Privacy Notice CarbonPay

Contents

1. Personal Data We collect
   1. Information you give us
   2. Information we collect about you
2. General Use and Legal Basis
   1. Automated Decision-Making and Profiling
3. Disclosure of Your Personal Data
4. Where We Store Your Personal Data and How We Protect it
5. Your Rights
6. International Transfers of Personal Data
7. How Long We Keep Your Personal Data
8. Changes to our Privacy Notice
9. Cookie Policy
10. FAQ’s
11. Contact Details

CarbonPay Limited (referred to and trading as “CarbonPay“, or “we” or “our” in this Notice) is committed to respecting the privacy of individuals, including its clients. CarbonPay is a company registered in England under company number 12934414, and whose registered office is at 3 Park Court Pyrford Road, West Byfleet, Surrey, KT14 6SD, England. CarbonPay owns and operates this website: https://carbonpay.io.

CarbonPay is a Fintech company focused on providing specialised payment solutions for niche industries. Designed for seamless integration with your existing tech infrastructure. With our API suite, most of the development work is handled on our end, allowing your company to integrate our solutions quickly and effortlessly or bespoke them to your requirements.

This Privacy Notice (“Notice”) applies to visitors of our website and individuals who subscribe to our newsletter. It explains how we collect, use, and protect your personal data when you browse our site or interact with us for marketing purposes. It does not apply to the processing of personal data related to the provision of our services to clients or partners. That processing is governed by separate contractual agreements and service-specific privacy terms, where applicable.

Please read the following carefully to understand our views and practices regarding how we handle personal data. For the purposes of applicable data protection law (in particular, the retained EU law version of the General Data Protection Regulation ((EU) 2016/679) (UK GDPR) and the Data Protection Act 2018, CarbonPay is the “data controller” of your personal data.

Personal Data We collect

We may collect and process the following personal data:

Information you give us:

In order to set up your account with us and for us to perform our contract with us, we may process the following personal data which you provide to us:

• Identity data – including first name, last name, role in organisation and business name (in case of corporate applications)
• Contact data – including address, e-mail address and phone number.

Information we collect about you:

With regard to each of your visits to our website we may collect the following information:

• technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform; and
• information about your visit; products, services or issues you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the website. This information is collected by using cookies and similar technologies. Please see our cookie policy below for further details.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Notice.

We do not currently collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

General Use and Legal Basis

We use your personal data:

• To manage our relationship with you when you subscribe to our newsletter, including:
  • Sending you the content you’ve requested;
  • Notifying you about updates, new services, or relevant insights;
  • Enabling you to manage your preferences or unsubscribe at any time.
• Where necessary for our legitimate interests, including:
  • Using cookies and analytics tools to understand how users interact with our website and email campaigns, so we can improve content relevance and user experience;
  • Improving the quality of experience when you interact with our services.
• For purposes which are required by law, including:
  • Responding to requests by government or law enforcement authorities conducting an investigation;
  • Maintaining records for accountability and compliance with data protection laws.

Automated Decision-Making and Profiling

We do not use solely automated decision making or profiling.

Disclosure of Your Personal Data

We may share your personal data with :

• Analytics and search engine providers that assist us in the improvement and optimisation of our website.

We do not provide your information for marketing purposes or to marketing companies.

Moreover, we may disclose your personal data to third parties:

• If we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets;
• If CarbonPay, its business, or its assets are acquired by a third party, in which case personal data held by it about its users, suppliers, or customers will be one of the transferred assets; and
• If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms and conditions and other agreements; or if we reasonably consider this necessary; or to protect the rights, property, or safety of CarbonPay, our users, our customers, or others.

Where We Store Your Personal Data and How We Protect it

We take appropriate technical and organisational measures to protect your personal data from loss, misuse, and unauthorised access. Please note that while we do our best to safeguard your information, transmitting data over the internet is not completely secure. Any data you send to us is at your own risk. Once received, we use security measures to help protect it.

Your Rights

You have various rights with respect to our use of your personal data:

• Right ofAccess: You have the right to request a copy of the personal data that we hold about you. Please note that there are exceptions to this right, so that access may be denied if, for example, making the information available to you would reveal personal data about another person, or if we are legally prevented from disclosing such information. You are entitled to see the personal data held about you. If you wish to do this, please contact us using the contact details provided below.
• Right to Rectification: We aim to keep your personal data accurate, current, and complete. We encourage you to contact us using the contact details provided below to let us know if any of your personal data is not accurate or changes during your relationship with us, so that we can keep your personal data up-to-date. You can also review and correct/ update some of your personal data by logging-in to your account on our website.
• Right to Object: In certain circumstances, you also have the right to object to processing of your personal data and to ask us to block, erase and restrict your personal data. If you would like us to stop using your personal data, please contact us using the contact details provided below.
• Right to Data Portability: You have the right to request that some of your personal data is provided to you, or to another data controller, in a commonly used, machine-readable format.
• Right to Erasure: You have the right to erase your personal data when the personal data are no longer necessary for the purposes for which they were collected, or when, among other cases, your personal data have been unlawfully processed.
• Review of Automated Decision-Making: You have the right to request a manual review of any decision made based solely on automated processing of your personal data (i.e. where no human has yet reviewed the criteria or outcome for the decision) in circumstances where the decision has a legal or similarly significant effect on you.
• Complaints: If you believe that your data protection rights may have been breached, you have the right to lodge a complaint with the applicable supervisory authority or to seek a remedy through the courts. The relevant supervisory authority in the United Kingdom is the Information Commissioner’s Office (ICO) at www.ico.org.uk. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first.

You are not required to pay any charge for exercising your rights. You can exercise any of the above mentioned rights by emailing us at: [email protected].

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

International Transfers of Personal Data

Some of our service providers are outside the UK/EU (e.g. US-based cloud platforms). Where this occurs, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions).

How Long We Keep Your Personal Data

We will retain your personal data, whether or not your account is active, for as long as we believe it necessary or desirable to fulfil our business purposes or to comply with applicable law, audit requirements, regulatory requests or orders from competent courts.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.