PLATFORM TERMS & CONDITIONS

iStock / © Xavieramau

Terms & conditions for the use of our platform

Terms of Service

Last updated: 18 November 2025

Your use of the Platform (as defined below), including any products, software, data, information, reports and services made available to you on, from or through the Platform and its respective sub-domains, constitutes your consent to these Terms of Service.

By creating an account and ticking the box confirming that you have read and agree to these Terms of Service, you enter into a legally binding agreement (“Agreement”) with Roots of Impact GmbH.

If you do not agree to these Terms, you may not register for or use the Platform.

Definitions

Agreement: These Terms of Service, including future updates.

Platform: The ILF Transaction Hub.

Roots of Impact: Roots of Impact GmbH, referred to as “we”, “our” or “us”.

User: Any individual accessing or using the Platform, referred to as “you” or “your”.

Overview of the Platform

The ILF Transaction Hub is a transaction management platform that enables Users to manage, structure, and monitor Impact-Linked Finance (ILF) transactions, access related tools and resources, and collaborate with relevant stakeholders. The Platform facilitates transaction workflows and provides expert support features.

Eligibility

By using the Platform, you confirm that you are of legal age in your jurisdiction and capable of entering into this Agreement.

The Platform is intended exclusively for business users (“Unternehmer” as defined in §14 BGB). By registering, you confirm that you are acting in a professional or commercial capacity.

User Accounts

To obtain access to the Platform, you must create an account. You agree to:

Provide accurate information during registration.
Update your information as needed.
Keep your credentials confidential and notify us of unauthorized use.
You may not share your log-in credentials with others and/or share accounts with others. We reserve the right to terminate your account in case of account-sharing.

Access to the Platform is only granted after you have completed registration and confirmed your acceptance of these Terms by ticking the corresponding box.

If your account remains inactive for more than 12 months, we may archive or delete it after providing reasonable prior notice (at least 30 days).

User Conduct

When using the Platform, you must not:

Share harmful, illegal, or infringing content.
Impersonate others or misuse their accounts.
Attempt unauthorized access, modifications, or disruption of the Platform.
Use the Platform for fraudulent or deceptive purposes.
Use automated systems, bots, or scripts to access the Platform without our prior written permission.
Otherwise break any applicable laws and regulations when using the Platform.

Examples of violations:

Uploading copyrighted materials without permission.
Hacking or introducing malware.
Falsifying information for personal gain.

Data Collection and Privacy

Personal data is processed in accordance with our Privacy Policy, which forms an integral part of this Agreement. The Privacy Policy is available here.

Content Ownership and Licensing

User Content: You retain ownership of any content you upload or share on the Platform. By uploading content, you grant us a non-exclusive, worldwide licence to use such content solely to operate, maintain, and provide the Platform and related support services. Aggregated and anonymized data that cannot be linked back to you may be used to improve the Platform or to generate general market insights. No transfer of intellectual property rights occurs.
Platform Content: All platform content, including but not limited to software, text, and graphics, is owned by us or our licensors and protected by intellectual property laws. You may not copy, modify, or distribute Platform content without our prior written consent.

Payment and Transactions

The Platform may involve payments for services or products. By making a payment, you agree to:

Provide accurate payment information.
Authorize us to charge the specified amount to your payment method.

Refunds will be provided where required by applicable law or where the Platform fails to perform the services agreed. Additional refund requests will be evaluated on a case-by-case basis.

Unless stated otherwise, all fees are exclusive of applicable value-added tax (VAT), which will be charged at the statutory rate where required.

Termination

We may suspend or terminate your access for violating these Terms or harming the Platform. Upon termination:

Your personal data will only be retained as necessary to meet legal obligations.
You may request data retrieval before account deletion.

You can terminate your account by contacting transactionhub@roots-of-impact.org. Upon request, we will provide you with a copy of your data in a commonly used electronic format prior to deletion, unless legal retention requirements prevent such transfer.

Liability and Disclaimers

The Platform is provided „as is“ without guarantees of any kind, except as required by law. We guarantee a 98% availability of the software provided as SaaS on an annual average.

Nothing in these Terms limits our liability for intent, gross negligence, or injury to life, body or health.

For slight negligence, we are liable only in cases of breach of essential contractual duties. In such cases, liability is limited to typical and foreseeable damages.

We do not assume liability for loss of data to the extent such loss would have been avoidable through regular data backups within your area of responsibility.

Liability for the breach of non-essential duties is excluded.

Governing Law and Dispute Resolution

These Terms are governed by the laws of Germany, expressly excluding the UN Convention on Contracts for the International Sale of Goods. Any disputes arising under these Terms will be resolved in the courts of Frankfurt, Germany, as far as legally permissible. Where possible, disputes may first be resolved through alternative dispute resolution methods, such as mediation.

Changes to These Terms

We may update these Terms from time to time to reflect changes in legal requirements, improvements to the Platform, or new features. Any changes will be published on the Platform and you will be notified of material changes by email or through your user account.

Revised Terms will take effect no earlier than 30 days after notification unless a shorter period is required by law or the changes relate solely to the correction of typographical errors or the introduction of non-material clarifications. Your continued use of the Platform after the revised Terms take effect will be deemed acceptance of the updated Terms.

If you do not agree to the revised Terms, you may terminate your account before the changes come into effect. In this case, the version of the Terms applicable prior to the revision will continue to apply until termination is completed.

We will not make changes that materially alter the core contractual obligations without seeking your explicit consent.

Third-Party Services

We may use third-party service providers (subprocessors) to support the hosting, operation, and maintenance of the Platform. These providers act on our behalf and process data strictly in accordance with our instructions. A current list of subprocessors is available in our Privacy Policy or upon request.

Contact Us

For questions about these Terms or the Platform, contact us at transactionhub@roots-of-impact.org.

Privacy Policy

Last updated: 12 December 2025

Roots of Impact GmbH („we,“ „our,“ or „us“) is committed to safeguarding your privacy. This Privacy Policy outlines how we collect, use, and protect your data when you visit our website or use the ILF Transaction Hub (the “Platform”).

Controller and Contact Details

The controller responsible for processing personal data under Article 4(7) GDPR is:

Roots of Impact GmbH
Günthersburgallee 48
60316 Frankfurt am Main
Germany
Email: info@roots-of-impact.org

Roots of Impact is not legally required to appoint a Data Protection Officer. For all data protection matters, you may contact us at IT@roots-of-impact.org.

Scope of this Privacy Policy

This Privacy Policy applies to:

Website: Browsing activities, contact forms, newsletter registration, and hosting logs.

ILF Transaction Hub (Platform): Account creation, login activity, transaction management features, collaboration, and platform usage analytics.

Communications: Email correspondence, support requests, and marketing communications (where applicable).

This policy does not apply to third-party websites we link to. Please review their privacy policies separately.

Categories of Personal Data We Process

We only process personal data necessary for the purposes described below.

1. Data collected on the Website:

IP address and server logs
Browser type, device information, operating system
Newsletter subscription data: name, email address, organization
Data submitted through contact or registration forms

2. Data collected on the Platform (ILF Transaction Hub)

Account information: name, email address, username, password, organization, country, job title, city, ZIP code, state, contact number
Optional information provided: date of birth, gender
Platform activity logs: login timestamps, usage interactions, transaction-related data
Uploaded files or content: documents, text entries, comments

3. Communication Data

Emails and correspondence with us
Support requests
Metadata generated by such communications

How We Use Your Information

We process personal data only where permitted by GDPR.

Operating the Website

Providing website functionality and secure delivery
Managing hosting infrastructure (e.g., server logs)
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR): ensuring the security, stability and integrity of our website.

Operating the Platform

Creating and managing user accounts
Providing Platform features (e.g., transaction management, collaboration tools, workflows)
Ensuring security, monitoring access, preventing misuse
Legal basis: Performance of contract (Art. 6(1)(b) GDPR).

Newsletter Subscription

Sending newsletters and updates
Legal basis: Consent (Art. 6(1)(a) GDPR), where you have opted in.
Consent may be withdrawn at any time.

Improving and developing the Website and Platform

Usage analytics (aggregated)
Troubleshooting, system optimization
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR): improving our services and ensuring functionality.

Security and Fraud Prevention (Website and Platform)

Monitoring unusual or unauthorized activity
Protecting systems from bots, spam, and misuse (e.g., hCaptcha)
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR): ensuring the security, stability and integrity of our website and Platform.

Compliance with Legal Obligations (Website and Platform)

Fulfilling tax and commercial law retention obligations
Responding to lawful requests from authorities
Legal basis: Fulfilment of legal obligation (Art. 6(1)(c) GDPR).

Data Sharing and Disclosure

We do not sell or rent your personal data. Data may be shared in the following circumstances:

With Service Providers: Third-party vendors supporting processing, analytics, or hosting services.
With Users: Aggregated and anonymized usage data may be shared to facilitate collaboration and insights.
As Required by Law: To comply with legal obligations or protect our legal rights.

Where service providers act as our processors, they are bound by data processing agreements in accordance with Article 28 GDPR.

Specific Service Providers

We use the following service providers to operate our website and the ILF Transaction Hub. These providers act as processors under Article 28 GDPR and process personal data strictly in accordance with our instructions:

Strato AG (Website Hosting)

Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, hosts our website and processes server log files (including IP addresses) to ensure secure and reliable website delivery.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) in providing a secure and stable website

Strato’s privacy notice: https://www.strato.de/datenschutz/

WordPress (Website Content Management)

Automattic Inc, 60 29th St, San Francisco, CA 94110, US. Our website and certain registration or content features are operated using WordPress, provided either as software or via services of Automattic Inc. WordPress processes data such as IP addresses, form content, and technical metadata to deliver website content and handle forms.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) in operating and maintaining a modern, functional website.

WordPress’s Privacy policy: https://wordpress.org/about/privacy/

We use the “User Registration & Membership for WordPress” plugin to manage user registration and profile creation on the Platform. The plugin operates entirely within our WordPress hosting environment and does not transmit personal data to the plugin developer or any external service. All registration data is processed and stored on our servers only.

Legal basis: Art. 6(1)(b) GDPR (contract performance); Art. 6(1)(f) GDPR (legitimate interests in secure user management).

Mailchimp (Email and Newsletter Service)

Intuit Mailchimp 405 N Angier Ave. NE Atlanta, GA 30308 USA. We use Mailchimp, a service provided by Intuit Inc., to manage and send newsletters and certain email communications. Mailchimp processes your email address and, where provided, your name and organization.
Legal basis: Consent (Art. 6(1)(a) GDPR) for newsletter communications; legitimate interests (Art. 6(1)(f) GDPR) for essential service-related communications where applicable.

Mailchimp’s Privacy Policy: https://www.intuit.com/privacy/statement/

Hochhuth Consulting GmbH (Platform Development & Maintenance)

Hochhuth Consulting GmbH, Christinenstr. 16, 10119 Berlin, provides technical development and maintenance services for the Transaction Hub and may access personal data solely for technical support purposes. We have entered into a Data Processing Agreement with Hochhuth Consulting GmbH.

Legal basis: Performance of contract (Art. 6(1)(b) GDPR); Legitimate interests (Art. 6(1)(f) GDPR) in operating a secure and functional platform.

hCaptcha (Bot Prevention Tool)

We use hCaptcha, provided by Intuition Machines, Inc., 2211 Selig Drive, Los Angeles, CA 90026, USA, to protect the Platform against abusive automated access. hCaptcha analyzes user interactions (e.g., IP address, cursor movements) to distinguish automated from human behaviour.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) in preventing misuse and ensuring platform security.

hCaptcha’s privacy policy: https://www.hcaptcha.com/privacy

Data Storage and International Transfers

Where possible, data is stored on servers located in Germany. Where personal data is transferred outside the EU/EEA, we ensure an adequate level of protection through:

An adequacy decision (e.g., EU-US Data Privacy Framework for certified providers)
Standard Contractual Clauses (SCCs) approved by the European Commission
Additional safeguards where required

You may request copies of applicable safeguards at any time.

Data Rentention

We retain personal data only as long as necessary for the purposes described above or where legally required.

Platform account data: Retained for the duration of your account.
Deleted accounts: Retained for up to 6 months, unless other legal retention periods apply.
Contractual and billing records: Retained for 6–10 years under German tax and commercial law.
Newsletter subscriber data: Retained until consent is withdrawn.
Server logs: Typically retained for 30 days, unless needed for security or legal reasons.
Aggregated/anonymized data (non-personal): Retained indefinitely.

Your Rights under GDPR

As a User you have the following rights:

Right to Access (Art. 15 GDPR): Request details of your data held by us.
Right to Rectification (Art. 16 GDPR): Update inaccurate or incomplete data.
Right to Deletion (Art. 17 GDPR): Request the deletion of your data (subject to legal obligations).
Right to Restriction of Processing (Art. 18 GDPR): Limit data processing in specific circumstances.
Right to Data Portability (Art. 20 GDPR): Receive your data in a structured format for transfer to another service.
Right to Object (Art. 21 GDPR): Withdraw consent for marketing communications or object to processing based on legitimate interests.

To exercise these rights, contact us at IT@roots-of-impact.org.

You also have the right to complain to a data protection supervisory authority about the processing of your personal data. Contact details of the data protection supervisory authorities are available at https://www.bfdi.bund.de/EN/Service/Anschriften/Laender/Laender-node.html.

Provision of Personal Data and Consequences of Non-Provision

Where personal data is required for:

Contract creation (Platform account)
Platform access
Legal compliance

failure to provide it will result in the inability to create or use a Platform account. There is no obligation to provide optional information, and choosing not to do so has no negative consequences.

Security

We implement appropriate technical and organizational measures to protect your personal data, including:

Encryption
Access controls
Secure authentication
Regular security and compliance audits

No system is completely secure. Users are responsible for keeping account credentials confidential.

Automated Decision-Making

We do not perform automated individual decision-making or profiling within the meaning of Article 22 GDPR.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, improvements to the website or Platform, or new features. Any changes will be published on the Platform, and you will be notified of material changes by email or through your user account.

Revisions to the Policy will take effect no earlier than 30 days after notification unless a shorter period is required by law or the changes relate solely to the correction of typographical errors or the introduction of non-material clarifications. Your continued use of the Platform after the revised Policy takes effect will be deemed acceptance of the updated Privacy Policy.

If you do not agree to the revisions, you may terminate your account before the changes come into effect. In this case, the version of the Privacy Policy applicable prior to the revision will continue to apply until termination is completed.

Contact Us

For questions or data protection requests, contact: IT@roots-of-impact.org