Privacy Policy

Climeto Sustainable Services Private Limited acts as the Data Fiduciary in respect of personal data collected through the Platform. For all data-related queries, you may contact us at:

We collect personal data only to the extent necessary for the purposes described in this Policy. The categories of personal data we may collect include, but are not limited to:

Climeto collects and processes only such personal data as is necessary for the specific purpose for which it is collected. We do not process personal data for purposes incompatible with those stated in this Privacy Policy without your prior consent. Compliance data submitted through the Application Platform is used exclusively for the regulatory and advisory services subscribed by you and is not used for any unrelated commercial purpose.

Climeto does not sell, rent, or trade your personal data to any third party for commercial purposes. We may share personal data in the following limited circumstances:

• Service Providers: With authorised technology vendors, payment gateways, and infrastructure providers engaged in the delivery of our services, subject to strict confidentiality and data processing obligations.
• Regulatory Authorities: With CPCB, SPCB, and other competent government bodies as required for EPR portal submissions and regulatory compliance.
• Legal Obligations: Where disclosure is required under applicable law, court order, or direction of a competent authority.
• Fraud and Security: Where necessary to prevent fraud, protect the security of the Platform, or enforce our rights.

Any third party to whom personal data is disclosed is required to maintain its confidentiality and use it solely for the authorised purpose.

Climeto retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law, whichever is longer. The following general retention guidelines apply:

• Account data: Retained for the duration of your account and for a reasonable period thereafter to facilitate any service-related queries or legal obligations.
• Compliance and EPR data: Retained for the period required under applicable environmental regulations and thereafter for a minimum period consistent with statutory limitation periods.
• Communication data: Retained for a reasonable period to address any follow-up queries or disputes.

Upon the expiry of applicable retention periods, personal data is securely deleted or anonymised.

Subject to applicable law, you have the following rights in respect of your personal data held by Climeto:

• Right to Access: You may request a summary of personal data we hold about you and information on how it is being processed.
• Right to Correction: You may request that inaccurate or incomplete personal data be corrected or updated.
• Right to Erasure: You may request deletion of your personal data where processing is no longer necessary for the original purpose, subject to overriding legal obligations.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal will not affect the lawfulness of processing carried out before withdrawal.
• Right to Grievance Redressal: You have the right to have your grievances addressed by our Grievance Officer.
• Right to Nominate: You may nominate another individual to exercise your data rights in the event of your death or incapacity.

To exercise any of these rights, please contact us at support@climeto.com. We will respond within 2 working days, except where the volume or complexity of requests necessitates an extension, of which we will inform you.

Please note that certain rights may be subject to limitations where overriding legal obligations, public interest, or third-party rights are involved.

Climeto implements appropriate technical, administrative, and organisational measures to protect personal data from unauthorised access, disclosure, alteration, loss, or destruction. These measures include:

• Encryption of data in transit using TLS/HTTPS protocols
• Access controls restricting data access to authorised personnel on a need-to-know basis
• Regular security assessments and vulnerability testing
• Employee training on data handling and security obligations
• Secure storage of payment data exclusively through PCI-DSS compliant payment gateways

While we take reasonable and appropriate precautions, no system transmitting data over the internet can be guaranteed to be completely secure. In the event of a personal data breach likely to cause harm to Users, Climeto will take prompt remedial action and notify affected Users and relevant authorities in accordance with applicable law.

Climeto's primary data processing operations are conducted within India. In the event that any personal data is transferred outside India, for example through cloud infrastructure providers, such transfers will be made in accordance with applicable law and subject to appropriate contractual safeguards to ensure equivalent levels of data protection.

The Application Platform is not directed at individuals below the age of 18. Climeto does not knowingly collect personal data from minors. If we become aware that personal data of a minor has been collected without verifiable parental consent, we will take prompt steps to delete such data.

Climeto reserves the right to modify or update this Privacy Policy at any time to reflect changes in applicable law, technology, or our business practices. Material changes will be communicated to registered Users through email or in-Platform notifications prior to the effective date of such changes. The most current version of this Privacy Policy will always be available on the Platform. We encourage you to review this Policy periodically.