Privacy Notice

Coalition for Climate Resilient Investment – Privacy Notice

Last updated:  September 2023

(1)       Who we are

The Coalition for Climate Resilient Investment is a collaboration between the Governments of the UK and Jamaica, Willis Towers Watson, the Global Commission on Adaptation, and the World Economic Forum, (“Coalition,” “CCRI,” “we,” “us,” or “our”) and is the owner of this website (the “Website”). We are committed to privacy and to transparency in our information practices.

(2)       Scope of this Privacy Notice

This Privacy Notice describes, generally, how the Coalition, handles and processes your personal information when you visit and interact with the Website. The Coalition is a data controller or business under applicable data protection laws. Please refer to the Contact Us section to find out how to exercise any of your rights or if you have any questions about your personal data.

In this Privacy Notice, our use of the term “personal information” includes other similar terms under applicable privacy laws—such as “personal data” and “personally identifiable information.” In general, personal information includes any information that identifies, relates to, describes, or is reasonably capable of being associated, linked or linkable with a particular individual.

(3)       Cookies and other technologies

We use cookies and other technologies on this Website. You can find out more about the cookies we use and why by viewing our Cookie Policy. Our Cookie Policy should be read together with this Privacy Notice.

(4)       Changes to our Privacy Notice

We may change this Privacy Notice from time to time. Please take a look at the “Last Revised” legend at the top of this page to see when this Privacy Notice was last revised. If we make significant changes to this Privacy Notice, we will notify you of changes when you next visit. We encourage you to review this Privacy Notice whenever you return to our Website.

(5)       What information do we collect about you?

Categories of sources of personal information.  The precise collection, use, and disclosure of personal information will vary depending upon the circumstances and nature of our interactions or relationship with you, but the following sections provide an overview of our practices in this regard.  We do not direct or services toward nor knowingly process personal data belonging to individuals 16 years or younger.   We may collect personal information directly from you, as well as automatically related to your use of our Website, as well as from third parties.  For example, we collect personal information:

• from you, either directly (i.e., through information you submit to us, including via forms that you may complete and submit through our Website) or indirectly (i.e., by observing your actions on our Website)
• from 'cookies' and other similar tools deployed on parts of our Website (for further information regarding cookies used on our Websites, please our Cookie Policy)

Categories of personal information we collect.  We may collect the following categories of personal information (subject to applicable legal requirements and restrictions):

• Name, contact information and other identifiers: identifiers such as a real name, alias, address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
• Usage data: internet or other electronic network activity Information including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement.

Legal bases for processing your personal information

We must have a legal basis to process your personal information. In most cases the legal basis will be one of the following:

• for our legitimate business interests, for example to ensure that your query or message is responded to when you use our Contact Us form and to analyse the interest in our Website for the purposes of improving, enhancing and modifying it. We ensure that these legitimate interests do not unfairly impact your privacy or your other rights; and
• to comply with our legal, regulatory and professional obligations, such as our duties to members and our due diligence and reporting obligations.

(6)       How we use your personal information

We use your personal information to:

• Respond to your queries, comments, or messages and fulfilling your requests for products, services or information;
• Comply with legal obligations that apply to us;
• Provide, communicate and market the products and services offered by the Coalition members, and their respective affiliates, subsidiaries and successors-in-interest
• Facilitate your application for one or more policies,
• Personalizing content and experiences,
• Advertising, marketing and promotional purposes, including marketing the products and services offered by other businesses, affiliates and subsidiaries with the individual Members of CTP (subject to applicable laws)
• Provide troubleshooting and other technical support, and for other customer service and support purposes, including operating our websites,
• Analyze and improve our business, including securing and protecting our business,
• Defend our legal rights, and comply with legal obligations
• Audit, report, and for corporate governance and internal operations,

(7)       How we share your personal information

The Coalition’s purpose is to transform infrastructure investment by integrating climate risks into decision-making, driving a shift toward a more climate resilient economy for all countries, including the most vulnerable. Because of the membership of the Coalition your personal information may be shared within our members, which may include subsidiaries and affiliates of corporate organisations.

(8)       Categories of personal information disclosed for a business purpose, purposes for which we disclose your personal information, categories of personal information we sell and categories of third parties to whom we disclose personal Information

Categories of personal information disclosed

Please review the descriptions of the categories of personal information under the Personal Information Collected section above, for further descriptions of each category of personal information.

Categories of personal information disclosed for a business purpose.

In general, we may disclose the following categories of personal information in support of our business purposes identified below:

• Name, contact information and other identifiers
• Usage data

We have disclosed the categories of personal information listed above to the following categories of third parties in the preceding twelve months: Members of the Coalition and their affiliates, subsidiaries, and successors in interest and our service providers.

Categories of personal information we sell or share

The CCPA defines a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and it defines “share” in pertinent part as disclosing personal information to a third party for cross-context behavioral advertising.  We do not “sell” or “share” personal information as defined by the CCPA.

Purposes for which we disclose personal information and disclosure to third parties

The Coalition may disclose your personal information to any of its members for the uses and purposes set out above. We may also disclose your personal information for the following reasons:

• to third party service providers such as entities providing customer service, email delivery, auditing, hosting our Website and other services
• to other third parties where we are required or authorised by law to do so, including to law enforcement agencies for the purposes of fraud prevention.
• if we are obliged to disclose your personal information under applicable law or regulation, which may include laws outside your country of residence
• in order to enforce or apply our Websites’ terms of use, or to protect the rights, privacy, safety or property of any Coalition member, our clients, affiliates or other parties
• subject to applicable laws, to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include such authorities outside your country of residence
• in connection with the planning, due diligence and implementation of commercial transactions, including a reorganization, merger, sale of all or a portion of our assets, a joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings)—in such cases, your personal information will be transferred to the acquiring entity
• in accordance with the separate terms and conditions of use that may apply to you or with your explicit consent.

(9)       Opt-Out Preference Signals and “Do-Not-Track” Signals

If your browser enables the Global Privacy Control (GPC) when visiting our Website, our Website will automatically opt you out of any tracking cookies that constitute a “sale” where required by applicable privacy law.  For more information about the GPC and to learn how to implement it on your browser, please click here.   Please note, our Website does not recognize or respond to any signal which your browser might transmit through its so-called “Do Not Track” (DNT) feature.  If you wish to disable cookies on our Websites, you should not rely on DNT browser settings.

(10)       Security and retention

CCRI stores personal information as needed to accomplish the purposes identified in this Notice and to meet legal requirements, including legal and compliance requirements regarding records retention, resolving disputes, and enforcing our agreements.  This means that we may be required to maintain your information, for example, to: (1) comply with our legal or regulatory compliance needs (e.g., maintaining records of transactions you have made with us); (2) to exercise, establish or defend legal claims; and/or (3) to protect against fraudulent or abusive activity on our services and systems.  For these and possibly other reasons, we may be unable to delete personal information upon request of an individual in certain cases.

We may retain different categories of information for different periods of time for the instances stated above.  However, it our policy as an organization that when personal information is no longer needed or after legal authority to retain it has expired, personal information will be destroyed in accordance with applicable law and pursuant to procedures established in relation to the relevant services, systems, or processes.  Retention periods for records maintained by CCRI, including those containing personal data are established based upon business need, statutory and regulatory record keeping requirements in the geographies where we do business, and legal obligations.  If you have any further questions about our handling of personal information, please contact us at privacy@resilientinvestment.org.

(11)       Overseas transfers of personal information

The Coalition is a global initiative and the personal information that we collect from you may be transferred to, accessed, processed or stored in, and subject to requests from law enforcement agencies, in jurisdictions outside of your home jurisdiction, including the Bermuda, the European Union, India, Quebec, the United States, and other jurisdictions, in which we or our service providers operate.. Some of these jurisdictions, including the United States, may not provide equivalent levels of data protection as your home jurisdiction. We have established safeguards to protect personal information that is transferred to other countries, including appropriate contractual protections. For more information on the appropriate safeguards in place, please contact us using the details below.

(12)       Your rights

Access, amendment and deletion.
You may request to review, make amendments, have deleted or otherwise exercise your rights, under applicable privacy laws, over your personal information that we hold, subject to certain limitations under applicable law. Except for California residents who should use the contact means described below in the “California Residents” section, you may submit a request to us related to your personal information:

• By submitting a request to us at via the Contact Us form;
• By emailing us at privacy@resilientinvestment.org.

We take steps in accordance with applicable legislation to keep your personal information accurate, complete and up-to-date. If you would like to review, correct, update, suppress, or restrict the processing of your personal information or request a copy of personal information about you, you may contact us by sending us an email at privacy@resilientinvestment.org or sending your request by postal mail to the address provided in the “Contact & Comments” section below.

In your request, please make clear what personal information you would like to have changed, whether you would like to have your personal information suppressed from our database or otherwise let us know what limitations you would like to put on our use of your personal information. For your protection, we may only implement requests with respect to the personal information associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.

Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion. There may also be residual information that will remain within our databases and other records, which will not be removed.

To exercise your rights please use any of the details set out above or in the Contact and Comments section below. Subject to legal and other permissible considerations, we will make reasonable efforts to honour your request promptly or inform you if we require further information in order to fulfil your request.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

(13)       Contacts & Comments

If you have any questions or comments regarding this Privacy Notice, please contact us by email at privacy@resilientinvestment.org, or write to us at 51 Lime Street, London, EC3M 7DQ, United Kingdom.   If you reside in Canada, you may contact us by mail using the following information: Willis Towers Watson Canada, Inc., Privacy Officer, 130 King Street W, Exchange Tower, Suite 1500, P.O. Box 424, Toronto, ON  M5X 1E3, or by email at privacy@willistowerswatson.com or telephone at +1.416.960.2700.

(14)       Additional Information for Residents in Certain Jurisdictions

The Coalition is committed to respecting the privacy rights of individuals under all privacy laws applicable to us. Some privacy laws require that we provide specific information about individual rights to applicable consumers, which we have set forth at the end of this Notice:

• California: if you are a California resident, please go to the “California Residents” section below for your rights under California privacy laws.
• EU/EEA and UK: if you are in the European Union / European Economic Area or the United Kingdom, please go to the “European Union/EEA/UK section below for details about your rights under the GDPR.
• Brazil: If you are in Brazil, please see the “Brazil” section below for details about your rights under the LGPD.

A.California Residents

In this section, we provide information for California residents, as required under California privacy laws, including the California Consumer Privacy Act (“CCPA”), which requires that we provide California residents certain specific information about how handle their personal information, whether collected online or offline. This section does not address or apply to our handling of publicly available information made lawfully available by state or federal governments.

This section does not address or apply to our handling of:

• publicly available information made lawfully available by state or federal governments
• personal information that is subject to an exemption under Section 1798.145(c) – (f) of the CCPA (such as protected health information that is subject to HIPAA or the California Medical Information Act, and non-public information subject to the Gramm-Leach Bliley Act or the California Financial Information Privacy Act)
• personal information we collect about job applicants, independent contractors, or current or former full-time, part-time and temporary employees and staff, officers, directors or owners of Willis Towers Watson or its affiliates.
• personal information about individuals acting for or on behalf of another company, to the extent the information relates to our transactions with such company, products or services that we receive from or provide to such company, or associated communications or transactions (except that such individuals have the right to opt-out of any sale of their personal information and to not be subject to any discrimination for exercising such right)

Rights of California residents. California law grants California residents, certain rights and imposes restrictions on particular business practices as set forth below.

Do-Not-Sell/Do Not Share: California residents have the right to opt-out of the “sale” and the “sharing” of their personal information. The CCPA defines a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration, and it defines “share” in pertinent part as disclosing personal information to a third party for cross-context behavioral advertising.  We do not “sell” or “share” personal information about California residents California residents have the right to opt-out of our sale of their personal information. The Website does not sell any personal information and therefore is not required to provide means to exercise an these opt-out rights.

Limit the Use of Sensitive Personal Information: California residents have the right in certain instances to request that we limit the use and sharing of their sensitive personal information. The CCPA defines “sensitive personal information” to include, among other things, your: social security, driver’s license, state identification card, or passport numbers; account log-in, financial account, debit card, or credit card numbers in combination with any required security or access code, password, or credentials allowing access to an account; racial or ethnic origin, religious or philosophical beliefs, or union membership; genetic data; and biometric information (including physiological, biological, or behavioural characteristics). We do not collect Sensitive Personal Information under the CCPA and therefore are not required to provide a means to exercise this right.

• Initial Notice: We are required to notify California residents, at or before the point of collection of their personal information, the categories of personal information collected and the purposes for which such information is used.

• Request to Delete:California residents have the right to request deletion of their personal information that we have collected about them and to have such personal information deleted, except where an exemption applies. We will respond to verifiable requests received from California residents as required by law. The instructions for submitting a verifiable Request to Delete are described in the “Submitting Requests” section below.

• Request to Know:California residents have the right to request and, subject to certain exemptions, receive a copy of the specific pieces of personal information that we have collected about them and to have this delivered, free of charge, either (a) by mail or (b) electronically in a portable and, to the extent technically feasible, readily useable format that allows the individual to transmit this information to another entity without hindrance. California residents also have the right to request that we provide them certain information about how we have handled their personal information, including the:
• categories of personal information collected;
• categories of sources of personal information;
• business and/or commercial purposes for collecting and selling their personal information;
• categories of third parties/with whom we have disclosed or shared their personal information;
• categories of personal information that we have disclosed or shared with a third party for a business purpose;
• categories of personal information collected; and
• categories of third parties to whom the residents’ personal information has been sold and the specific categories of personal information sold to each category of third party

California residents may make a Request to Know up to twice every 12 months. We will respond to verifiable requests received from California residents as required by law.  The instructions for submitting a verifiable Request to Know are described in the “Submitting Requests” section below.

• Request to Correct: California residents have the right to request that we correct inaccurate personal information that we maintain.

• Right to non-discrimination: The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices, rates, or penalties on residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.

• Financial incentives:A business may offer financial incentives for the collection, sale or deletion of California residents’ personal information, where the incentive is not unjust, unreasonable, coercive or usurious, and is made available in compliance with applicable transparency, informed consent, and opt-out requirements. California residents have the right to be notified of any financial incentives offers and their material terms, the right to opt-out of such incentives at any time and may not be included in such incentives without their prior informed opt-in consent. We do not offer any such incentives at this time

Submitting Requests. Requests to Know, and Requests to Delete may be submitted:

• By submitting a request to us using the Contact Us form.
• By contacting us at 1-800-999-9550
• By emailing us at privacy@resilientinvestment.org.

We will use the following process to verify Requests to Know and Requests to Delete:  We will acknowledge receipt of you Consumer Request, verify it using processes required by law, then process and respond to your request as required by law.  To verify such requests, we may ask you to provide the following information:

• For a request to know categories of personal information which we collect, we will verify your identity to a reasonable degree of certainty by matching at least two data points provided by you against information in our systems which are considered reasonably reliable for the purposes of verifying a consumer’s identity.
• For a request to know specific pieces of personal information or for requests to delete, we will verify your identity to a high degree of certainty by matching at least three pieces of personal information provided by you to personal information maintained in our systems and also by obtaining a signed declaration under penalty of perjury that the requestor is the consumer whose personal information is the subject of the request.
• An authorized agent can make a CCPA request on a California resident’s behalf by providing either: (1) a power of attorney valid under California law; or (2) proof that the consumer gave the agent signed permission to submit the request. The consumer must also provide either: (1) verification of their own identity with respect to a right to know categories, right to know specific pieces of personal information, or requests to delete which are outlined above; or (2) direct confirmation that the consumer provided the authorized agent permission to submit the request.

We will respond to verifiable requests received from California residents as required by law. For more information about our privacy practices, you may contact us as set forth in the Contact and Comments section above.

Consumer Requests Received in 2022.   In calendar year 2022, we received and responded to consumer requests under the CCPA as set forth in the table below:

B. European Union / European Economic Area and the United Kingdom

Residents of the European Union (EU) and the European Economic Area (EEA) and the United Kingdom (UK) have the following rights, under the GDPR, regarding their personal information:

• Right of access: You have the right to obtain from us confirmation as to whether or not personal information concerning you is being processed, and where that is the case, to request access to the personal information. The accessed information includes – among others – the purposes of the processing, the categories of personal information concerned, and the recipients or categories of recipient to whom the personal information have been or will be disclosed. You have the right to obtain a copy of the personal information undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.
• Right to rectify and complete personal information:you can request the rectification of inaccurate data and the completion of incomplete data. We will inform relevant third parties to whom we have transferred your data about the rectification and completion if we are legally obliged to do so.
• Right to erasure (right to be forgotten): You have the right to obtain from us the erasure of personal information concerning you in limited circumstances where:

• it is no longer needed for the purposes for which it was collected; or
• you have withdrawn your consent (where the data processing was based on consent); or
• following a successful right to object; or
• it has been processed unlawfully; or
• the data has to be erased in order to comply with a legal obligation to which The Coalition is subject.

We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for:

• compliance with a legal obligation; or
• the establishment, exercise or defense of legal claims.

• Right to restriction of processing: You have the right to obtain from us restriction of processing your personal information. In this case, the respective data will be marked and only be processed by us for certain purposes. This right can only be exercised where:

• the accuracy of your personal information is contested, to allow us to verify its accuracy; or
• the processing is unlawful, but you do not want the personal information erased; or
• it is no longer needed for the purposes for which it was collected, but you still need it to establish, exercise or defend legal claims; or
• you have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal information following a request for restriction, where:

• we have your consent; or
• to establish, exercise or defend legal claims; or
• to protect the rights of another natural or legal person.

• Right to data portability:You have the right to receive the personal information concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another entity without hindrance from us, but in each case only where the processing is (a) based on your consent or on the performance of a contract with you, and (b) also carried out by automated means.
• Right to object: You have the right to object at any time to any processing of your personal information which has our legitimate interests as its legal basis. You may exercise this right without incurring any costs. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. The right to object does not exist, in particular, if the processing of your personal information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
• Right to object to our use of your personal information for direct marketing purposes: You can request that we change the manner in which we contact you for marketing purposes. You can request that we do not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.
• Right to withdraw consent: if you have given us your consent for the processing of your personal information, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to obtain a copy of safeguards: you can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside the EU/EEA/UK. We may redact data transfer agreements to protect commercial terms.
• Right to lodge a complaint with your local supervisory authority: You have a right to lodge a complaint with your local supervisory authority if you have concerns about how we are processing your personal information. We ask that you please attempt to resolve any issue with us first, although you have a right to contact your supervisory authority at any time.

C. Brazil

The following information applies to personal data which we process from any individuals that is related to Brazil’s territory under the National Data Protection Law (LGPD):

• Scope: In addition to the circumstances set forth in the section above regarding Scope, the LGPD applies when we process personal data subject to protect fundamental rights of freedom, privacy and the free development of the personality of individuals.
• Sensitive Personal Data under the LGPD: Sensitive personal data under the LGPD includes personal data (as defined above in Scope section of this Notice) about racial or ethnic origin, religious belief, political opinion, union membership or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data, when linked to a natural person.  Please see the section above regarding Personal Information Collected for more information on how we treat sensitive personal data.

• Individual rights: Under the LGPD, individuals have certain rights related to their personal data, subject to other limitations in this law, as follows:

1. Confirmation of the existence of data processing;
2. Access to your personal data;
3. Correction of incomplete, inaccurate, or out-of-date data;
4. Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with LGPD;
5. Portability of data to another service or product provider, subject to the LGPD;
6. Deletion of personal data, to the extent permitted by the LGPD;
7. Information about the entities with whom we have shared personal data;
8. Information about the possibility of denying consent and consequences of such denial;
9. Revocation of consent.