist with retrieving and analysing publicly available company information.

The research workflow may involve the following services.

Jina

Jina retrieves publicly available webpage content. It receives webpage addresses and returns extracted page text.

Mistral

Mistral assists with extracting structured sustainability information from webpage text.

Information submitted may include company names, countries, website addresses, source URLs and extracted webpage content.

Outputs may include ESG-related observations, company descriptions, certification information and supporting quotations.

Jev (typesafe.ai)

Where enabled, Jev assists with checking whether a retrieved webpage relates to the correct company.

It may receive company identifiers, webpage content and relevant extracted research information.

Public webpage content may contain personal data.

Automated research supports the Index's information-gathering process. Findings enter a research or administrative review process before acceptance into the publication workflow.

AI-assisted findings may contain inaccuracies or omissions and may be corrected when new evidence becomes available.

The Impakter Index uses Hetzner infrastructure within the European Union, including application and database services in Finland.

The PostgreSQL database and encrypted backups are hosted in Helsinki.

Uploaded files and company logos are stored using Amazon Web Services S3 in Stockholm, Sweden.

The infrastructure uses encrypted connections, restricted access, private database connectivity and encrypted database storage and backups.

These measures are designed to protect data against unauthorised access, alteration and loss.

No internet-based service can guarantee absolute security.

The Index uses external service providers for hosting, storage, analytics and research.

These include:

• Hetzner: Hosting, database and backup infrastructure.
• Amazon Web Services: File and logo storage.
• PostHog EU Cloud: Consent-based website analytics.
• Jina: Public webpage retrieval.
• Mistral: AI-assisted sustainability information extraction.
• Jev (typesafe.ai): Company-source verification where enabled.

Service providers may process personal data only to the extent relevant to the services they provide and their applicable contractual and legal roles.

The processing locations, retention practices and contractual arrangements of certain research providers remain under verification.

The Index's principal hosting and file-storage infrastructure is located within the European Union.

Some external research services may involve processing or access outside the European Economic Area.

Where personal data is transferred internationally, the applicable requirements of Chapter V GDPR must be satisfied, including appropriate transfer mechanisms where required.

The precise processing locations and transfer arrangements of certain research providers are being verified.

We retain personal data for purposes connected with website operation, security, sustainability research, publication and the handling of enquiries or corrections.

Retention depends on the category of information and the purpose for which it is processed.

Company research records

Research records and supporting sources may be retained while relevant to published company profiles, methodological review, corrections and research integrity.

Some historical research records are currently retained without an automated deletion deadline.

Company profiles

Published company information is retained while the relevant profile remains available on the Index.

When a profile is removed, the associated company record can be permanently deleted from the active system.

Enquiries and correction requests

Communications and supporting evidence may be retained as necessary to investigate requests, document decisions and address potential legal claims.

Application logs

Technical logs may be retained for operational and security purposes. A fixed maximum retention period is not currently configured.

Database backups

Encrypted database backups are retained according to the active backup configuration. The precise expiry period is being verified.

Analytics information

PostHog event retention is determined by the project's provider configuration. The exact period is being verified.

Retention controls are being reviewed and improved. Individuals may exercise applicable data-protection rights at any time.

Company logos may be displayed to identify the companies discussed in the Index.

Logos are uploaded by Klimado personnel or by the relevant company and stored in the Index's file-storage infrastructure.

The Index does not automatically scrape company logos from websites or obtain them from external logo services.

The appearance of a company name or logo does not imply endorsement, sponsorship, partnership or affiliation.

Where a logo is unavailable or removed, the Index may display the company's initials instead.

Rights holders may submit substantiated correction or removal requests to:

The Index aims to maintain accurate and transparent company research.

Companies and other interested parties may report factual inaccuracies, incorrect attribution, disputed certifications or other relevant concerns.

Requests are assessed using available evidence and the applicable research methodology.

For company research corrections:

Personal-data requests should be directed to:

Under the GDPR, individuals may have the following rights, subject to applicable conditions and exceptions:

• Access to personal data.
• Rectification of inaccurate personal data.
• Erasure of personal data.
• Restriction of processing.
• Objection to processing based on legitimate interests.
• Data portability where applicable.
• Withdrawal of consent at any time.

We may request reasonable information to verify the identity of the requester.

We will assess and respond to requests within applicable legal deadlines.

The Index uses automated systems to assist with company-level sustainability research.

The Index does not currently provide public user accounts, investment portfolios or financial trading services.

Its automated company assessments are not intended to constitute solely automated decisions concerning identifiable natural persons that produce legal or similarly significant effects within the meaning of Article 22 GDPR.

The Index may link to company websites, public registers, research sources and other external resources.

These websites operate independently and may have their own privacy practices.

Individuals have the right to lodge a complaint with a competent data-protection supervisory authority.

The supervisory authority for Klimado GmbH's establishment in Hesse is generally:

We may update this Privacy Policy to reflect changes in our research practices, technologies, service providers or legal obligations.

The latest version will be published on this page with its revision date.