SourceBlue (“SourceBlue”) operates www.sourceblue.com and may operate other websites. It is SourceBlue’s policy to respect your privacy regarding any information we may collect. This Privacy Policy sets out the principles governing SourceBlue’s use and protection of personal data.

PRIVACY POLICY FOR

www.sourceblue.com

EFFECTIVE DATE

January 1, 2022

We invite you to explore the 2024 Decarbonization Price Index and leverage its insights to enhance your organization’s decarbonization efforts. Together, we can drive the shift toward a more sustainable future.

Privacy Notice Changes

This privacy policy will be reviewed and updated, if required at a minimum of every 12 months.

SourceBlue encourages visitors to frequently check this page for any changes to its Privacy Notice. If we make changes, we will revise the “Effective” date at the top of this statement, and we may provide additional notice such as on the SourceBlue website homepage, or via the email address we have on file for you.

SourceBlue may collect Personal Data in the course of our normal business activities, as detailed below.

SourceBlue collects, uses, stores and process Personal Data, which is data that identifies, relates to, describes, or can reasonably be associated with a particular person. For all data subjects, this can include:

1. Identifiers: Identifying information including name, postal or e-mail address, and phone or fax number, social security numbers, driver’s license numbers, biometric information.
2. Personal Information: Names, signatures, Social Security Numbers, addresses, government identification documents, financial information such as bank account, credit or debit card information, health insurance information, education information.
3. Business contact information including as job title, department and name of organization, business address, e-mail address, mobile telephone number.
4. Usernames and passwords used to access internal SourceBlue network resources such as our Partner Logon on web page or internal training Learning Management System.
5. Website visitor activity including IP address, the identity of the Internet service provider, the name and version of the operating system, the name and version of the browser, the date and time of the visit, the pages visited. This data may be aggregated such that the individual identities have been removed.
6. Biometric information: Genetic, physiological, behavioral, biological characteristics, activity patterns, fingerprints, eye scans, health, or exercise data.
7. Geolocation information: Physical location, movements, and mobile device unique identifier.
8. Financial information including as financial account information used for payment purposes and/or information that may be contained in a consumer report, bank account information.
9. Contact information for referrals.
10. Employment information: employment history, employee number, performance appraisals, salary and benefits, healthcare information, emergency contact information.
11. Protected class information: Age, race, color, national origin, citizenship, religion or creed, marital status, disability information, sex, genetic information, military or veteran status.

Children

SourceBlue’s services are not directed to persons under 13 years of age. We do not knowingly collect personal information from children under 13. If a parent or guardian becomes aware that their child has provided us with personal information without the parent’s consent, they should contact us at privacy@sourceblue.com. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete the information from our records.

How We Collect Information

1. When you visit our website, we may collect information about your visit.
2. Directly from clients, contractors, sub-contractors, vendors, employees, and job applicants.
3. From third parties including contractors, sub-contractors, government agencies.

Why We Collect It

We collect personal information to conduct our business activities. SourceBlue collects only the minimum amount of personal data required to fulfill these activities. These activities include:

1. Executing business activities, including completing our services.
2. Conducting marketing and promotional activities, including responding to inquiries about SourceBlue products or services, providing offers and information (as permitted by law) about products, services, or events offered by SourceBlue.
3. Improving the functionality, security, and usability of SourceBlue’s website.
4. Security, including monitoring log-in portals for access, validating identity, and preventing fraud.
5. Fulfilling a legal or contractual obligation.
6. Managing employee relationships, including the administration of benefits.
7. Processing job applications, including background investigations.
8. Validating identity for security to allow access to SourceBlue premises and job sites.
9. Complying with applicable laws or regulations.

SourceBlue will not use the personal data it collects for purposes other than those described above without notifying data subjects identified by the data.

We use the information you have given us in order to conduct business activities.

Information Sharing

SourceBlue may share this information with:

1. Other entities controlled by or under common control with SourceBlue, including all affiliated entities using the SOURCEBLUE® mark
2. Vendors
3. Service providers
4. Contractors or sub-contractors
5. Federal, state, and local governments

For the purposes of:

1. Fulfilling SourceBlue’s commercial, contractual, legal, and regulatory obligations.
2. Responding to subpoenas, court orders, or other lawful requests by public authorities, and to meet national security or law enforcement requirements.
3. Investigating illegal activities, suspected fraud, or as otherwise required by law or regulation. Centralizing SourceBlue’s administrative, IT maintenance, and IT security practices.
4. Providing information about SourceBlue products, services, or events.

Any third-party that receives personal information from SourceBlue may only process the information in accordance with applicable data processing agreements or contracts terms which require the third-party to protect the data and process it in a manner consistent with applicable privacy laws, regulations and SourceBlue’s policies and practices.

Third-Party Links

SourceBlue’s websites may provide links to other third-party websites that are outside of SourceBlue’s control and not covered by this Privacy Policy. SourceBlue is not responsible for the availability, content, or accuracy of third-party policies, nor is it responsible for the privacy practices of other websites, products, services, or goods that may be linked to SourceBlue’s websites. SourceBlue encourages all users of its websites to review the privacy policies posted on these (and all) sites.

SourceBlue takes the responsibility of keeping your information secure.

Storage

The security measures SourceBlue uses vary based on the sensitivity of the personal information we collect, process, and store, and the current state of technology. We also take measures to ensure service providers that process personal data on our behalf also have appropriate security measures.

Retention

SourceBlue retains Personal Data only as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or not prohibited by law. If you have consented to the processing of your Personal Data (“opt-in”), SourceBlue will retain and process your Personal Data until you withdraw your consent (“opt-out”), unless the Personal Data must be kept for administrative, legal, or regulatory purposes, as for the management of the right to object. If SourceBlue has not received your opt-in, SourceBlue will delete your Personal Data once the purpose of the collection and processing of such Personal Data has been fulfilled and the adequate duration for documentation and backup storage of such Personal Data has lapsed.

Disposal

Data is securely destroyed or disposed once it is no longer necessary to retain the data.

Security

SourceBlue has in place security policies that are intended to ensure the security and integrity of all Personal Data. SourceBlue has appropriate technical and organizational measures in place to protect against unauthorized or unlawful processing of Personal Data and against accidental loss or destruction of, or damage to, Personal Data held or processed by SourceBlue. If SourceBlue forwards Personal Data to any third party, SourceBlue requires that those third parties have appropriate technical and organizational measures in place to comply with this Privacy Policy and applicable laws.

You have certain rights for the collection, use, or dissemination of your Personal Data to the extent required by law as applicable to SourceBlue and your data.

Your Individual Data Subject Rights+

1. Right to request access to data: You have the right to ask for copies of your Personal Data.
2. Right to correction: You have the right to request correction of your Personal Data.
3. Right to deletion: You have the right to request that we delete your Personal Data.
4. Right to opt-out of communications: You have the right to opt-out from marketing communications. We provide an unsubscribe link in certain marketing communications. You may also request to opt-out of marketing communications via the data subject rights request process.

California Consumers: Data Subject Rights under the California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act of 2018 provides California consumers (California residents) with specific rights regarding their personal information. If you are a California resident, you have the rights under data protection law which are explained here.

You may exercise your data subject rights using any of the following methods:

1. Emailing privacy@sourceblue.com
2. Calling our toll-free number at 844-615-4259.
3. Mailing the request to the Privacy Officer at SourceBlue, 250 Pehle Ave, Suite 706, Saddle Brook, NJ 07663

We will verify your identity prior to completing these requests. Please provide sufficient information in your request for us to be able to reasonably locate our records about you and what actions you are requesting we take with regards to your data.

SourceBlue will respond as described below.

SourceBlue will deliver the required information within 30 days of a verifiable request, and you will receive notification if SourceBlue will need an additional 30 days to respond.

SourceBlue will provide response to requests for access to data in a written, readily usable format for data portability and free of charge to the consumer after SourceBlue receives a valid request.

You will receive your requested information either by your account, electronically, or via mail.

SourceBlue will not provide you with specific pieces of personal information if the disclosure would create a substantial, articulable, and reasonable risk to the security of the personal information, your account with the business, or the security of SourceBlue’s systems or networks.

SourceBlue will notify you when data has been deleted.

There may be circumstances where SourceBlue must deny your verified request because of a conflict with state law, federal law, or an exception to applicable privacy laws. If SourceBlue must deny a request accordingly, you will be informed and given the basis for the denial. If the request is denied only in part, SourceBlue will disclose the other information sought by you.

Cookies

For information on how we use cookies, please click here.

Sourceblue complies with legal frameworks for transferring data from the EU, UK and Switzerland.

SourceBlue complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. SourceBlue has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. SourceBlue has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles (collectively, “DPF Principles”), the applicable DPF Principles shall govern. To learn more about the Data Privacy Framework (“DPF”) program, and to view our certification, please visit Data Privacy Framework website.

The Federal Trade Commission has jurisdiction over SourceBlue’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Data Transfers to Third Parties

We are responsible for the processing of personal information we receive under the DPF Principles and subsequently transfer to a third party acting as an agent on our behalf. We shall remain liable under the DPF Principles if our agent processes such personal information in a manner inconsistent with the DPF Principles, unless we can provide that we are not responsible for the event giving rise to the damage.

Be advised that we may be required to disclose personal information in response to lawful requests by public authorities in the United States, including to meet national security or law enforcement requirements.

Your DPF Privacy Rights

You may have the right, under the DPF Principles, to access the personal information that we hold about you, and correct, amend, or delete that information where it is inaccurate, or has been processed in violation of the DPF Principles, subject to certain exceptions. You may also have the right to opt-out of having your personal information: (i) disclosed to a third party (other than parties that are acting as our agents to perform tasks on our behalf and under our instructions); or (ii) used for a purpose that is materially different from the purposes for which it was originally collected or which you subsequently authorized.

For more information about your DPF rights and/or to exercise such rights, please contact us at privacy@sourceblue.com

Resolution of DPF Complaints

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, SourceBlue commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact us at privacy@sourceblue.com .

Resolution by regulatory authorities

SourceBlue commits to cooperate and comply with the advice of the panel established by the EU data protection authorities, the UK Information Commissioner’s Office and the Gibraltar Regulatory Authority (GRA), and the Swiss Federal Data Protection and Information Commissioner, respectively and as applicable, with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Binding arbitration

Under certain conditions, you have the option to invoke binding arbitration for complaints regarding DPF compliance that remain fully or partially unresolved. For more information about the terms under which we are obligated to arbitrate claims, please see Annex I to the DPF

If you have any concerns or questions about anything in this Privacy Notice, please get in touch with us.

This website is owned and operated by SourceBlue.

We are registered in the State of New York.

Our principal place of business is:

SourceBlue 250

Pehle Ave, Suite 706

Saddle Brook, NJ 07663

Chief Privacy Officer contact information:

privacy@sourceblue.com

You can also contact us:

By mail:

Privacy Office

SourceBlue

250 Pehle Ave, Suite 706

Saddle Brook, NJ 07663

By telephone toll-free, at 844-615-4259