Privacy & Cookie Policy.

Carbon Global respects your privacy and is committed to handling personal data responsibly, transparently and in accordance with applicable data protection laws. This Privacy & Cookie Policy explains what personal data we collect through deploycarbon.com (the "Site") and through our advertising on third-party platforms, how we use it, who we share it with, how long we keep it, the rights you have, and how we use cookies and similar technologies. It also covers people at businesses we contact who have not contacted us first.

This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and the Estonian Personal Data Protection Act.

1. Controller

For the purposes of GDPR and UK GDPR, the controller of your personal data is:

Carbon Global OÜ
Address: Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond 15551, Estonia
Privacy contact: privacy@deploycarbon.com
Phone: +44 7413 336636

Carbon Global has not appointed a Data Protection Officer because its activities do not meet the mandatory designation criteria set out in Article 37 GDPR. Privacy enquiries are managed by the Legal team.

2. Website Development and Hosting

This Site is developed and maintained by Carbon Global OÜ. The Site is hosted on Vercel.

3. Personal Data We Collect

We collect personal data in the following categories.

Information You Provide Directly

• Identity and contact details: name, job title, business email address, telephone number and company name when you complete a contact form, request information or download gated materials such as guidebooks.
• Lead forms on Meta platforms: when you respond to one of our adverts on Facebook or Instagram and complete a lead form, Meta passes us the details you submit, such as your name, business email address, company name, job title and your answers to our questions.
• Professional context: information you choose to share about your role, company size, region, project requirements or current operations.
• Communications: the contents of emails, messages and forms you send to us, including any documents or attachments.
• Marketing preferences: your consent and preferences regarding marketing communications.

Information Collected Automatically

• Technical data: IP address, device and browser type, operating system, language settings, referring URL, and the pages and resources you access.
• Usage data: dates and times of access, session duration, navigation paths and interactions with Site content.
• Advertising measurement data: if you consent to marketing cookies, the Meta Pixel records your visit and the pages and actions on the Site (such as form submissions) and sends this to Meta, together with technical data such as your IP address and browser information.
• Cookies and similar technologies: see Section 14 for full detail.

Information from Third Parties

• Google Analytics records aggregated and de-identified information about your interactions with our Site so we can understand and improve usage patterns.
• Publicly available business information, where relevant to verifying or contextualising an enquiry.
• Business contact data providers: name, job title, business email address, business telephone number and LinkedIn profile URL of people at businesses we may contact, from Amplemarket, Findymail, Hunter, Prospeo, Wiza, Forager, Enrow and Datagma, some accessed through our data enrichment platform, Clay. On request, we will tell you which source supplied your details.
• Public business sources: business listings such as Google Maps, company websites and professional registers, which we use to identify businesses we may contact.

We use Meta (Facebook and Instagram) for advertising, as described in this policy. If we engage additional advertising or analytics providers, we will update this policy and the cookie banner before any related tracking begins.

We do not knowingly collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data or biometric data) through the Site, and we ask that you do not submit such data through our forms or communications.

4. Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis to do so. Our purposes and corresponding legal bases under GDPR and UK GDPR are set out below.

Operating and securing the Site

Purpose: delivering Site functionality, maintaining performance, preventing fraud and abuse, and protecting our systems.

Legal basis: legitimate interests under Article 6(1)(f) GDPR.

Responding to enquiries and providing information

Purpose: responding to messages submitted through contact forms, lead forms on Meta platforms, email or live chat, arranging calls, and providing requested materials such as guidebooks and contracts.

Legal basis: performance of a contract or steps prior to entering a contract under Article 6(1)(b) GDPR; or legitimate interests under Article 6(1)(f) where you contact us in a non-contractual capacity.

Marketing communications

Purpose: sending newsletters, service updates, event invitations and other marketing materials about Carbon Global.

Legal basis: your consent under Article 6(1)(a) GDPR, or legitimate interests under Article 6(1)(f) for existing business contacts and business prospects (see "Business prospecting" below) where permitted by applicable e-privacy law. You may withdraw consent or opt out at any time.

Business prospecting

Purpose: contacting people at businesses we believe may benefit from our services, in their professional capacity, by email, telephone and LinkedIn, and keeping a record of replies and opt-outs.

Legal basis: legitimate interests under Article 6(1)(f) GDPR in promoting our services to businesses. Every email includes an unsubscribe link, we screen UK telephone numbers against the Telephone Preference Service and Corporate Telephone Preference Service before calling, and you can object at any time (see Section 8).

Sending domains: our outreach emails may come from deploycarbon.com or from our dedicated outreach domains deploycarbon.ai, carbondeployed.com, carbonengineered.com and carbonapplied.com, all operated by Carbon Global OÜ.

Advertising and audience measurement

Purpose: measuring how our adverts on Meta platforms perform, showing our adverts to people who have visited the Site, and building audiences of people with similar professional profiles.

Legal basis: your consent under Article 6(1)(a) GDPR, given through our cookie banner. You can withdraw consent at any time through the cookie preferences link in the Site footer.

Custom audiences

Purpose: showing our adverts on Meta platforms to people at businesses we may contact, in their professional capacity. We upload business contact details (such as business email address) to Meta in hashed form. Meta uses them only to match against its users and does not use them for its own purposes.

Legal basis: legitimate interests under Article 6(1)(f) GDPR in promoting our services to businesses. You can object at any time by contacting privacy@deploycarbon.com, and we will remove you from future uploads.

Measuring lead quality

Purpose: telling Meta which leads went on to become conversations or clients (for example, "call booked" or "qualified"), so its systems show our adverts to more relevant businesses.

Legal basis: legitimate interests under Article 6(1)(f) GDPR.

Analytics and Site improvement

Purpose: understanding how the Site is used so we can improve content, structure and performance.

Legal basis: your consent under Article 6(1)(a) GDPR for non-essential cookies and tracking; legitimate interests under Article 6(1)(f) for aggregated, anonymised analytics that do not require consent under applicable law.

Compliance and legal obligations

Purpose: meeting our obligations under applicable laws, responding to lawful requests from public authorities, and exercising or defending legal claims.

Legal basis: legal obligation under Article 6(1)(c) GDPR, and legitimate interests under Article 6(1)(f) GDPR for the establishment, exercise or defence of legal claims.

5. Sharing of Personal Data

We do not sell your personal data. We may share personal data with the following categories of recipients where necessary for the purposes described in Section 4, subject to applicable data protection laws:

• Technology and service providers: third-party providers supporting our website, hosting, infrastructure, analytics, communications, business development and internal operations. These include Vercel, Google, Clay, lemlist, Amplemarket, Trellus, Attio, Data Soap, Supabase, n8n, Slack and AI service providers, as applicable.
• Advertising platforms: Meta Platforms Ireland Limited (Facebook and Instagram), for lead forms, advertising measurement, custom audiences and lead quality measurement as described in Section 4. For data collected through the Meta Pixel, Carbon Global and Meta act as joint controllers for the collection and transmission of that data to Meta; Meta is responsible for its own processing after that. Meta's Controller Addendum applies.
• Business contact data providers: third-party providers that assist us in identifying and verifying professional contact information, including those identified in Section 3. Where applicable, we may share limited business identifiers, such as an individual's name and company domain, to facilitate these services. Such providers may act as independent data controllers in relation to their own data collection and provision activities.
• Professional advisers: legal counsel, auditors, accountants and other professional advisers who are subject to appropriate confidentiality obligations.
• Legal and regulatory authorities: courts, regulators, law enforcement agencies and other competent authorities where disclosure is required or permitted by applicable law.
• Corporate transactions: potential or actual investors, purchasers, acquirers and successor entities in connection with financing, mergers, acquisitions, reorganisations or transfers of business assets, subject to appropriate confidentiality and data protection safeguards.

Where third parties process personal data on our behalf, we require appropriate contractual arrangements in accordance with applicable data protection laws, including Article 28 GDPR where relevant.

Certain recipients may act as independent data controllers for specific processing activities, in which case they are responsible for complying with their own applicable data protection obligations.

6. International Data Transfers

Carbon Global is established in Estonia. Some of our service providers and infrastructure partners, including Meta, are based outside the European Economic Area (EEA) and the United Kingdom, including in the United States. When we transfer personal data outside the EEA or the UK, we put appropriate safeguards in place, including:

• Transfers to recipients in countries that the European Commission or the UK Information Commissioner has determined to provide an adequate level of protection.
• Transfers under the European Commission's Standard Contractual Clauses (SCCs), supplemented by the UK International Data Transfer Addendum where required, with additional technical and organisational measures based on a transfer impact assessment.
• Transfers to recipients in the United States that are self-certified under the EU-US Data Privacy Framework (DPF), the UK Extension to the EU-US DPF or the Swiss-US DPF, where applicable.

You may request a copy of the safeguards in place for a specific transfer by contacting privacy@deploycarbon.com.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including any legal, accounting or reporting requirements. Our retention periods are summarised below:

• Contact form, lead form and enquiry data: up to 24 months after the last interaction, unless a business relationship is established.
• Business prospect data: up to 24 months after our last contact with you, unless a business relationship is established. If you opt out, we keep only the details needed to make sure we do not contact you again.
• Marketing data and consent records: until you withdraw consent or unsubscribe, plus up to 24 months for record-keeping.
• Server logs and security data: up to 12 months, or longer where required for security investigations.
• Analytics data: up to 14 months for Google Analytics user-level data; aggregated analytics may be retained for longer.
• Meta Pixel cookies: see Section 14. Meta retains advertising data in line with its own policy.
• Custom audience uploads: hashed contact data is used by Meta only to match against its users and is deleted after matching, in line with Meta's terms.
• Contract-related data and downloaded materials records: for the duration of the relationship and for the period required by applicable contract, tax and statutory limitation laws.

When personal data is no longer required, we will delete or anonymise it. Where deletion is not technically feasible, we will isolate the data and stop further processing.

8. Your Rights Under GDPR and UK GDPR

If you are located in the European Economic Area, the United Kingdom or Switzerland, you have the following rights in relation to your personal data:

• Right of access: to obtain confirmation of whether we process your personal data and a copy of that data.
• Right to rectification: to have inaccurate or incomplete personal data corrected.
• Right to erasure: to have personal data deleted in defined circumstances.
• Right to restriction: to restrict our processing of your personal data in defined circumstances.
• Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object: to object to processing based on legitimate interests, including custom audiences and lead quality measurement, and to direct marketing at any time. To stop business prospecting, unsubscribe from any of our emails or reply to the sender.
• Right to withdraw consent: where processing is based on consent, including marketing cookies, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making: we do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you.
• Right to lodge a complaint: with a supervisory authority, in particular in your country of residence, place of work or place of the alleged infringement.

You may exercise these rights by contacting privacy@deploycarbon.com. We will respond within one month, with the option to extend by a further two months for complex requests, in accordance with Articles 12 and 15 to 22 GDPR. We may need to verify your identity before responding.

The lead supervisory authority for Carbon Global is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia. UK residents may also contact the Information Commissioner's Office (ICO) at ico.org.uk.

9. Your Rights Under US State Privacy Laws

If you are a resident of California, Colorado, Connecticut, Virginia, Utah or another US state with applicable privacy legislation, you have additional rights described below.

California (CCPA/CPRA)

California residents have the right to:

• Know what personal information we collect, use, disclose and (if applicable) sell or share, and the categories of sources and recipients.
• Access a copy of the specific pieces of personal information we have collected about you.
• Request deletion of personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information for cross-context behavioural advertising.
• Limit the use and disclosure of sensitive personal information.
• Be free from retaliation or discrimination for exercising these rights.

Carbon Global does not sell personal information for monetary consideration. Where you consent to marketing cookies, we share personal information with Meta through the Meta Pixel for cross-context behavioural advertising. You can opt out at any time by rejecting marketing cookies through the cookie preferences link in the Site footer. We respect Global Privacy Control (GPC) signals as a valid opt-out request.

You may submit a request through privacy@deploycarbon.com. You may use an authorised agent, subject to verification. We will respond within 45 days, with the option to extend by an additional 45 days for complex requests.

Other US States

Residents of states with comparable privacy legislation (including Colorado, Connecticut, Virginia and Utah) have rights of access, correction, deletion, portability, and opt-out of targeted advertising and certain profiling, subject to the specific requirements of each state. To exercise these rights, contact privacy@deploycarbon.com.

10. Data Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include encryption in transit, access controls, vendor due diligence and incident response procedures. We review and update these measures in line with the state of the art and the risks presented by our processing.

No method of transmission over the internet or electronic storage is fully secure. We cannot guarantee absolute security, but we will notify you and the relevant supervisory authority of a personal data breach where required by law.

11. Minors

The Site is intended for adult business users. We do not direct the Site at, and do not knowingly collect personal data from, anyone under the age of 18. If you believe a person under 18 has provided personal data to us, please contact privacy@deploycarbon.com and we will take steps to delete it.

12. Changes to This Policy

We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. The current version is identified by the "Last Updated" date above. Material changes will be communicated through the Site or by direct notice where appropriate.

13. Contact

For all data privacy questions, including the exercise of your rights under this policy:

Email: privacy@deploycarbon.com
Phone: +44 7413 336636
Address: Carbon Global OÜ, Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond 15551, Estonia

14. Cookies and Similar Technologies

This section explains how Carbon Global uses cookies and similar technologies on the Site.

What Are Cookies

Cookies are small text files placed on your device when you visit a website. They help the site function correctly, remember your preferences and provide information to the site operator. Similar technologies include pixels, tags, local storage and software development kits, all of which we refer to collectively as "cookies" in this section.

How We Use Cookies

We use cookies in the following categories.

Strictly Necessary Cookies

These cookies are essential for the Site to function. They enable basic features such as page navigation, secure areas, form submission, spam prevention and the cookie consent mechanism itself. The Site cannot operate properly without them, and they do not require consent.

Analytics Cookies

These cookies help us understand how visitors interact with the Site so we can improve its content and performance. We use Google Analytics 4 (GA4), which sets cookies to collect information about your visit on an aggregated and de-identified basis where possible. IP addresses are truncated within the EEA or UK before being transmitted to Google, where applicable. Analytics cookies are set only with your consent.

Marketing and Targeting Cookies

We use the Meta Pixel to measure the performance of our adverts on Facebook and Instagram, to show our adverts to people who have visited the Site, and to build audiences of people with similar professional profiles. These cookies are set only with your consent and can be refused or withdrawn at any time through our cookie banner.

Managing Your Preferences

When you first visit the Site, our consent banner allows you to accept all cookies, reject non-essential cookies or manage your preferences by category. You can change your preferences at any time by reopening the cookie preferences panel from the link in the Site footer.

You can also manage cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies or be notified when a cookie is set. Please note that disabling certain cookies may affect Site functionality.

For Google Analytics specifically, you can install the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout. You can also control the adverts you see on Facebook and Instagram through your Meta ad preferences.

Carbon Global respects Global Privacy Control (GPC) signals where applicable as a valid mechanism for opting out of the sale or sharing of personal information.

Third-Party Information

For more information on the cookies set by our third-party providers, please consult their privacy and cookie policies:

• Google Analytics: policies.google.com/privacy
• Meta: facebook.com/privacy/policy
• Vercel: vercel.com/legal/privacy-policy