Privacy Policy

1. Introduction#

We, Infra-Backer Limited, respect your privacy and are committed to protecting your personal data. This privacy policy informs you about how we look after your personal data when you visit our Platform or communicate with us in any way, and tells you about your rights and how the law protects you.

This privacy policy covers the following areas:

• Important information and who we are
• The data we collect about you
• How your personal data is collected
• How we use your personal data
• Disclosures of your personal data
• International transfers
• Data security
• Data retention
• Your legal rights
• Data protection complaints

2. Important Information and Who We Are#

2.1 Purpose of This Privacy Policy

This privacy policy aims to give you information on how we collect and process your personal data through your use of the Infra-Backer platform ("Platform"), including any data you may provide when you register for an account, pre-register your interest in the Platform, list a project, express interest in a project, subscribe to Premium Insights, contact us, or interact with the Platform in any other way.

The Platform is a business-to-business service and is not intended for children. We do not knowingly collect data relating to children.

Please read this privacy policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we use your data. This policy supplements other notices and is not intended to override them.

2.2 Data Controller

Infra-Backer Limited is the controller and responsible for your personal data (referred to as "we", "us", or "our" in this privacy policy).

We are responsible for overseeing questions in relation to this privacy policy. If you have any questions about this policy, or wish to exercise any of your legal rights set out below, please submit your request through the contact form on the Platform. Your request will reach an Infra-Backer administrator who is responsible for handling data protection matters.

2.3 Contact Details

The data controller is Infra-Backer Limited, a company registered in England and Wales (company number 17455512), with its registered office at 128 City Road, London, EC1V 2NX, United Kingdom. The most reliable way to reach us about your personal data is via the contact form on the Platform. You can also email us at [email protected]. You may make a request to exercise your rights by any of these means.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

2.4 Changes to This Privacy Policy and Your Duty to Inform Us of Changes

We may update this privacy policy from time to time. We will post the updated version on the Platform with a new "last updated" date and, where the changes are significant, we will notify Registered Users by email or through the Platform.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

2.5 Third-Party Links

The Platform may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave the Platform, we encourage you to read the privacy notice of every website you visit.

3. The Data We Collect About You#

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity Data: includes first name, last name, username or similar identifier, job title, and professional role.
• Contact Data: includes business email address, postal address, and telephone numbers.
• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, platform, and other technology on the devices you use to access the Platform.
• Profile Data: includes your username, account role (developer, investor, advisor, or researcher), organisation membership, investment preferences, saved search criteria, feedback, survey responses, and pre-registration details (the role you select, your organisation and any message you include).
• Usage Data: includes information about how you use the Platform, including pages visited, features used, project listings viewed, expressions of interest made, and engagement workflow interactions, and the map features you use and the number of map requests you make.
• Financial Data: includes billing details, payment confirmations and subscription status. Payment card details are collected and processed directly by Stripe, our payment processor, and are not stored on our servers.
• Communications Data: includes your preferences in receiving communications from us and your communication history through the Platform.

We also collect, use, and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data in accordance with this privacy policy.

Information about people who are not users. Some Data Content, including information drawn from public planning and energy databases, may include the names of individuals, for example where an individual is the applicant for or operator of a project. We obtain this information from publicly available sources and use it, on the basis of our legitimate interests, to present market information about infrastructure projects. Because we do not hold contact details for these individuals, we provide this information through this privacy policy rather than contacting them individually. They have the rights described in Section 10.

We do not collect any Special Categories of Personal Data about you (such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, or genetic and biometric data). Nor do we collect any data about criminal convictions and offences.

3.1 If You Fail to Provide Personal Data

Where we need to collect personal data and you fail to provide that data when requested, we may not be able to provide you with access to the Platform or its services. For example, we may be unable to approve your registration, process your subscription, or facilitate engagement workflows. We will notify you if this is the case at the time.

4. How Is Your Personal Data Collected?#

We use different methods to collect data from and about you, including through:

• Direct interactions. You may give us your Identity, Contact, Profile, and Financial Data by filling in forms or by corresponding with us by email or otherwise. This includes personal data you provide when you register for an account on the Platform, pre-register your interest in the Platform before launch, create or update your user profile, list a project or express interest in a project, subscribe to Premium Insights or another paid feature, shortlist investors, configure saved search criteria or notification preferences, contact us with enquiries or feedback, or participate in surveys.
• Automated technologies or interactions. As you interact with the Platform, we may automatically collect Technical Data and Usage Data about your equipment, browsing actions, and usage patterns. We collect this personal data by using cookies, server logs, and other similar technologies. Please see our separate Cookie Policy for further details. When you submit our pre-registration or contact forms, or where our map features ask for a security check, an automated security check (Cloudflare Turnstile) processes Technical Data to confirm that the request is made by a person rather than an automated bot.
• Third parties or publicly available sources. We may receive personal data about you from third parties and public sources, including Technical Data from analytics providers, Identity and Contact Data from publicly available sources such as Companies House, and payment confirmation data from Stripe (our payment processor), and project information, which may include the names of individuals, from public planning and energy databases.

5. How We Use Your Personal Data#

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform a contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.
• Where you have given consent for a specific purpose.

5.1 Purposes for Which We Will Use Your Personal Data

We have set out below a description of the ways we plan to use your personal data, and the legal bases we rely on to do so.

5.2 Communications

You will receive communications from us if you have registered for an account, subscribed to notifications, or otherwise requested information from us, and you have not opted out of receiving such communications.

If you pre-register, we will only contact you about Infra-Backer beta access and the launch of the Platform, unless you later register for an account or ask to hear from us about other matters.

We will obtain your consent before sharing your personal data with any third party for marketing purposes. You can ask us or third parties to stop sending you communications at any time by updating your notification preferences in your account settings or by contacting us.

5.3 Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and will explain the legal basis which allows us to do so.

We may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5.4 Automated Decision-Making

Our matching service suggests projects and investors based on criteria that users set, but decisions to express interest, shortlist or engage are always made by users, and registrations are approved by our administrators. The only decision our systems may take automatically is the temporary restriction of an account's access to the map features described in Section 5.5. That restriction does not affect the rest of the Platform, and a member of our team will review it if you contact us.

5.5 Map Usage Monitoring

To protect the map data against automated extraction, we count each account's use of the Infra-Maps features, such as map views, searches and detail requests, and keep a daily summary of each account's map usage for 12 months. If an account's use passes a warning threshold, we record the IP address and browser information of the request in our audit log and alert our administrators, and we may ask you to complete a security check (Cloudflare Turnstile). If an account's use passes a higher threshold, our systems may restrict that account's access to the map features until an administrator has reviewed it. The same limits apply to every account.

6. Disclosures of Your Personal Data#

We may share your personal data with the following categories of recipients. Most act as our processors and process your data only on our instructions. Some, identified below, also act as independent controllers of some of the data they receive and are responsible for that processing under their own privacy notices.

• Hosting and infrastructure: Render, which hosts the Platform, its database and its cache in the United States.
• Network, security and analytics: Cloudflare, which handles every request to the Platform as our processor, providing domain name services, a proxy and content delivery network, security and bot protection, and Web Analytics. Web Analytics counts page views from the technical information your browser sends with each request (such as the page address, the referring site, your browser type and your country); it sets no cookies and does not track you across other websites.
• Bot checks: Cloudflare Turnstile, which checks that submissions to our pre-registration and contact forms, and requests to our map features where a security check is required, are made by a person rather than an automated bot. Turnstile processes your IP address, browser (user-agent) information and similar technical signals. It does not read what you enter into a form and is not used to identify, profile or advertise to you. Cloudflare may also use these signals as an independent controller to improve its bot detection, as described in Cloudflare's Turnstile Privacy Addendum.
• Payment processing: Stripe, which processes subscription payments, broker fee payments and other paid-feature transactions on our behalf. Stripe also acts as an independent controller for its own fraud prevention and regulatory compliance. We do not store your full payment card details on our servers.
• Transactional email: Postmark, which delivers account, verification, notification and contact emails on our behalf, using its parent company ActiveCampaign and its hosting providers Amazon Web Services and Deft as sub-processors.
• Business email: Microsoft 365, which hosts our company mailboxes, including messages you send to us and our replies.
• Error monitoring: Sentry, which (where enabled) helps us detect and diagnose technical errors, and stores that data in the European Union. We configure it to scrub sensitive fields from the diagnostic data it receives.
• Mapping: Mapbox, which renders the Platform's maps (the Infra-Maps pages, the dashboard project map and the location maps on project and service-request pages). Once you choose "Show maps", your browser connects to Mapbox whenever a map loads: Mapbox receives your IP address and technical information about your browser, and Mapbox's software stores a randomly generated identifier in your browser that Mapbox uses to calculate aggregate usage statistics. See our Cookie Policy for more information.
• Professional advisers including lawyers, auditors, and insurers who act as independent controllers and who provide consultancy, legal, insurance, and accounting services.
• Other Platform users: where a developer shortlists an investor's expression of interest, certain Identity and Contact Data of the interested investor is unlocked and shared with the developer so that they can make contact off the Platform. Likewise, a developer's organisation details are visible to users engaging with their listings.
• Regulators and authorities who require reporting of processing activities in certain circumstances.
• Business transfers: a buyer or successor of all or part of our business, including any group company to which we transfer the operation of the Platform. If this happens, the new owner may use your personal data in the same way as set out in this privacy policy, and we will tell you about the change.

We require our processors to respect the security of your personal data and to treat it in accordance with the law, and we only permit them to process it for specified purposes and in accordance with our instructions.

7. International Transfers#

Our service providers Render, Cloudflare, Stripe, Postmark (and its sub-processors ActiveCampaign, Amazon Web Services and Deft), Microsoft, Mapbox and, where enabled, Sentry are based in, or process data in, the United States or other countries outside the United Kingdom. In particular, the Platform and its database are hosted in the United States. Using these providers therefore involves transferring your personal data outside the United Kingdom.

Whenever we transfer your personal data outside the United Kingdom, we ensure it is protected by an appropriate safeguard under UK data protection law. Either the destination is covered by UK adequacy regulations (including, for providers certified to it, the UK Extension to the EU-US Data Privacy Framework), or we use the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in our agreements with those providers.

8. Data Security#

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. These measures include:

• Mandatory two-factor authentication (TOTP via authenticator app), with single-use backup recovery codes, for all user accounts.
• Email verification and administrator approval required for all new user registrations.
• Encryption of data in transit.
• Automated bot and spam protection on our public forms.
• Role-based access controls limiting data visibility to authorised users only.
• A server-side session registry that lets you see your active sessions and sign out of individual devices or everywhere at once.
• Audit logging of significant actions on the Platform, which captures the IP address and device information associated with security events such as sign-in.

We limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9. Data Retention#

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes through other means, and the applicable legal requirements.

When your account is deactivated or terminated, we will retain certain data as required by law or for our legitimate business purposes (such as audit trail obligations and dispute resolution). We will securely delete or anonymise your personal data when it is no longer required.

As a guide: we keep transaction and billing records for six years after the end of the financial year to which they relate, to meet our tax and accounting obligations; we keep a daily summary of each account's use of the map features for 12 months; we keep security logs (sign-in and account-security events, which include IP addresses and device information) for 12 months; and we keep the record of actions taken on the Platform, such as changes to a project's status, for as long as we need it to run the Platform and to establish, exercise or defend legal claims, deleting the IP address and device information recorded with it after 12 months.

If you pre-register, we keep your pre-registration details until beta access opens for your role and for up to 12 months afterwards, unless you create an account, withdraw your consent or ask us to delete them sooner.

10. Your Legal Rights#

Under data protection laws, you have the following rights in relation to your personal data:

• Request access to your personal data (commonly known as a 'data subject access request'). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. Note that we may not always be able to comply with your request for specific legal reasons, which will be notified to you at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in certain scenarios.
• Request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

If you wish to exercise any of these rights, please submit your request through the contact form on the Platform.

10.1 No Fee Usually Required

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

10.2 What We May Need from You

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data or exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

10.3 Time Limit to Respond

We aim to respond to all legitimate requests within one month. Where a request is complex or you have made a number of requests, we may extend this period by up to two further months, and we will tell you within one month if we need to do so. If we need to confirm your identity, the time period starts when we receive the information we need.

11. Data Protection Complaints#

You have a right to submit a data protection complaint to us if you are unhappy with how we have handled your personal data. This may include how we have responded to data subject rights requests, where you have been impacted by a data breach involving Infra-Backer, or how we have used and processed your personal data.

11.1 Submitting Your Complaint

If you wish to exercise your right to submit a data protection complaint, you can do so through the contact form on the Platform, choosing "Data protection or privacy complaint". When submitting your complaint, please provide details of what the complaint relates to, any relevant time periods, and the reason for your complaint.

11.2 Acknowledging Your Complaint

Once we have received your data protection complaint, we will acknowledge it in writing within 30 days. The acknowledgement will include details on the steps we will take as part of responding to your complaint.

11.3 Time Limit to Respond

We will respond to your complaint without undue delay and will keep you informed of progress, including when we expect to provide a full response.

11.4 Escalation

If you are unhappy with our response to your data protection complaint, you have the right to complain to the Information Commissioner’s Office (ICO). Details on how to make a complaint can be found at ico.org.uk. Please note that the ICO may ask you to submit a complaint to us first if you have not already done so.