Privacy Policy: ClimAdapt Carbon Footprint Tool

Effective date: 1st October 2026

This policy explains how ARCA Sustainability Pty Ltd, trading as ClimAdapt (ABN 70 684 953 571), collects, uses, stores and shares information in the ClimAdapt Carbon Footprint Tool. ClimAdapt handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. ClimAdapt also follows the principles of the National Farmers' Federation Australian Farm Data Code: transparency, fairness, control, portability, security and compliance.

1. What information ClimAdapt collects

Account information. To create an account, ClimAdapt collects your name, business name, address, email address and phone number. ClimAdapt also records your sign-in details and the date you accepted this policy.

Business and carbon footprint data. To calculate your carbon footprint, the tool collects:

• site details, including vineyards, wineries, cellar door and offices
• vineyard area and production volumes, such as tonnes crushed, litres produced and bottles sold
• activity data, such as fuel, electricity, refrigerants, fertilisers, sprays, water, wastewater, packaging, freight, waste, and purchased grapes and wine
• documents you upload, such as invoices, utility bills and delivery dockets.

ClimAdapt doesn't need bank account or payment card numbers. Remove them from documents before you upload.

Information about other people. Your records may include the names of growers, suppliers or contractors you deal with. Some of them may be sole traders, which makes their names personal information. Enter only what the calculation needs. Let those people know you share their details with ClimAdapt.

2. How ClimAdapt collects information

ClimAdapt collects information directly from you when you create an account, enter data, upload documents or contact ClimAdapt. ClimAdapt doesn't buy data about you from other sources.

3. Why ClimAdapt collects and uses information

ClimAdapt uses your information to:

• create and manage your account
• calculate your business's carbon footprint and produce your reports
• check your data for errors and gaps
• respond to your questions and support requests
• send you service messages, such as account notices and changes to this policy.

Industry benchmarks. ClimAdapt de-identifies your data and combines it with data from other businesses to build industry benchmarks. A benchmark only appears when it includes at least 10 businesses, so no single business can be identified. ClimAdapt doesn't attempt to re-identify de-identified data.

Marketing. ClimAdapt sends product updates only if you agree to receive them. Every marketing email includes an unsubscribe link.

4. What happens if you don't provide information

ClimAdapt can't create your account without your name and email address. If you leave out activity data, your carbon footprint will be incomplete, and your reports will show the gaps.

5. Who ClimAdapt shares information with

ClimAdapt doesn't sell your data. ClimAdapt doesn't share it with marketing or advertising companies.

ClimAdapt shares your data only in these cases:

• With people you approve. You decide which team members can view or edit your records, and you can remove their access at any time.
• With verifiers and industry bodies, at your request. ClimAdapt shares your results with a verifier or industry body only when you ask, and asks you to confirm before each share.
• When Australian law requires it. If a court order or law requires ClimAdapt to disclose your data, ClimAdapt tells you before disclosing, where the law allows.

Authorised ClimAdapt staff access your data to run the tool and resolve support requests. All staff who handle your data receive training in this policy and the Australian Farm Data Code.

6. Where information is stored

ClimAdapt stores your data in Australia with Supabase, a hosting provider. While primary hosting is in Australia, ClimAdapt and its service providers may access, process, or support personal information from outside Australia (such as for support, maintenance, or service delivery) where applicable.

7. How ClimAdapt protects information

• Encryption. Transport Layer Security (TLS) protects data in transit. Advanced Encryption Standard (AES-256) encryption protects stored records and backups.
• Independent audits. Supabase's security controls undergo independent System and Organization Controls (SOC 2 Type 2) audits.
• Account separation. Access rules applied inside the database limit each account to its own business's records. Uploaded documents sit in private storage with the same rules.
• Backups. Regular backups let ClimAdapt restore data if it's lost or damaged.

8. How long ClimAdapt keeps information

ClimAdapt keeps your data until you delete it or close your account. If your account has no sign-in for 18 months, ClimAdapt deletes your data. Before deleting, ClimAdapt emails you so you can sign in or download your data. De-identified benchmark data may be kept after your account closes.

9. Your rights: access, copies, correction and deletion

• Access and correction. You can view and correct your data in your account at any time.
• Copies. You can download your data as a spreadsheet and your reports as PDFs at any time, including when you stop using the tool.
• Deletion. You can delete your data in your account, or ask ClimAdapt to delete your account by emailing jdiaz@climadapt.com.au. Deleted data can't be recovered.

ClimAdapt responds to access and correction requests within 30 days. There's no charge.

10. Data breaches

ClimAdapt takes reasonable steps to contain and evaluate any suspected data security incidents. If ClimAdapt suspects or has reasonable grounds to believe an eligible data breach has occurred under the Privacy Act 1988 (Cth) and Notifiable Data Breaches scheme, ClimAdapt will promptly assess the incident. Where required by law, ClimAdapt will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, explaining the nature of the breach and recommending steps affected individuals should take.

11. Changes to this policy, ownership or service

ClimAdapt emails you at least 30 days before any material change to this policy. ClimAdapt also asks you to accept the updated policy when you next sign in. If you don't agree, you can download and delete your data, and close your account at no cost.

ClimAdapt gives you the same notice before a change of ownership, a move of data outside Australia, or the end of the service. You'll have time to download or delete your data first.

12. Questions and complaints

Contact ClimAdapt about privacy at jdiaz@climadapt.com.au.

ClimAdapt acknowledges complaints within 5 business days and aims to resolve them within 30 days.

ARCA Sustainability Pty Ltd, trading as ClimAdapt

ABN 70 684 953 571