Report requests
and optional emails.

This notice covers report forms and email preferences; see the website privacy policy for other website processing.

Who is responsible?

impact4good GmbH (U Impact), Gottfried-von-Cramm-Weg 45, 14193 Berlin, Germany. Privacy enquiries: hello@uimpact.earth. Telephone: +49 30 6920 4740. See the imprint.

What is collected, and why?

The form records your email, requested report, optional name and company, campaign labels from the link, request time, consent choice and the versions of the form notice and consent wording. If you opt in, we also record confirmation and withdrawal or expiry times. We store confirmation-token hashes, rather than plaintext confirmation links. Lead records do not contain your IP address or browser fingerprint. The host may keep separate security logs.

Email is required by this form to manage a report request and recognise repeated requests. Name and company are optional. We use download-only records to operate the request service and understand which reports prompted requests, relying on our legitimate interest in operating and improving this service under Article 6(1)(f) GDPR. We do not use those records to initiate marketing or build a contact list. You can object to this processing by emailing us. You can also download the same report using the alternative link below the form without recording an email. Choosing that option does not affect access to the material.

Optional email contact is based on your consent under Article 6(1)(a) GDPR. It covers investor research, related events and U Impact's investor-engagement services, including an invitation to discuss your organisation's needs. It does not permit telephone marketing, sharing a marketing list with partners or unrelated advertising. Downloading a report does not require marketing consent.

How confirmation and withdrawal work

The optional checkbox starts a confirmation request. We send a neutral confirmation email, and your record becomes eligible for contact only after you explicitly confirm using the linked page. The link expires after 48 hours. Opening the link alone does not confirm consent. If the email was unsolicited, ignore it; the pending record will be deleted. We send no reminder emails automatically.

Every marketing email must include an unsubscribe link. Withdrawal takes effect in this contact list immediately and applies across all three reports. You can also email hello@uimpact.earth. Withdrawal does not affect the lawfulness of earlier processing. A later fresh, confirmed request can authorise contact again. Any internal CRM receiving this list must honour the current consent status.

Who receives the data?

Access is restricted to authorised U Impact staff operating the reports and follow-up process. We do not sell the information. The database processor is Supabase Pte. Ltd. (Singapore), with the selected primary database in Ireland. Vercel, Inc. (United States) hosts the website; report functions are configured for Frankfurt, Germany; Plus Five Five, Inc. (Resend, United States) processes recipient addresses and the content of optional confirmation emails. The CRM, if synchronised, is an internal U Impact system; only the current permitted contact list and suppression status are transferred to it.

A primary EU database location does not mean all processing stays in the EU. These providers and their subprocessors may process operational, support or email data outside the EEA. Their data-processing agreements form part of their service terms and include EU standard contractual clauses for applicable transfers. Supabase may process support and operational data outside the selected region; Vercel and Resend also use United States facilities. We restrict the information sent to each service and use the contractual safeguards described in the linked agreements. You can request details and a copy of applicable safeguards from hello@uimpact.earth. See Supabase's processor terms, Vercel's processor terms and Resend's processor terms.

How long are records kept?

• Download-only requests: 30 days.
• Unconfirmed email requests: seven days; the confirmation link expires after 48 hours.
• Confirmed email contact: up to twelve months after confirmation, unless withdrawn sooner. Another download does not renew consent automatically.
• After withdrawal or expiry: name, company and campaign labels are removed. A restricted record of the email, report, exact consent wording and version, notice version, request and confirmation time, and withdrawal or expiry is retained for up to three years to demonstrate our handling of consent and defend potential claims. The basis is Article 6(1)(f) GDPR. This is a purpose-specific policy based on our documented assessment of consent evidence, objections and possible claims; it is not a universal statutory deadline. It does not permit further marketing.

A daily database job removes or reduces expired records. Supabase daily database backups have seven days of retention on the existing Pro plan. Deleted records may remain in those restricted backups until they expire; after any restoration, deletion and suppression instructions must be applied before contact resumes. Resend retains email and delivery-log data for 30 days on its standard plans. Any CRM import must use current eligibility, replace old campaign snapshots and honour withdrawal and erasure. Host security and operational records are governed separately by the provider terms; our report functions do not log submitted emails, bodies or tokens.

Your rights

Subject to applicable conditions, you can request access, correction, deletion, restriction and portability, object to processing based on legitimate interests, and withdraw consent. Contact hello@uimpact.earth; we may ask for information reasonably needed to verify your identity. You can complain to the Berlin Commissioner for Data Protection and Freedom of Information or another competent supervisory authority. We do not make decisions with legal or similarly significant effects by automated processing of these records.

Notice version: reports-privacy-2026-10-10-v1. Consent version: reports-email-2026-10-10-v1.