Privacy Policy

Who this Policy covers. Marketplace users (buyers, sellers/project developers, brokers), enterprise clients and their authorized users, vendors, site visitors, job applicants, and B2B prospects.

Affiliates. Our affiliates may process data on our behalf under this Policy and applicable DPAs.

Sensitive Data. We avoid collecting special category data unless required (e.g., sanctions checks) and will seek additional safeguards/consent where legally necessary.

Sources: You; your employer; counterparties; verifiers/registries; KYC/AML and fraud- prevention providers; PSPs; MRV partners; public records; events; cookies/SDKs.

* We reference GDPR-style bases; local laws (e.g., India DPDP Act, CCPA/CPRA) are addressed in the Regional Addenda below.

Automated Decisions/Profiling: We may use automated checks (e.g., sanctions matches, risk scores) to flag activity for human review. We do not make solely automated decisions that produce legal or similarly significant effects without a path for human intervention where required by law.

We use strictly necessary cookies (auth, security), functional cookies (preferences), analytics (product usage), and advertising (B2B remarketing where permitted). You can manage preferences via our Cookie Settings (CMP) and/or your browser. See our separate Cookie Policy for details.

We do not sell Personal Data. We disclose only as needed:

• Service Providers / Sub-processors: cloud hosting/CDN, database and storage, analytics, email/SMS, customer support tools, KYC/AML, payment processors, e-signature, document management, security monitoring. Bound by confidentiality and DPAS.
• Verification & Registry Partners: accredited verifiers (VVBs), standards/registries to validate projects, issue/retire credits.
• Counterparties: as necessary to settle marketplace transactions and provide proof of ownership/retirement.
• Professional Advisors: auditors, accountants, lawyers, insurers.
• Regulators & Law Enforcement: where required by law or to defend our rights/users' safety.
• Corporate Transactions: merger, financing, acquisition, or bankruptcy-data transfers subject to this Policy and notice.

We maintain a current Sub-processor Overview at: [https://carbclex.com/legal/subprocessors] (update this path) and will notify material changes as required.

We operate globally. Where data moves across borders, we rely on recognized transfer mechanisms (e.g., SCCs under GDPR, country-specific adequacy, contractual safeguards). For India's DPDP Act, cross-border transfers comply with government notifications and contractual protections. We implement defense-in-depth security and access controls regardless of location.

We employ organizational and technical measures appropriate to the risk, including:

• Role-based access control (RBAC), MFA for privileged access, least-privilege, secure SDLC.
• Encryption in transit (TLS) and at rest for core data stores.
• Network segmentation, WAF, DDoS protection, and continuous monitoring.
• Vendor risk management and sub-processor DPAs.
• Audit logging and tamper-resistant trails for key transactions (e.g., issuance/retirements).
• Employee training, background checks where permissible, confidentiality agreements.
• Incident response and breach notification procedures aligned with applicable laws.

No system is 100% secure. If we discover a breach impacting your data, we will notify you and regulators as required.

We retain Personal Data only as long as needed for the purposes above or as required by law/regulators, then delete or irreversibly anonymize.

Where retention mandates differ, we follow the longest applicable legal requirement.

Your rights depend on your location and role (data subject vs. enterprise client admin). Generally, you may request: access, correction, deletion, restriction, objection (to certain processing/marketing), and portability. You can also withdraw consent where we rely on consent.

• Marketplace/Direct Users: submit requests via [email protected] or the in-product privacy portal [link].
• Enterprise Users: please contact your employer (the Controller) first; we will support them as Processor.
• Marketing Opt-Out: use unsubscribe links or email us.

We will verify identity before fulfilling requests and respond within legal timeframes.

Our Services are for business and professional use and are not directed to children under 18. We do not knowingly collect children's data.

We may disclose data if legally required (court order, warrant, regulator demand). Unless prohibited, we will notify affected customers before disclosure and limit scope to what is legally compelled.

We may update this Policy to reflect operational, legal, or regulatory changes. We will post updates here and, for material changes, provide additional notice (e.g., email or in- product). Continued use after the effective date constitutes acceptance.

Data Protection Contact / DPO:

For EU/UK: If required, we will appoint an EU/UK Representative and publish details here.

For India: Our Data Protection Officer (if mandated under DPDP rules) will be listed here.

These summaries do not limit your rights under applicable law; where there is a conflict, local law prevails.

When acting as Processor, we will:

1. process Personal Data only on your documented instructions;
2. maintain confidentiality and require the same from personnel;
3. implement appropriate technical and organizational measures;
4. assist with data subject requests and DPIAS;
5. inform you of sub-processors and obtain appropriate flow-down commitments;
6. notify you without undue delay of data incidents;
7. delete or return data at termination, subject to legal retention;
8. make available information for audits subject to confidentiality and reasonable limits.

For full details, see our Data Processing Addendum (DPA): [https://carbclex.com/legal/dpa] (replace with actual URL).

• Privacy & Security Settings: MFA, IP allowlists, SSO/SAML, session timeouts.
• Data Minimization: field-level controls for user roles; project-level redaction for public artifacts.
• Transparency: downloadable audit trails for bids, issuances, and retirements.
• Data Portability: export emissions datasets and certificates in standard formats (CSV/JSON/PDF).
• Cookie Choices: fine-grained toggles for analytics/ads SDKs.

• Personal Data/Personal Information: any information that identifies or relates to an identifiable person.
• Processing: any operation performed on Personal Data (collection, storage, use, disclosure, deletion).
• Controller/Fiduciary | Processor: the party determining "why/how" vs. the party processing on instructions.
• MRV: measurement, reporting, and verification data supporting carbon claims.