Privacy & Cookie Policy

Last Updated: 30 April 2026

Carbon Global respects your privacy and is committed to handling personal data responsibly, transparently, and in accordance with applicable data protection laws. This Privacy & Cookie Policy explains what personal data we collect through deploycarbon.com (the “Site”), how we use it, who we share it with, how long we keep it, the rights you have, and how we use cookies and similar technologies.

This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and the Estonian Personal Data Protection Act.

1. Controller

For the purposes of GDPR and UK GDPR, the controller of your personal data is:

Carbon Global OÜ
Address: Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond 15551, Estonia
Privacy contact: privacy@deploycarbon.com
Phone: +44 7413 336636

Carbon Global has not appointed a Data Protection Officer because its activities do not meet the mandatory designation criteria set out in Article 37 GDPR. Privacy inquiries are managed by the Legal team.

2. Website Development, Design, and Hosting

This Site is developed and maintained by Carbon Global OÜ. The Site was designed by Thomas Trotin (frostyourdesign.webflow.io).

The Site is hosted on Webflow, with content delivery and infrastructure provided by Amazon Web Services (AWS) and Fastly. Webflow’s hosting documentation is available at webflow.com/hosting.

2. Personal Data We Collect

We collect personal data in the following categories.

Information You Provide Directly

• Identity and contact details: name, job title, business email address, telephone number, and company name when you complete a contact form, request information, or download gated materials such as guidebooks.
• Professional context: information you choose to share about your role, company size, region, project requirements, or current engineering operations.
• Communications: the contents of emails, messages, and forms you send to us, including any documents or attachments.
• Marketing preferences: your consent and preferences regarding marketing communications.

Information Collected Automatically

• Technical data: IP address, device and browser type, operating system, language settings, referring URL, and the pages and resources you access.
• Usage data: dates and times of access, session duration, navigation paths, and interactions with Site content.
• Cookies and similar technologies: see Section 13 below for full detail.

Information from Third Parties

• Google Analytics records aggregated and de-identified information about your interactions with our Site so we can understand and improve usage patterns.
• Publicly available business information, where relevant to verifying or contextualizing an inquiry.

We may engage additional marketing automation, advertising, or analytics providers in the future. If we do, we will update this policy and the cookie banner before any related tracking begins.

We do not knowingly collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) through the Site, and we ask that you do not submit such data through our forms or communications.

3. Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis to do so. Our purposes and corresponding legal bases under GDPR and UK GDPR are set out below.

Operating and securing the Site

Purpose: delivering Site functionality, maintaining performance, preventing fraud and abuse, and protecting our systems.

Legal basis: legitimate interests under Article 6(1)(f) GDPR.

Responding to inquiries and providing information

Purpose: responding to messages submitted through contact forms, email, or live chat, and providing requested materials such as guidebooks and contracts.

Legal basis: performance of a contract or steps prior to entering a contract under Article 6(1)(b) GDPR; or legitimate interests under Article 6(1)(f) where you contact us in a non-contractual capacity.

Marketing communications

Purpose: sending newsletters, service updates, event invitations, and other marketing materials about Carbon Global.

Legal basis: your consent under Article 6(1)(a) GDPR, or legitimate interests under Article 6(1)(f) for existing business contacts where permitted by applicable e-privacy law. You may withdraw consent or opt out at any time.

Analytics and Site improvement

Purpose: understanding how the Site is used so we can improve content, structure, and performance.

Legal basis: your consent under Article 6(1)(a) GDPR for non-essential cookies and tracking; legitimate interests under Article 6(1)(f) for aggregated, anonymized analytics that do not require consent under applicable law.

Compliance and legal obligations

Purpose: meeting our obligations under applicable laws, responding to lawful requests from public authorities, and exercising or defending legal claims.

Legal basis: legal obligation under Article 6(1)(c) GDPR, and legitimate interests under Article 6(1)(f) GDPR for the establishment, exercise, or defense of legal claims.

4. Sharing of Personal Data

We do not sell your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary for the purposes set out in Section 3:

• Service providers and processors: hosting and form processing (Webflow, AWS, Fastly), analytics (Google), and email and communications providers. These providers process personal data on our behalf under written agreements that meet the requirements of Article 28 GDPR.
• Professional advisors: lawyers, auditors, and other professional advisors, where bound by duties of confidentiality.
• Authorities: courts, regulators, and law enforcement, where required by law or to protect our legal rights.
• Corporate transactions: acquirers or successor entities in the event of a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality protections.

5. International Data Transfers

Carbon Global is established in Estonia. Some of our service providers and infrastructure partners are based outside the European Economic Area (EEA) and the United Kingdom, including in the United States. When we transfer personal data outside the EEA or the UK, we put appropriate safeguards in place, including:

• Transfers to recipients in countries that the European Commission or the UK Information Commissioner has determined to provide an adequate level of protection.
• Transfers under the European Commission’s Standard Contractual Clauses (SCCs), supplemented by the UK International Data Transfer Addendum where required, with additional technical and organizational measures based on a transfer impact assessment.
• Transfers to recipients in the United States that are self-certified under the EU-US Data Privacy Framework (DPF), the UK Extension to the EU-US DPF, or the Swiss-US DPF, where applicable.

You may request a copy of the safeguards in place for a specific transfer by contacting privacy@deploycarbon.com.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including any legal, accounting, or reporting requirements. Our retention periods are summarized below:

• Contact form and inquiry data: up to 24 months after the last interaction, unless a business relationship is established.
• Marketing data and consent records: until you withdraw consent or unsubscribe, plus up to 24 months for record-keeping.
• Server logs and security data: up to 12 months, or longer where required for security investigations.
• Analytics data: up to 14 months for Google Analytics user-level data; aggregated analytics may be retained for longer.
• Contract-related data and downloaded materials records: for the duration of the relationship and for the period required by applicable contract, tax, and statutory limitation laws.

When personal data is no longer required, we will delete or anonymize it. Where deletion is not technically feasible, we will isolate the data and stop further processing.

7. Your Rights Under GDPR and UK GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights in relation to your personal data:

• Right of access: to obtain confirmation of whether we process your personal data and a copy of that data.
• Right to rectification: to have inaccurate or incomplete personal data corrected.
• Right to erasure: to have personal data deleted in defined circumstances.
• Right to restriction: to restrict our processing of your personal data in defined circumstances.
• Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object: to object to processing based on legitimate interests, and to direct marketing at any time.
• Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right not to be subject to automated decision-making: we do not use automated decision-making, including profiling, that produces legal or similarly significant effects on you.
• Right to lodge a complaint: with a supervisory authority, in particular in your country of residence, place of work, or place of the alleged infringement.

You may exercise these rights by contacting privacy@deploycarbon.com. We will respond within one month, with the option to extend by a further two months for complex requests, in accordance with Articles 12 and 15 to 22 GDPR. We may need to verify your identity before responding.

The lead supervisory authority for Carbon Global is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia. UK residents may also contact the Information Commissioner’s Office (ICO) at ico.org.uk.

8. Your Rights Under US State Privacy Laws

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, or another US state with applicable privacy legislation, you have additional rights described below.

California (CCPA / CPRA)

California residents have the right to:

• Know what personal information we collect, use, disclose, and (if applicable) sell or share, and the categories of sources and recipients.
• Access a copy of the specific pieces of personal information we have collected about you.
• Request deletion of personal information, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising.
• Limit the use and disclosure of sensitive personal information.
• Be free from retaliation or discrimination for exercising these rights.

Carbon Global does not sell personal information for monetary consideration, and we do not currently share personal information with advertising partners for cross-context behavioral advertising. If we begin to share personal information for that purpose in the future, we will update this policy and provide an opt-out mechanism through our cookie banner. We respect Global Privacy Control (GPC) signals as a valid opt-out request.

You may submit a request through privacy@deploycarbon.com. You may use an authorized agent, subject to verification. We will respond within 45 days, with the option to extend by an additional 45 days for complex requests.

Other US States

Residents of states with comparable privacy legislation (including Colorado, Connecticut, Virginia, and Utah) have rights of access, correction, deletion, portability, and opt-out of targeted advertising and certain profiling, subject to the specific requirements of each state. To exercise these rights, contact privacy@deploycarbon.com.

9. Data Security

We maintain appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include encryption in transit, access controls, vendor due diligence, and incident response procedures. We review and update these measures in line with the state of the art and the risks presented by our processing.

No method of transmission over the internet or electronic storage is fully secure. We cannot guarantee absolute security, but we will notify you and the relevant supervisory authority of a personal data breach where required by law.

10. Minors

The Site is intended for adult business users. We do not direct the Site at, and do not knowingly collect personal data from, anyone under the age of 18. If you believe a person under 18 has provided personal data to us, please contact privacy@deploycarbon.com and we will take steps to delete it.

11. Changes to This Policy

We may update this Privacy & Cookie Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The current version is identified by the “Last Updated” date above. Material changes will be communicated through the Site or by direct notice where appropriate.

12. Contact

For all data privacy questions, including the assertion of your rights under this policy:

Email: privacy@deploycarbon.com
Phone: +44 7413 336636
Address: Carbon Global OÜ, Sepapaja tn 6, Lasnamäe linnaosa, Tallinn, Harju maakond 15551, Estonia

13. Cookies and Similar Technologies

This section explains how Carbon Global uses cookies and similar technologies on the Site.

What Are Cookies

Cookies are small text files placed on your device when you visit a website. They help the site function correctly, remember your preferences, and provide information to the site operator. Similar technologies include pixels, tags, local storage, and software development kits, all of which we refer to collectively as “cookies” in this section.

How We Use Cookies

We use cookies in the following categories.

Strictly Necessary Cookies

These cookies are essential for the Site to function. They enable basic features such as page navigation, secure areas, form submission, spam prevention, and the cookie consent mechanism itself. The Site cannot operate properly without them, and they do not require consent. This category includes session and security cookies set by our hosting provider, Webflow.

Analytics Cookies

These cookies help us understand how visitors interact with the Site so we can improve its content and performance. We use Google Analytics 4 (GA4), which sets cookies to collect information about your visit on an aggregated and de-identified basis where possible. IP addresses are truncated within the EEA or UK before being transmitted to Google, where applicable. Analytics cookies are set only with your consent.

Marketing and Targeting Cookies

Carbon Global does not currently use marketing or targeting cookies on the Site. We may introduce them in the future to deliver and measure advertising on third-party platforms (such as LinkedIn or Meta) and to personalize content based on your interests. If we do, we will update this policy, identify the specific tools in use, and obtain your consent through our cookie banner before any such cookies are set on your device.

Managing Your Preferences

When you first visit the Site, our consent banner allows you to accept all cookies, reject non-essential cookies, or manage your preferences by category. You can change your preferences at any time by reopening the cookie preferences panel from the link in the Site footer.

You can also manage cookies through your browser settings. Most browsers allow you to refuse new cookies, delete existing cookies, or be notified when a cookie is set. Please note that disabling certain cookies may affect Site functionality.

For Google Analytics specifically, you can install the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Carbon Global respects Global Privacy Control (GPC) signals where applicable as a valid mechanism for opting out of the sale or sharing of personal information.

Third-Party Information

For more information on the cookies set by our third-party providers, please consult their privacy and cookie policies:

• Google Analytics: policies.google.com/privacy
• Webflow: webflow.com/legal/privacy