Privacy Policy

• 1.1 The Global Centre for Risk and Innovation (GCRI Canada), a Canadian not-for-profit organisation with its registered office in Toronto, Ontario, is responsible for the personal information described in this Policy. For the purposes of the GDPR and the UK GDPR, GCRI Canada is the controller of that information.
• 1.2 GCRI Canada has designated a Privacy Officer, who is accountable for this Policy and can be reached at contact@therisk.global (subject: Privacy).
• 1.3 This Policy applies to nexustandards.com and the programme sites published at addresses beginning with nexustandards.com/, such as nexustandards.com/climate/ (together, the Sites), to correspondence with the Secretariat, and to the records of the open development process of the Nexus Standards. Other services operated under separate terms have their own privacy notices.

• 2.1 The Sites have no reader accounts, no forms, no analytics and no advertising. They do not use social-media plug-ins or embedded video, and they do not sell, rent or trade personal information.
• 2.2 Reading a page involves the technical exchange that every web page requires: the visitor's browser sends its internet protocol (IP) address and technical details to the hosting provider and, for some interactive figures, to the third-party providers listed in Section 5.
• 2.3 Personal information is collected only when a person writes to the Secretariat or takes part in the development of the standards; contributions to the open process are public by design.

Each provider processes this information under its own terms and privacy notice. The Sites do not embed video, social-media plug-ins, advertising networks or analytics services. Following a share link opens the chosen service, which then applies its own privacy notice.

• 6.1 GCRI Canada is based in Canada. The hosting provider and the third-party providers in Section 5 may process information in Canada, the United States, the European Union and other countries, where it is subject to the law of that country, including lawful access by its authorities.
• 6.2 Where the law of the visitor's jurisdiction requires a transfer mechanism, GCRI Canada relies on the mechanism that law provides, such as an adequacy decision or standard contractual clauses. Information on the mechanism used can be requested from the Privacy Officer.

• 8.1 Requests may be sent to the Privacy Officer at contact@therisk.global. GCRI Canada may ask for information needed to confirm the requester's identity, acknowledges each request within fourteen days and answers it within the period the applicable law sets (thirty days under PIPEDA, one month under the GDPR and UK GDPR, extendable only as that law permits, with reasons).
• 8.2 Requests are free of charge, except where the law permits a reasonable fee or a refusal for requests that are manifestly unfounded or excessive.
• 8.3 Contributions to the open process form part of a public record that others rely on. Where erasure of such a record is not required by law, GCRI Canada removes or masks contact details and, where possible, replaces the name with a pseudonym, while keeping the substance of the record.
• 8.4 A person may complain to the competent authority at any time; the Privacy Officer is available to resolve a concern first.

• 9.1 The Sites are served over HTTPS. Third-party code libraries are pinned to exact versions and checked against integrity digests, and access to the systems that publish the Sites is restricted to authorised persons.
• 9.2 No method of transmission or storage is entirely secure. Where a breach of security creates a real risk of significant harm, or otherwise where the law requires, GCRI Canada notifies the affected individuals and the competent authority.

• 10.1 The Sites are not directed to children and do not knowingly collect personal information from children. Persons under sixteen years of age should not send personal information to the Secretariat or contribute to the standards without the involvement of a parent or guardian.
• 10.2 A parent or guardian who believes that a child has provided personal information may ask the Privacy Officer to delete it.

• 11.1 GCRI Canada does not use personal information for profiling or for decisions based solely on automated processing that produce legal or similarly significant effects.

• 12.1 GCRI Canada may update this Policy. The updated Policy is published on this page with a new effective date; a material change is also announced on the Sites before it takes effect where practicable.