Privacy Policy

About this policy

This policy explains how IN DEPTH uses personal information: what we collect, why we collect it, who we share it with, how long we keep it and the rights you have. We have tried to write it in plain words. If anything is unclear, write to us at apply@in-depth.io and we will explain.

It applies to our public website at in-depth.io, to the application process and to the IN DEPTH platform at app.in-depth.io and client addresses under in-depth.io. It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). For people in the European Union and European Economic Area, it is also written to meet the EU General Data Protection Regulation (EU GDPR).

Who we are

IN DEPTH INTELLIGENCE LTD is a private company limited by shares, registered in England and Wales with company number 17342348. Our registered office is 38 Church Road, Abbots Leigh, Bristol BS8 3QP, United Kingdom. In this policy "IN DEPTH", "we", "us" and "our" mean that company.

IN DEPTH is an operating system for the climate solutions network. It is a software platform with three streams: BREACH (research on organisations and people, funders and partners), SPLASH (media and campaign intelligence) and UNDERCURRENT (impact decisions and reporting). Admission is by application only.

For most of the personal information described here we are the controller, which means we decide how and why it is used. For content that our clients put into or generate on the platform, the client is the controller and we act on its behalf as processor. We explain this below.

We have not appointed a Data Protection Officer, as the law does not require one for an organisation of our size. For any privacy question, email apply@in-depth.io with "Privacy" in the subject line, or write to us at our registered office.

Who this policy covers

• Website visitors: anyone who visits in-depth.io.
• Applicants: people who apply for access on behalf of themselves or an organisation.
• Clients and platform users: people at accepted organisations who hold an account on the platform.
• Billing contacts: people who receive and pay our invoices.
• People who appear in research: people publicly connected with organisations that we or our clients research, such as a funder's trustees or a journalist whose work is published.

What we collect and where it comes from

Information you give us

• Your application: your organisation and its website, your name, role and email address, the language you would like us to use, the lane you are applying in, your answers to our seven questions and your view of where your organisation fits. We need these to consider an application; without them we cannot assess it or reply to you. The form does not create an account.
• Your platform account: your name, work email, role and organisation.
• Billing: the name and contact details of billing contacts and the details on our invoices.
• Support: the content of any conversation you have with us when you need help.

Information collected when you use our website or platform

• Website analytics: page views, when you leave a page, clicks on the page, browser and device type, the page that referred you. On the public website this runs without cookies and without browser storage. To follow a single visit from page to page, the analytics service works out a one-way code on its server from your IP address and browser details and a secret that changes every day, so we cannot recognise you from one day to the next. We do not build a profile of you, we do not work out your location and we do not record sessions.
• Platform analytics: how signed-in users use the product and any errors they meet. On the platform we identify signed-in users by their user id, with their email address attached.
• Sign-in and security logs: records of sign-ins and other security events on the platform.

Information we get from other sources

Some personal information does not come from you directly. This is what we collect and where it comes from:

• Research on applicants: when an organisation applies, we research it against the public record using our own platform. The sources are the organisation's website, public filings, news reports and public professional profiles. This can include information about the people publicly connected with the organisation, such as their names, roles and published work. Our application form tells applicants that this research takes place.
• Research for our own purposes: we may research organisations we would like to work with, using the same kinds of public sources.
• Research for clients: our clients use the platform to research organisations and the people publicly connected with them. This uses only publicly available sources, such as websites, public filings, news and published work. Web search providers help us retrieve those public pages. Every claim in a report carries its source.
• Your organisation: if your organisation is a client, it may give us your name, work email and role to set up your account or to name you as a billing contact.

We do not seek to collect special categories of personal information, such as information about health, religion or political opinions, and our research is not aimed at it.

How we use it and our lawful bases

Data protection law requires a lawful basis for each use of personal information. Where we rely on legitimate interests, we have weighed our interests against your rights and expectations, and you can object at any time (see Your rights).

We will only use your information for a new purpose if it is compatible with the one we collected it for, or if we have another lawful basis and have told you.

Admission decisions

We aim to decide on every application within five working days. The decision is made by our founder, with counsel from our Head of Operations and our Head of Partnerships. We use our platform to research applicants, but a person makes every admission decision. We do not make any decision about you based solely on automated processing that has legal or similarly significant effects.

Client content: controller and processor

Accepted organisations sign an access agreement, the Evaluation Access Agreement, before we issue any credentials. For the content a client puts into or generates on the platform, including research it asks us to run, the client organisation is the controller and IN DEPTH is its processor. We act only on the client's instructions and under that agreement. If you are a client, please see your agreement for the full terms.

We are the controller for platform users' account details, sign-in and security logs, billing contacts and invoices, support conversations and product analytics on the platform.

For client content, we make these commitments:

• Client data is never used to train an AI model.
• Client data is never shared with another organisation, and never shared at all without the client's explicit opt-in.
• We do not access, review or use anything in a client's system beyond operating it for them.
• A client can take a complete export of everything it has built, at any time, from its settings (owner role).
• A client can mark a person or organisation as "never contact", and the platform will then refuse to research them or draft anything to them.

If you appear in research

If you are publicly connected with an organisation, your name, role and published work may appear in research that we run for ourselves or that a client runs on our platform. We use only publicly available sources and every claim is linked to its source. When a client runs the research, the client is the controller. When we research applicants or organisations we would like to work with, we are the controller and rely on legitimate interests.

Because this research uses public sources and can involve many people, it is often impossible, or would take disproportionate effort, to contact each person individually. We publish this policy so that the information is available to everyone.

If you want to know whether you appear in research, or you want to object to it, write to apply@in-depth.io with "Privacy" in the subject line. We will deal with your request ourselves, or pass it to the client concerned and tell you we have done so.

Who we share it with

We never sell personal information. We share it only with service providers who help us run IN DEPTH (our sub-processors), who may use it only on our instructions and must keep it secure. They fall into these categories:

• cloud hosting and database
• AI model providers, which process the content needed to produce each output (the platform routes work across models from more than one provider and records which model produced each output)
• web search providers, which retrieve public pages for research
• transactional email, which delivers application messages and other emails
• product analytics
• payments, for invoices paid by card or bank transfer
• background job processing

A current list of our named sub-processors is available on request from apply@in-depth.io. Clients also receive it with their agreement.

Applications are read by our founder and our technical lead. We may also share information with our professional advisers and with authorities where the law requires it. If our business is ever sold or reorganised, information may pass to the buyer or successor, and this policy would continue to apply to it.

International transfers

Our public website is served by a cloud hosting provider from a global network, so some processing may take place outside the UK and the EEA. Our application emails are sent through a provider that sends from the EU (Ireland), and our analytics service is hosted in the EU (Frankfurt). Some of our other sub-processors may process information outside the UK and the EEA.

When personal information leaves the UK or the EEA, we make sure it is protected. We rely on adequacy regulations or decisions, which confirm that a country protects personal information to the required standard, or on standard contractual clauses approved for this purpose, together with the UK International Data Transfer Addendum where UK law applies. You can ask us for more information about the safeguards we use.

Where client data is stored

Every client organisation is pinned to a home region, chosen at admission, and its platform data is stored and processed there. The regions are:

• European Union (Frankfurt), which also serves the UK
• United States (East)
• United States (West)
• Asia Pacific (Singapore)

Our own records, including applications and billing, sit in the European region. Some sub-processors, such as AI model providers, may process the content needed for an output in another location, under the safeguards described above.

How long we keep it

We keep personal information only as long as we need it for the purposes above. After that we delete it or anonymise it so it no longer identifies anyone.

We may keep information for longer where we need it to deal with a legal claim or where the law requires it.

How we keep it safe

We use technical and organisational measures to protect personal information. Separation between client organisations is enforced at the database layer: a signed-in user's queries can only return their own organisation's records. Access to the platform and to our systems is controlled, and data is encrypted in transit. No system is perfectly secure, but we work to protect your information and will act promptly if something goes wrong, including telling you and the regulator where the law requires.

Your rights

You have these rights over your personal information:

• Access: to ask for a copy of the information we hold about you.
• Rectification: to ask us to correct information that is wrong or incomplete.
• Erasure: to ask us to delete your information in certain circumstances.
• Restriction: to ask us to limit how we use your information, for example while we check its accuracy.
• Portability: to receive information you gave us in a structured, commonly used format, or have it sent to another organisation, where we use it under contract or consent and by automated means.
• Objection: to object to our use of your information where we rely on legitimate interests. We will stop unless we have compelling grounds that override your interests or we need it for a legal claim.
• Direct marketing: you have an absolute right to object to direct marketing at any time. If you do, we will stop.
• Withdrawing consent: where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
• Automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We do not make such decisions: a person makes every admission decision.

To use any of these rights, email apply@in-depth.io with "Privacy" in the subject line, or write to our registered office. We may need to confirm your identity. We will reply within one month, which the law allows us to extend by up to two further months for complex requests (we will tell you if so). There is normally no charge.

If your request is about client content on the platform, the client is the controller. We will pass your request to them and help them respond.

How to complain

If you are unhappy with how we have handled your information, please tell us first at apply@in-depth.io and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. If you live or work in the EU or EEA, or the issue arose there, you can complain to your local data protection authority.

Cookies

Our public website at in-depth.io sets no cookies and uses no browser storage. The platform uses strictly necessary session cookies to keep you signed in, and first-party cookies and browser storage for product analytics. Our Cookie Policy explains this in full.

Children

Our website and platform are for organisations and professionals. They are not directed at anyone under 18 and we do not knowingly collect information from children. If you think a child has sent us personal information, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make a significant change, we will tell clients and platform users directly. Our Terms of Use cover your use of the website.

Contact us

Email apply@in-depth.io (for privacy and data requests, put "Privacy" in the subject line), or write to IN DEPTH INTELLIGENCE LTD, 38 Church Road, Abbots Leigh, Bristol BS8 3QP, United Kingdom.