Privacy statement of Hedgehog

Updated on: 11th of Novembre 2025

This Privacy Statement describes how Hedgehog Company B.V. and Hedgehog Impact Software B.V. (“we”, “us”, or “our”) process personal data in connection with the use of our website hhc.earth and the Hedgehog Carbon Platform (the “Platform”). Both entities are registered in the Netherlands at Donauweg 10-22, 1043 AJ Amsterdam.

We are committed to protecting your personal data and ensuring transparency about how we collect, use, and store it in compliance with the General Data Protection Regulation (GDPR).

Relationship between entities

Hedgehog Company B.V. is the data controller for personal data collected through the website hhc.earth, including contact forms, downloads, and marketing communications.

Hedgehog Impact Software B.V. is the data controller for personal data processed through the Hedgehog Carbon Platform, including user accounts, platform activity, and payment-related information.

The two entities may share data internally where necessary for operational or contractual purposes (for example, to provide user support or manage billing), under a joint controller arrangement that ensures consistent protection of your data across both services.

1. Personal data we collect

We may collect and process the following categories of personal data:

• Contact information: name, email address, and company details when you download knowledge resources or contact us via the website.
  
  
• Account data: email address when you create an account on the Hedgehog Carbon Platform (authentication is handled via OAuth 2.0 through Auth0; no passwords are stored).
  
  
• Payment data: payment information when you purchase a paid licence through Stripe.
  
  
• Technical data: IP address and activity data collected for analytical and security purposes, as described in our Cookie Statement.

2. Purposes and legal bases for processing

We process personal data for the following purposes and corresponding legal bases:

Purpose - Legal basis

Website and platform analytics - Legitimate interest (optimising and improving our services)

Logging of errors and performance in the platform - Legitimate interest (ensuring system stability and security)

Creating and managing user accounts on the Platform - Performance of a contract

Providing requested knowledge resources and communications - Consent (via website form submission)

Communicating updates and service information - Legitimate interest (informing existing users and clients)

Processing payments - Performance of a contract

3. Data sharing with third parties

We only share personal data with third-party service providers where necessary to deliver our services, subject to appropriate data processing agreements. These include:

• Auth0 – for secure authentication (OAuth 2.0).
  
  
• Stripe – for payment processing.
  
  
• Mandrillapp – for sending transactional emails (e.g. login codes).
  
  
• ActiveCampaign – as our CRM and communication tool.
  
  
• Google Analytics, Microsoft Clarity, and Inspectlet – for website and platform analytics.
  
  
• Google Cloud Platform – for hosting and data storage.
  
  

We do not sell or trade your personal data.

4. Data storage and retention

Personal data is stored within the services mentioned above and is not duplicated elsewhere.
We do not retain personal data longer than necessary for the purposes stated in this Privacy Statement.
Analytical and transactional data are typically retained for no longer than 90 days, unless a longer retention period is required for contractual or legal reasons.

5. International data transfers

Where data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as the use of Standard Contractual Clauses approved by the European Commission.

6. Your rights

You have the right to:

• Access the personal data we hold about you.
  
  
• Request correction or deletion of your personal data.
  
  
• Object to or restrict certain processing activities.
  
  
• Withdraw consent at any time (where processing is based on consent).
  
  
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe your rights have been violated.

Requests regarding your data can be submitted by contacting us at info@hhc.earth.

7. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. This includes the use of secure hosting environments, two-factor authentication, and access restrictions based on the principle of least privilege.

8. Updates to this Privacy Statement

We may update this Privacy Statement from time to time. The most recent version will always be available on our website. Material changes will be communicated where appropriate.

For any questions about this Privacy Statement or our data protection practices, please contact:
Hedgehog Company B.V. / Hedgehog Impact Software B.V.
Donauweg 10-22, 1043 AJ Amsterdam
Email: info@hhc.earth

‍