1. Who We Are and Our Role
Katanso Solutions Ltd, trading as "Kumo", is a company registered in England and Wales under company number 16264296, with its registered office at 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom. Our ICO registration number is ZB960147. You can reach us about anything in this Policy at support@kumo.earth.
This Privacy Policy explains how we collect, use, store, and share personal data when you use the Kumo Platform (platform.kumo.earth), the Kumo Terminal (terminal.kumo.earth), our website (kumo.earth), and any related services (together, the "Services"). It applies to everyone who uses the Services, including people acting for our business customers.
We act in two capacities. For account, billing, usage, technical, communications, and marketing data, and for security monitoring and service improvement, we are the controller and this Policy governs our processing. For personal data contained in material a customer uploads to the Services, we act as processor on that customer's instructions and that customer is the controller. This includes creating anonymised and aggregated data from that material, which we do on the customer's instruction. Our obligations as processor are set out in our Data Processing Agreement at kumo.earth/dpa. If your data appears in material uploaded by one of our customers, that customer is responsible in the first instance for informing you and for handling your rights requests, and we will pass any request we receive to them.
We process personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, the Data Use and Access Act 2025, and the Privacy and Electronic Communications Regulations 2003 ("PECR"), each as amended.
2. What We Collect
Account data. Your name, email address, company name, job title, and password (hashed). If you use single sign-on, we receive your name and email address from your identity provider.
Billing data. Your billing address and company VAT number where applicable. Card details are collected and processed directly by Stripe and are not stored on our systems. We retain your Stripe customer ID and your subscription details.
Usage data. How you interact with the Services, including pages visited, features used, searches performed, session duration, and click patterns.
Technical data. Your IP address, browser, operating system, device type, screen resolution, referring URL, and time zone, collected automatically when you access the Services.
Project data. If you use the Kumo Platform or go through onboarding, the data you provide about your projects, including financial details, cost profiles, revenue projections, carbon credit volumes, and other project-specific information. It may include personal data relating to project contacts and personnel. Where you upload personal data about other people, you are responsible for having a lawful basis for sharing it with us and for having told them how it will be processed. We process this material as processor on your instructions, as explained in section 1.
Feedback data. If you use the in-product feedback tool, the message you send and, where you choose to include one, a screenshot of the page you were viewing. A screenshot captures whatever was on screen, so please review it before sending.
Communications and marketing data. The content of your correspondence with us and any attachments, and, if you opt in, your email address and marketing preferences.
You must provide account and billing data to enter into and perform our contract with you, and we cannot provide the Services without them. Project data, feedback, and marketing preferences are provided at your choice.
3. Why We Process It, and Our Lawful Basis
| Purpose | Lawful Basis |
|---|---|
| Creating and managing your account, providing and operating the Services, processing payments, and responding to support requests | Performance of a contract (Art. 6(1)(b)) |
| Analytics, product improvement, and creating anonymised and aggregated data from data we hold as controller | Legitimate interests: improving and developing the Services (Art. 6(1)(f)) |
| Security monitoring, and detecting and preventing fraud, abuse, and unauthorised access | Legitimate interests: protecting our Services and our users (Art. 6(1)(f)) |
| Sending marketing communications | Consent (Art. 6(1)(a)) |
| Tax and accounting compliance, and responding to regulatory or legal requests | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have carried out a balancing test to satisfy ourselves that our interests do not override your rights and freedoms. You may contact us for more information about it.
The processing we carry out as processor, including the automated extraction of data from uploaded documents and the creation of anonymised data from that material, is carried out on our customer's instruction and is governed by our Data Processing Agreement rather than by this table.
Automated processing. Where you upload a document such as a financial model, we use a third-party artificial intelligence provider to extract structured data from it, and the document is transmitted to that provider for that purpose. We engage that provider under terms that do not permit it to use the document to train its models. We do not take decisions about you based solely on automated processing that produce legal or similarly significant effects; extraction assists our analysis and our people remain responsible for the conclusions drawn.
4. Sharing and Sub-processors
We do not sell your personal data. We may commercialise anonymised and aggregated data from which individual users and companies cannot be identified; anonymised data is not personal data, and its creation and use is governed by our agreement with the customer concerned.
We share personal data with third-party service providers ("sub-processors") who process it on our behalf, on our instructions, and only so far as necessary to perform services for us. They fall into the following categories: cloud hosting, database, and object storage; authentication and single sign-on; data synchronisation; logging and monitoring; transactional email; payment processing; customer relationship management; website and service analytics; artificial intelligence providers used to extract data from uploaded documents; electronic signature; engineering issue tracking; and in-product feedback capture.
We maintain a current list of our sub-processors, naming each provider, what it processes, where it is located, and the transfer mechanism that applies to it. You may request it at any time from support@kumo.earth. We will notify account holders by email at least thirty (30) days before we add or replace a sub-processor, and we keep each superseded version of the list.
We may also share personal data: (a) with professional advisers bound by confidentiality obligations no less protective than those we owe you; (b) with a prospective buyer or investor in connection with a merger, acquisition, investment, or sale of assets, subject to confidentiality arrangements and limited to what is reasonably necessary for that transaction; (c) with capital providers who are bound by confidentiality obligations, on the basis set out in our agreement with the customer whose project data is concerned; personal data is disclosed to a capital provider only with that customer's prior consent; or (d) where required by law, regulation, court order, or a governmental authority.
5. International Transfers
Our primary database is hosted on Google Cloud Platform in the europe-west3 region (Frankfurt, Germany). Some of our infrastructure and some of our sub-processors are located outside the United Kingdom and the European Economic Area: our BigQuery analytics datasets and certain object storage buckets, including backup storage for documents uploaded to the Kumo Platform, are in the United States. Our sub-processor list, available on request, identifies the location of each sub-processor and the transfer mechanism that applies to it.
Every such transfer is made under a mechanism permitted by Article 46 of the UK GDPR, in practice the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment where one is required. You may request a copy of the relevant mechanism from us.
6. Retention
We keep personal data only for as long as we need it for the purposes in this Policy or for as long as the law requires. Our standard periods are:
| Data Category | Retention Period |
|---|---|
| Account data | Duration of your account plus 12 months after closure |
| Billing and payment records | 7 years from the date of the transaction (HMRC requirement) |
| Usage and analytics data | 26 months from collection |
| Project data (Kumo Platform) | 30 days from account closure or from a deletion request, extended only where a funding process you asked us to support is still live |
| Marketing consent records | Until consent is withdrawn, plus 12 months |
| Communications data | 24 months from the date of the communication |
| Feedback data | 24 months from submission |
| Technical and log data | 12 months from collection, except audit logs retained for 400 days |
Copies held in backups, database exports, and warehouse snapshots may persist beyond these periods until deleted in the ordinary course of the relevant cycle. They are not used for any operational purpose and remain subject to the measures in section 9. Anonymised and aggregated data is not personal data and may be kept indefinitely.
7. Your Rights
Under the UK GDPR you have the right to: access the personal data we hold about you, together with information about how we process it; have inaccurate or incomplete data rectified; have your data erased in certain circumstances; have our processing restricted in certain circumstances; receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible; object to processing we carry out on the basis of legitimate interests, which we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms; and withdraw your consent at any time where we rely on it, including by using the unsubscribe link in any marketing email.
We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you. Section 3 explains how we use automated extraction.
To exercise a right, email us at support@kumo.earth. We will respond within one calendar month, and may extend that by up to two further months for complex or high-volume requests, telling you within the first month if we do. We do not charge a fee unless a request is manifestly unfounded or excessive. Where your data appears in material uploaded by one of our customers, that customer is the controller and we will refer your request to them, as explained in section 1.
8. Cookies
Strictly necessary cookies, which support authentication and core functionality, do not require your consent. Apart from the booking pages described below, analytics cookies (Google Analytics) and marketing cookies (HubSpot) load only if you accept them through our cookie banner, which lists each cookie, its purpose, and how long it lasts, and lets you change your choice at any time. We do not use advertising cookies or cross-site advertising trackers. Our Cookie Policy, at kumo.earth/cookie-policy, sets out each cookie in full.
Booking pages. Our four booking pages (/meet-robin, /meet-henry, /meet-robin-and-henry, and /meet-kumo) load HubSpot's scheduling tool as soon as the page opens, because it is the service you went to that page to use. That embed also sets HubSpot's analytics cookies, which link your enquiry to your earlier visits. You can decline those in the banner.
9. Security
These are the technical and organisational measures referred to in the Confidentiality and Security section of our Data Processing Agreement. We implement and maintain measures appropriate to the risk, including: encryption of data in transit using TLS 1.3 and encryption of data at rest; role-based access control applied on the principle of least privilege; multi-factor authentication for administrative access to internal systems; logging and monitoring of access to personal data; periodic review of access rights and security configuration; and a defined process for responding to security incidents. We may change these measures provided the level of protection is not reduced. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office, and where that risk is high we will notify affected individuals, in accordance with Articles 33 and 34 of the UK GDPR. Where we act as processor, we will notify the customer concerned within seventy-two (72) hours of becoming aware, as our Data Processing Agreement provides.
10. Children
The Services are intended for business use and are not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18, and will delete it promptly if we find that we have. Please contact us if you believe we hold data about a child.
11. Changes to This Policy
We may update this Policy to reflect changes in our practices, the Services, or the law. For material changes we will give at least thirty (30) days' notice by email to the address associated with your account, by a notice on the Services, or both. A change to our sub-processor list is notified as described in section 4 and is not a change to this Policy. The date at the top of this page shows when it was last revised, and earlier versions remain available at this address.
12. Contact and Complaints
Write to our data protection contact at support@kumo.earth, or at Katanso Solutions Ltd, 71-75 Shelton Street, London, WC2H 9JQ, United Kingdom. For general enquiries, hello@kumo.earth.
If you are not satisfied with how we handle your data or your request, you may complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, ico.org.uk. We would rather have the chance to put it right first, so please come to us before you go to them.