PRIVACY NOTICE

SCOPE OF THIS NOTICE

Who

This Platform Privacy Notice only applies to Lowr and sets out the way in which we handle your data; it does not apply to your Employer. If you have any questions regarding you Employer’s privacy policies or how they handle your date, either in connection to or outside of the Platform, you should contact the Administrator for your employer’s usage of this Platform. Any reference within this policy to us, we or our is a reference to The Green Shoot Inst. Ltd, a company registered in England and Wales under company registration number 12891189 with registered address

C/O Sustainable Ventures County Hall

3rd Floor

Westminster Bridge Road

London, England

SE1 7PB

who host and run the Lowr Platform (“the Platform”). Any reference to Member means a user of the Platform who has been granted access to the member area.

What

This Notice describes how we collect and process your personal information (which includes “personal data” or “personal information” as defined under applicable data protection laws) and the rights you have regarding such data.

Where

This Platform Privacy Notice applies to the data processing activities of Lowr solely with regard to the Lowr Platform. It also applies to those channels through which individuals communicate with us about the Platform and Services, such as Customer Service, whether in person, by telephone, by postal mail, email, or other means.

When

This Notice applies to the processing that Lowr performs when acting as a Data Processor on behalf of your Employer (the Data Controller). Our processing of your data is subject to the instructions we receive from your Employer and we have no independent rights to use your data. Our agreement with your Employer does allow us to anonymize certain platform usage information in order to analyse trends and perform benchmarking, however your personal information is removed or irreversibly anonymised before we perform that research. Please note: Links to third-party websites are provided solely for your convenience; when you go to those sites, your experience there is subject to the privacy notices and terms of use of those third-party sites, not ours, unless you are explicitly told otherwise.

INFORMATION COLLECTED RELATED TO PLATFORM AND SERVICES

Lowr recognises the importance of privacy and principles of data minimisation and privacy by design. As noted above, we collect and process your data as directed by your Employer. This means that ultimately your Employer controls the processing of your data. Data is provided to Lowr by your Employer and by you, our Members. For instance, your Employer may provide us with your name, position, business contact details, mobile phone number, and certain other relevant data about you, so that we can make the Platform available to you. You may then choose to provide additional data to us (e.g., your shipping address to redeem points for products on the Platform, or your mobile phone number to receive communications on your mobile device related to the Platform) and information about other Members (e.g., to recognize a colleague for something).

Sensitive Data

Plants + Perks does not intentionally collect sensitive data from Customers or Members. Your Employer may choose to use the Platform in ways that could, either intentionally or unintentionally, capture information that could be considered sensitive, such as race and ethnic origin, religious or philosophical beliefs, gender, gender identity, sexual orientation, trade union membership, or health-related data. If we receive any special category data, we shall consider that it has been provided to us from your employer with your consent, if you wish for any data we hold to be restricted by your employer then you should communicate this with the platform administrator. Plants + Perks shall have the right to delete any special category data from the Platform.

Automatically Collected Data

Lowr may automatically collect the following information about the use of the Services through cookies, web beacons, and other technologies: domain name; browser type and operating system; IP address; access time; device ID, name and model; location and language information, the length of time you are logged into the Platform; page views and referring URL; and your activities within the Platform. We may combine this information with other information that we have collected about you, including, where applicable, your username, name, and other data. Please see the section Purposes of Use and Processing below for more information.

Web Beacons

Lowr uses images embedded in e-mail messages called “web beacons.” Web beacons are clear images that allow Lowr to determine if a message has been opened. It also allows Lowr to determine the IP address of the user that opened it and to access any Lowr cookies. We may use this information in the aggregate to assess and improve our email messages. Email web beacons can be disabled by turning off HTML display and displaying text only or by turning off image display while still using HTML within your email client.

PURPOSES OF PROCESSING

Lowr will only collect, use, disclose, and otherwise process your data under the instructions of your Employer, as you instruct, or where otherwise permitted or required by law. Lowr does so on behalf of Customers, to provide the Services and as otherwise directed by you or your Employer under the terms of our commercial agreement (the “Customer Agreement”).

Subject to any requirements or restrictions in our Customer Agreements, we generally process user data as follows:

to create an account and profile to enable Members to access and use the Platform;
to provide users and Members with the information, products or Services they have requested from us;
to operate our Platform in accordance with the terms of our relevant Customer Agreement;
for security authentication and to verify that Members are authorised to use the Services;
to process, evaluate and complete transactions and as necessary to provide the Services and operate the Platform;
to operate, evaluate, maintain, and develop the Services (including by monitoring and analysing trends and usage statistics);
to respond to user and Member and Customer requests;
to provide Members with documentation or communications which Members have requested;
to correspond with Members to resolve their queries or complaints;
to send communications to Members as directed by Customer or other Members;
to manage, protect against and investigate fraud, risk exposure, claims and other liabilities, including but not limited to violation of our contract terms, laws or regulations, and to protect and prevent misuse of the Platform.

DISCLOSURE OF MEMBER DATA

We may disclose Member Data under the following circumstances:

Affiliated Entities

Plants + Perks may share Member Data with our affiliated businesses (“Affiliates”) who provide services to us or on our behalf, as part of our business operations and administration of the Services.

Where relevant, we have executed written agreements with such Affiliates that impose appropriate safeguards for the protection of Member Data in compliance with applicable privacy laws.

Agents and Service Providers

Lowr may share Member Data with selected third parties (“Service Providers”) who provide services to us or on our behalf, subject to our written instructions. For example, we may work with fulfilment partners spanning multiple international jurisdictions who are responsible for the delivery of product redemptions; in that case, the relevant Service Provider is provided with certain Member Data when Members would like to redeem a reward offered in the Platform, which may include Members’ physical mailing address, email and name.

Where relevant, Lowr has contractual agreements with Service Providers, which require them to provide protection as required by applicable data protection laws. Lowr does not transfer user or Member Data to a third party for the third party’s own use.

Your Employer

As a processor, Lowr will disclose Member Data to your Employer. Your Employer and its designated administrator(s) will be able to access all information you provide to the Platform, including information you post or send through it, and information regarding any transactions or redemptions you make on the Platform. For example, your Employer may need your Member Data for the purpose of calculating, deducting and/or paying income tax in respect taxable benefits in accordance with your Employer’s policies and applicable law. Where applicable, Member Data provided through Listen may be masked or otherwise concealed to promote your privacy interests, however, your Employer may unmask or re-associate Member Data with your identity. Plants + Perks has no control, and is not responsible for how your Employer may access, use and disclose Member Data. For more information on how your Employer may collect, use, disclose, or otherwise process your Member Data, please contact your Employer.

Member Content

Some areas of our Platform may allow you to upload or publish your own content to an area of the Platform that may be viewed by some or all other Members who have access to your Employer’s Platform, such as your colleagues (“Posting”). You may also make Postings external to the Platform (e.g., on social media). Such Postings may be associated with your name and any Member Data that you choose to include in such Posting. Lowr cannot control, and is not responsible for how any third parties, including your colleagues and/or your Employer, may use such information. If you choose to include Member Data in a Posting you post on the Platform, you consent to the disclosure of that Member Data. If you do not wish to publish your Member Data in this manner, please do not include it in a Posting you post to any area of the Platform that may be viewed by other users. Except mentioning the name of another Member or using the @-mention function to tag another Member in a Posting made to the Platform, You may not include the Member Data of any other individual in your Postings unless you have their consent.

Other Disclosures

Lowr may use or disclose your Member Data to comply with legal or regulatory requirements. If Lowr +The Green Shoot Inst. Ltd is involved in a merger, acquisition, or sale of all or a portion of its assets, or in the event of a bankruptcy or dissolution of our business, your personal information may be transferred to an acquiring business or third party, including in contemplation of or related to due diligence for such business transactions, subject to any applicable restrictions under applicable laws.

Lowr may use or disclose your Member Data if we believe in good faith that disclosure is necessary to respond to claims asserted against us; to protect our rights; to protect vital interests including your safety or the safety of others; or, to investigate or prevent fraud.

Lowr may also use, or disclose Member Data to third parties, if Lowr has reason to believe that using or disclosing such information is necessary to: (i) conduct investigations of possible breaches of law; (ii) identify, contact, or bring legal action against someone who may be violating an agreement they have with us; (iii) investigate security breaches or cooperate with government authorities pursuant to a legal matter; or (iv) to protect our rights, safety or property, and/or the rights, safety, and property of our Customers, Members of our Platform, and any other persons. Lastly, we may disclose Member Data for any other purpose for which you have provided your Employer with consent.

CHILDREN

Lowr’ Services are provided to Employers (our Customers) and their employees (the Members) and are not directed towards children. The Platform is not designed for or intended to be used by children, which we define as anyone under sixteen (16) years of age. We do not knowingly collect data from children and we request that children do not provide personal information through the Platform.

SECURITY

The security of your Member Data is important to us. We have implemented safeguards designed to protect the Member Data submitted to us, both during transmission and once it is received, including encrypting the transmission information (where appropriate). However, please note that no transmission over the Internet is 100% secure and you should not share confidential or personal information if you would not want such information to be circulated in the public domain.If you have any questions about the security of your Member Data, you can contact us at hello@lowr.co

DATA INTEGRITY

Plants + Perks will take steps to keep your Member Data accurate, complete and up-to-date. Members will have the ability to review much of the Member Data we have collected about them on the Platform. To make a request (e.g., access or correction of your Member Data), please see the “Your Rights” section below.

Retention

It is our policy to retain your information only for as long as is necessary to fulfill the purpose for which it was collected and processed, including our contractual obligations to your employer. Unless otherwise instructed by your employer, we will retain your information for as long as your account is active or as needed to provide you services and for as long as may be required to comply with our legal obligations, resolve disputes, maintain appropriate business records, and enforce our agreements. Even if you request for your information to be deleted, laws and regulations may require us to retain a copy of certain information in our files for a longer period of time. Unless a specific applicable law requires a different retention period, most data will be retained for no longer than seven (7) years.

YOUR RIGHTS

For EU Residents

The European Union’s General Data Protection Regulation (“GDPR”) gives you certain rights, including: a right to be notified of our data collection practices; the purposes and lawful bases under which we process your data; if our legitimate interests are a basis for processing, what those interests are; the categories of data processed; the categories of third parties with whom data is shared; the details of any data transfers outside of the EU and the safeguards in place; the applicable retention periods or policies; the right to access, correct, and delete (under certain circumstances) your personal information; the right to receive a copy of your information in a “portable” form so that you may transfer it to other services; the right to withdraw consent for processing; the right to lodge a complaint with a data protection authority; the right to be advised of the existence of any automated decision-making, including profiling, and the right to object such decisions; and, the right to withdraw consent without detriment. This Notice provides details regarding how we honour those rights in the context of our role as a Data Processor to your employer.

For California Consumers

California law gives you certain rights, including: a right to be notified of (and to request more information about) our data collection practices; the categories of data we process; the categories of third parties with whom data is shared; the right to request disclosure (up to twice per year) of the personal information we have about you or have had within the last 12 months: the right to delete that information (under certain circumstances); the right to know if your data is being sold; the right to know what personal information is being sold and to opt-out of such sales (if applicable); the right to receive a copy of your information in a “portable” form so that you may transfer it to other services; and, the right to not be discriminated against for exercising these rights. This Notice provides details on how we honour those rights in the context of our role as a service provider to your employer.

How to Exercise Your Rights

If you would like to exercise your rights under applicable privacy laws to access, amend, or request deletion of your Member Data, or make other requests regarding your Member Data, you should contact your Employer and we will work with your Employer, as needed, to assist them with information that they may need to respond to your requests Lowr will only refuse access to information about you where permitted or required by applicable privacy laws. If Lowr refuses access to you, it will provide you with the reasons for its refusal upon request. Exceptions may include information that contains references to other individuals, information that cannot be disclosed for legal, security or commercial proprietary reasons, and information that is subject to solicitor-client or litigation privilege. Lowr will respond to your requests for access in accordance with applicable privacy laws.

ENFORCEMENT AND DISPUTE RESOLUTION

Lowr will conduct periodic assessments to validate its continued adherence to this Platform Privacy Notice. If you have a question or dispute about our handling of your Member Data, please contact us at hello@lowr.co

Lowr will investigate and attempt to resolve complaints and disputes regarding the use and disclosure of Member Data in accordance with the principles contained in this Platform Privacy Notice. Lowr agrees to cooperate with data protection authorities located in the European Union or authorized representatives for disputes received from the European Union. Under certain conditions, more fully described on the Privacy Shield website at https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint, binding arbitration may be an option when other dispute resolution procedures have been exhausted.

INTERNATIONAL TRANSFERS

Subject to our Customer Agreements, the Member Data that we collect from you may be transferred to, processed, or stored at a location outside the local jurisdiction, including the US, Canada, the UK, and other locations. This means that we may be required to disclose your Member Data in response to lawful requests by public authorities, the courts, law enforcement, or national security authorities in that other jurisdiction.

We will take steps to ensure that your data receives an equivalent level of protection as required by laws of that jurisdiction, including by entering into data transfer agreements. For transfers from the EU, UK, or Switzerland to the US, Lowr relies on adequacy decisions by the EU Commission or putting in place Standard Contractual Clauses as approved by the European Commission (the form for the Standard Contractual Clauses can be found here: EU Commission Standard Contractual Clauses) or another applicable supervisory body.

CHANGES TO THIS PRIVACY NOTICE

This Notice is subject to change, so if this is your first time reading it, please make sure it is not the last. If we make any changes to this Notice, we will post those changes on this page and revise the “Last Updated” date at the top. If we make any changes to the ways in which we process your information that could be reasonably be considered material or substantial, we will make additional efforts to notify you of those changes, either by email or via a prominent notice on this Site prior to the change becoming effective. Where required by law, we will obtain your consent or give you the opportunity to opt out of such changes. Any changes will become effective when we post the revised Notice.

CONTACT US

If you have any queries on any aspect of our Privacy Policy, please contact us at hello@lowr.co