Privacy Policy

1. Introduction

At CarbonVerified.uk (a trading name of Paul Jacobs), we value your privacy. We process your data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) under registration number: ZC088609.

2. Data We Collect

We collect only the information necessary to provide our certification service:

3. How We Use Your Data

We use your information to provide, maintain, and improve our services, specifically:

• Service Delivery: Calculating emissions and generating your Verified Carbon Reports.
• Essential Communications: Sending account verification links, security alerts, and password reset instructions.
• Service Reminders (Planned Feature): Sending monthly reporting prompts to PRO users (can be managed in account settings).

4. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

• Contract Performance (Article 6(1)(b)): To provide our carbon reporting service, manage your account, and process your subscription payments.
• Legitimate Interests (Article 6(1)(f)): To improve our platform, monitor system security, and send essential service updates.
• Consent (Article 6(1)(a)): For analytics cookies and any optional marketing communications. You may withdraw consent at any time.
• Legal Obligation (Article 6(1)(c)): To comply with tax, accounting, or regulatory requirements.

5. Data Retention

We retain your data only for as long as necessary to fulfil the purposes outlined in this policy:

• Account Data: Retained for the duration of your active account. Upon account deletion, personal data is permanently erased within 30 days.
• Carbon Reporting Data: Retained for the duration of your account to maintain historical reporting. Deleted upon account closure unless a longer retention period is required by law.
• Payment Records: Retained for 7 years as required by UK tax and accounting regulations (HMRC).
• Server Logs: Automatically purged after 90 days.

6. Third-Party Processors

We share data with trusted third parties strictly for operational purposes:

• Stripe: Payment processing. We do not store your full card details. Stripe Privacy Policy.
• Google Authentication: Secure sign-in and account management. Google Privacy Policy.
• Google Gemini API: Used to generate AI-assisted carbon compliance analysis reports. Data submitted for analysis (such as tender descriptions and company context) is processed under Google's data processing terms. No personal data beyond business context is submitted to this service. Google Privacy Policy.
• Google Analytics: Anonymous usage statistics to help us improve the platform. Usage data may be transferred to the United States under the UK-US Data Bridge adequacy regulations. Google Privacy Policy.

Where we act as a Data Processor on your behalf (for example, when you submit employee personal data such as commuting or travel records), a Data Processing Addendum (DPA) compliant with UK GDPR Article 28 is available and incorporated into our Terms of Service. Please contact support@carbonverified.uk for a copy.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: You can request a copy of all data we hold about you.
• Right to Erasure ("Right to be Forgotten"): You can ask us to delete your account and all associated data permanently.
• Right to Rectification: You can correct incomplete or inaccurate data via your dashboard.
• Right to Restrict Processing: You can request that we limit the processing of your data in certain circumstances.
• Right to Object: You have the right to object to the processing of your data where we rely on legitimate interests as our lawful basis.
• Right to Data Portability: You can request a machine-readable copy of the data you have provided to us.

8. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113