This Privacy Notice explains how CarbonAI (“we”, “us”, “our”) processes personal data about our business partners, clients, and suppliers across our websites, direct communications, and onboarding. It should be read alongside any service‑specific notices we provide from time to time.
We are committed to complying with applicable data protection laws in every country in which we operate. You can contact our Data Privacy Manager at support@carbonai.eco. You have the right to complain to your local data protection authority; however, please contact us first so we can try to resolve your concern quickly.
About CarbonAI
CarbonAI comprises the following entities: CarbonAI Limited, a company registered in England and Wales (No. 16735735).
Each entity acts as a controller where it determines purposes and means of processing for the clients it serves. Some entities may act as joint controllers for internal administration. To make it easy to exercise your rights, we provide a single point of contact via our Data Privacy Manager at support@carbonai.eco. Please keep us informed if your personal data changes during your relationship with us.
Personal Data We Collect
“Personal data” means information about an individual from which that person can be identified. It does not include anonymous data.
- a. Identity Data: first and last name, username, address, date/place of birth, marital status, title, gender, role, job title, legal identification documents, company name.
- b. Contact Data: business email/phone and records of business communications; information disclosed during onboarding.
- c. Transaction Data: invoices, payments, payment methods, time, place, price.
- d. Technical Data: IP address, browser type/version, time zone and location, plug‑ins, operating system and platform, and device information.
- e. Usage Data: information about how you use our websites.
- f. Marketing & Communications Data: preferences for receiving marketing and other services and your communication preferences.
We may create and use aggregated or anonymised data for any purpose. If we combine aggregated data with personal data such that it identifies you, we treat the combined data as personal data. We do not collect special category data (e.g., health, biometrics) or criminal offence data in this context. Our customers are professional organisations; where necessary to provide services, we may process personal data about individuals associated with those organisations (employees, service providers, consultants).
How We Collect Personal Data
- a. Direct interactions: enquiries about services, business dealings, online/paper forms, subscriptions, requests for marketing, feedback, and other correspondence.
- b. Automated technologies: Technical and Usage Data collected as you interact with our websites.
- c. Public/third‑party sources: Identity and Contact Data from publicly available sources (e.g., corporate sites, LinkedIn) and business partners.
How We Use Personal Data (Lawful Bases)
We only use personal data when the law allows. Common purposes include:
- a. Legitimate interests: participating in business communications; managing contractual/business relationships; sending corporate marketing and materials of potential interest; providing and improving services; training; information security; enforcing legal claims; and compliance with applicable laws (balanced against your rights).
- b. Legal obligations: sharing information where required to comply with legal/regulatory obligations in relevant jurisdictions.
- c. Other purposes: protecting vital interests; record‑keeping; hosting, back‑up, disaster recovery, and system restoration.
Generally, we do not rely on consent except for direct marketing. You can withdraw consent to corporate marketing at any time by emailing support@carbonai.eco.
Sharing Personal Data
- a. Within CarbonAI, with personnel who need access for the purposes described above.
- b. With regulators, tax authorities, law enforcement and fraud‑prevention agencies where required by law.
- c. With essential business service providers (e.g., KYC providers) and third‑party processors (e.g., IT hosting, payment providers, professional advisers) acting under contracts that protect your data.
- d. In limited circumstances connected with specific client instructions or supplier relationships.
- e. To protect rights, property, or safety of our business, employees, partners, or customers (including fraud protection and credit‑risk reduction).
- f. With group companies (as defined under UK Companies Act 2006 s.1159 and similar laws).
- g. In connection with corporate transactions (sale, merger, or acquisition), subject to appropriate data protection safeguards.
Storing Your Personal Information & International Transfers
CarbonAI Limited is subject to UK GDPR and the Data Protection Act 2018. The EU has adopted an adequacy decision for the UK.
We implement appropriate technical and organisational measures to secure personal data. We may use secure servers and reputable providers, including (by way of example) AWS, Microsoft, Adobe/Docusign, Atlassian Cloud, Mailchimp, and Zoho. Physical records may be stored at our offices. We remain responsible for the security of your personal data.
Your information may be stored and processed outside the UK/EEA. Where possible, we transfer to countries that benefit from an adequacy decision. Otherwise, we use appropriate safeguards such as the UK IDTA/EU SCCs or equivalent measures. Contact support@carbonai.eco for details.
Data Security
We operate an Information System Security Programme (ISSP) to protect confidentiality, availability, and integrity of information assets. Access to personal data is limited to those with a business need under confidentiality obligations. We maintain procedures to handle suspected personal data breaches and will notify you and regulators where legally required.
Data Retention
We retain personal data only as long as necessary for the purposes collected and to satisfy legal, accounting, or reporting requirements. We may retain data longer to comply with law, protect vital interests, or in connection with legal claims. We may create anonymised/aggregated records (not personal data) which we may retain indefinitely.
Retention periods consider the amount, nature, and sensitivity of the data; potential risks from unauthorised use/disclosure; the purposes of processing and whether they can be achieved by other means; and applicable legal requirements.
Your Legal Rights
Subject to conditions in law, you have the following rights:
- a. Right to rectification – correct inaccurate or incomplete personal data.
- b. Right of access – confirmation we process your data; access and a copy (subject to others’ rights); information about processing purposes, categories, recipients, retention, and safeguards.
- c. Right to be informed – clear information about processing, storage duration, legal bases, recipients, and whether provision is mandatory.
- d. Right to restrict processing – in certain cases (e.g., contested accuracy, unlawful processing, no longer needed, or pending objection assessment).
- e. Right to data portability – receive personal data in a commonly used, machine‑readable format and transmit to another controller where technically feasible.
- f. Right not to be subject to automated decision‑making (including profiling) producing legal or similarly significant effects.
- g. Right to object – to processing based on public interest or legitimate interests; we will stop unless we demonstrate compelling legitimate grounds or need to establish/exercise/defend legal claims.
To exercise your rights, contact support@carbonai.eco. We will verify your identity and may request further information to speed up our response. We aim to respond within one month, extending where permitted for complex or multiple requests.
You will not normally pay a fee. We may charge a reasonable fee or refuse requests that are manifestly unfounded, repetitive, or excessive.
Personal Data Concerning Others
If you share personal data about another individual with us, you should inform them, refer them to this notice, and (where possible) obtain permission to share their data with us.
Contact & Complaints
Data Privacy Manager:support@carbonai.eco
If you have questions or concerns about our use of your personal data, please contact our Data Privacy Manager. We will investigate and try to resolve complaints quickly and fairly.
We will update this page when policies change. Material changes will be communicated via the Platform or email.