CO2 AI Privacy Policy

Who we are

This is the Privacy Policy for The Boston Consulting Group, Inc. and its affiliates (“BCG” or “we”). This privacy policy was last updated in December 2022. For more detail on BCG’s international operations please see

Applicability of this Privacy Policy

This Privacy Policy applies only to your use of the CO2 AI website by BCG (“Site”) which is a website to inform potential clients about the tool’s features and collect interest from them through a “request demo form”

Important information about this Privacy Policy

BCG understands that your privacy is important. BCG is committed to protecting your privacy and personal data you provide in relation to your access and use of the Site. This Privacy Policy (together with the Terms of Use, which you will also have been asked to agree to, and any additional terms of use incorporated by reference into the Terms of Use) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. This Site is not intended for and does not intentionally target or solicit to children or anyone of 18 years of age and younger. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.


Changes to this Privacy Policy

Please note that BCG may, in its discretion, amend this privacy policy from time to time. To ensure you are able to remain informed about the information we collect and how we use it, material changes to our statement will be reflected here and we will notify you whenever we make a material change to this Privacy Policy. The Site may contain links to external sites or services which are not governed by this Privacy Policy. We encourage you to review the privacy and cookie policies of any such sites before you submit information there.


The data we collect about you

We may collect, use, store and transfer the following personal data about you, which is your name, business email address, device information (DeviceID, Device Name), browser information (BrowserID, Browser Name), IP address, geolocation through IP addresses, user activity.

We also collect, use and share aggregated data such as statistical data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate the data relating to details of your use of the website to calculate the percentage of users accessing a specific feature. However, if we do ever combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.


Authentication through Okta

In order to use the Site, where applicable, you may need to authenticate with the third-party provider Okta Inc. (301 Brannan St Ste 300, San Francisco, CA 94107) with your personal username and a personal password. To do this, download the Okta Verify app and perform the authentication process. The regulations and data protection declaration of Okta, Inc. apply. We have no influence on and are not responsible for the data collection by Okta Inc. Your data will be processed exclusively for the purpose of authentication. After successful authentication you will receive personal access to our app. Here you register once with your e-mail address.


How your personal data is collected

We will collect and process the following data about you:

  • Information you give us. This is information you consent to giving us when you submit request demo form (your name and email address), or by corresponding with us (for example, by email). It includes information you provide when you request a demo or when you report a problem with the Site. If you contact us, we will keep a record of that correspondence.
  • When you register to the emailing list. We may collect your personal data where you subscribe to join our email list while you submit the request demo form.



BCG may use cookies on this Site and in our communications with you to keep track of your visit to our Site and our communications with you. A “cookie” is a small amount of data sent from a Web server to your browser and stored on your computer’s hard drive. Other tracking technologies work similarly to cookies and place a small amount of data on your devices to monitor your website activity to allow us to collect information about how you use our Site and our services. With most internet browsers, you can erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored on your computer. Please refer to your browser instructions or you can visit which will give you more information. Once you have given your consent to use non-essential cookies we shall store a cookie on your computer or device to remember this for next time. If you wish to withdraw consent at any time you will need to delete our cookies using your web browsers settings. Please be advised that certain sections or functionalities of the Site may be inaccessible to you if your browser does not accept cookies. We do not currently respond to browser do-not-track signals.

To view a detailed list of cookies used on the Site, click here.


  1. Purposes for use Of your personal data

We process your personal information for the following purposes:

  • Corresponding with you (by phone or email)
  • Monitoring usage of the Site;
  • Providing you support related to accessing and using the Site
  • Improving the Site content and navigation; informing you about updates to the Site
  • Tailoring and personalizing the Site and its content, improving the Site and service experience, conduct research to improve Site conversion and interaction content, improving navigation, improving search results, recommending content based on industry/company/interest/location/searches, improving/understanding needs for existing service improvements/roadmaps, developing new services
  • Informing the user about updates to the Site
  • Understanding the user population; determining whether the Site is designed to work with the Device settings of a majority of users
  • Sending marketing communications via emails, from CO2 AI by BCG based on your consent where required.


How your personal data is USED

We process your personal information for the purposes described above and most commonly we will use your personal data in the following circumstances:

  • Where you have consented before the processing
  • Where we need to perform a contract we are about to enter or have entered with you (including where necessary to use the Site)
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and
  • Where we need to comply with a legal or regulatory obligation

Insofar as you have granted us consent to the processing of personal information for specific purposes (including registration on the Site), the lawfulness of such processing is based on your consent. You may withdraw your consent to the extent permitted by applicable law, by sending an email to:

Disclosure of Personal Data

The information you provide will naturally only be used for the purposes explained under this Privacy Policy and will not be disclosed to third parties. However, given the global nature of BCG, Personal data may be processed at various locations where BCG conducts business, including in the United States and other countries as well as to external service providers appointed by BCG or another BCG company to perform IT services, IT infrastructure, business, administrative, and management functions for BCG and cloud storage capabilities e.g. BCG maintains and stores personal information in systems and applications located in Europe and the United States, and the personal information is only accessible by authorized persons or vendors who are bound by privacy requirements. BCG appreciates the confidential nature of personal data and discloses it only as necessary for BCG’s valid business purposes or as required by law as described herein, although whenever possible to do so, information will be anonymized prior to its production.

We may also disclose your Personal Data to law enforcement agencies, courts, other government authorities or other third parties where we believe necessary to comply with a legal or regulatory obligation. Further we may disclose your Personal Data to potential transaction partners, service providers, advisors, and other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell or transfer all or a portion of our assets or business. Should such a sale or transfer occur, we will use reasonable efforts to obligate the entity to which we transfer your Personal Data to use it in a manner that is consistent with this Policy.


Choices Regarding Disclosures

BCG does not disclose your personal data for purposes not described herein or to unaffiliated third parties for commercial or marketing purposes. BCG allows individuals to “opt out” before commencing any such disclosure in the future.


Data Retention

Personal data will only be kept as long as is reasonably necessary to fulfil the purpose for which it was collected. We may retain your personal information for longer if they may be the subject of a legal claim, or may otherwise be relevant for future litigation.

In some circumstances we will anonymise and/or aggregate your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.


International Data Protection Standards

With respect to personal data about you residing in the EEA and UK, BCG adheres to legitimate cross-border data transfer mechanisms (namely Standard Contractual Clauses approved by the European Commission) and the principles of applicable data protection laws. Accordingly, third parties obtaining access to personal data about you for purposes of performing services for or on behalf of BCG, are required to assure BCG in writing that they will provide at least the level of privacy protection as BCG provides e.g. the appropriate safeguards have been put in place.


Data security

BCG handles personal data in accordance with BCG procedures to protect the integrity and security of the personal data, including conducting periodic reviews of personal data quality, purging obsolete information, and imposing security measures such as industry-standard technical, physical and administrative safeguards. We have taken extensive technical and operational precautions to protect your data from accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security procedures are regularly reviewed and adapted to technological progress.


Your rights

In accordance with applicable data protection laws, you have the right to access your personal data, you have a right to request a copy of the personal information we hold about you and details of how we use that information. If any of the information held about you is incorrect or out of date, you have the right to amend or rectify it. Please follow the process outlined below and we will amend our records where appropriate. You also have the right to require us to erase your personal data, stop processing your personal data, restricting the processing of your personal information, right of portability of your personal information, right of not be subject to automated decision making, including profiling and/or to withdraw your consent to processing. This may not apply if there are other legal justifications to continue processing.

If you think we may have incorrect personal information, or would like a copy of the personal information we hold on you, or to exercise any other data protection right, please contact us on our point of contacts below. Please note that we need you to prove who you are before we can provide you with any information. You also have a right to lodge a complaint with your local supervisory authority.


If you have further questions on the topic of data protection, please contact us. For questions regarding the processing of your personal data, regarding access, rectification, blocking/restriction of processing or erasure of data, data transferability, objection to data processing and revocation of given consents, please contact us via:

Data Protection Office
Boston Consulting Group Inc.
200 Pier Four Boulevard
Boston, MA 02210
Contact Us


As required by the California Privacy Laws, this Privacy Policy describes the categories of personal data collected, processed, and disclosed by BCG, the categories of sources for that data, and the business or commercial purposes for which that data is collected, processed, and disclosed.

If you are a California resident, please see the California Addendum.

Data Protection Officer (Der Datenschutzbeauftragte)
Boston Consulting Group GmbH
Ludwigstrasse 21
80539 Munich Germany
Contact Us