Policies

Policies

Privacy policy

Last Updated: December 3, 2025

1. Introduction

CarbonAct ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from), or when you interact with us as a Client or a Supplier during our data collection processes.

This policy is compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who We Are

CarbonAct is the Controller and responsible for your personal data.

Contact Details:

  • Full name of legal entity: OYNK Ltd - T/A CarbonAct

  • Email address: ash@carbonact.co.uk

  • Postal address: Office 34, iCon Innovation Centre, Daventry, Northampton, NN11 0QB

3. The Data We Collect About You

We may collect, use, store, and transfer different kinds of personal data about you which we have grouped together follows:

  • Identity Data: First name, last name, username or similar identifier, title.

  • Contact Data: Billing address, delivery address, email address, and telephone numbers.

  • Technical Data: Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform.

  • Supply Chain Evidence Data: To perform our services, we collect data from Suppliers on behalf of our Clients. This may include utility bills, fuel receipts, production logs, and vehicle registration data. While this is primarily "Business Data," it may constitute "Personal Data" if it relates to a Sole Trader or Partnership.

4. How Is Your Personal Data Collected?

We use different methods to collect data from and about you including through:

  • Direct interactions: You may give us your Identity, Contact, and Financial Data by filling in forms (e.g., Typeform, Softr portals) or by corresponding with us by post, phone, email, or otherwise.

  • Automated technologies or interactions: As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions, and patterns.

  • Third parties: We may receive data about you from our Corporate Clients who list you as a supplier in their supply chain.

5. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • Performance of Contract: To facilitate the calculation of carbon emissions data as requested by you (the Client) or the company requesting the data (the Client).

  • Legitimate Interests: To conduct our business and ensure the integrity of the supply chain data we verify.

  • Legal Compliance: To comply with a legal or regulatory obligation (e.g., UK CBAM reporting requirements).

Specific Note on Supply Chain Data: If you provide utility bills or evidence as a Supplier, this data is used strictly for the purpose of calculating carbon emissions intensity. It is not sold, shared with competitors, or used for marketing purposes.

6. Disclosures of Your Personal Data

We may have to share your personal data with the parties set out below for the purposes set out in paragraph 5 above.

  • Internal Third Parties: Freelance Carbon Analysts and environmental consultants acting as processors who verify data and perform ISO-compliant calculations. All internal parties are bound by strict Non-Disclosure Agreements (NDAs).

  • External Third Parties: Service providers acting as processors who provide IT and system administration services (e.g., Google Workspace, Airtable, Softr).

  • Our Clients: If you are a Supplier, the verified carbon data we generate from your evidence will be shared with the Corporate Client who requested it.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

7. International Transfers

We utilise cloud-based tools (such as Airtable and Google Drive) which may store data on servers located outside the UK. Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring that specific contracts approved by the UK Government (International Data Transfer Agreements) are in place.

8. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way.

  • All data at rest is encrypted using AES-256 standard encryption.

  • Access to your personal data is limited to those employees, agents, contractors, and other third parties who have a business need to know.

9. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

  • Carbon Evidence Data: Retained for 7 years to align with HMRC and Audit record-keeping requirements.

10. Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to:

  • Request access to your personal data.

  • Request correction of your personal data.

  • Request erasure of your personal data.

  • Object to processing of your personal data.

  • Request restriction of processing your personal data.

  • Request transfer of your personal data.

  • Right to withdraw consent.

If you wish to exercise any of the rights set out above, please contact us at ash@carbonact.co.uk

Secure Your Margins Before 2027.

Don't let supply chain data gaps turn into tax liabilities. Establish your audit-ready primary data baseline today and shield your business from punitive "Default Value" tariffs.

Schedule Audit Risk Assessment

Close-up of a dark green leaf showing its textured surface and central vein against a muted background.
Smiling young woman with long hair standing against a dark green background, holding a finger to her chin.
Close-up of a dark green leaf showing its textured surface and central vein against a muted background.
A smiling woman with her arms crossed, standing against a dark green background. She has long, dark hair.
Close-up of a dark green leaf showing its textured surface and central vein against a muted background.
Smiling young man with short hair poses against a dark background, wearing a green button-up shirt.
Close-up of a tree stump showing growth rings and a textured brown wood surface.
A smiling young man with crossed arms, wearing a plaid shirt and white t-shirt, poses against a dark background.
Close-up of a tree stump showing growth rings and a textured brown wood surface.

Secure Your Margins Before 2027.

Don't let supply chain data gaps turn into tax liabilities. Establish your audit-ready primary data baseline today and shield your business from punitive "Default Value" tariffs.

Schedule Audit Risk Assessment

Close-up of a dark green leaf showing its textured surface and central vein against a muted background.
Smiling young woman with long hair standing against a dark green background, holding a finger to her chin.
Close-up of a dark green leaf showing its textured surface and central vein against a muted background.
A smiling woman with her arms crossed, standing against a dark green background. She has long, dark hair.
Close-up of a dark green leaf showing its textured surface and central vein against a muted background.
Smiling young man with short hair poses against a dark background, wearing a green button-up shirt.
Close-up of a tree stump showing growth rings and a textured brown wood surface.
A smiling young man with crossed arms, wearing a plaid shirt and white t-shirt, poses against a dark background.
Close-up of a tree stump showing growth rings and a textured brown wood surface.

Secure Your Margins Before 2027.

Don't let supply chain data gaps turn into tax liabilities. Establish your audit-ready primary data baseline today and shield your business from punitive "Default Value" tariffs.

Schedule Audit Risk Assessment

Close-up of a dark green leaf showing its textured surface and central vein against a muted background.
Smiling young woman with long hair standing against a dark green background, holding a finger to her chin.
Close-up of a dark green leaf showing its textured surface and central vein against a muted background.
A smiling woman with her arms crossed, standing against a dark green background. She has long, dark hair.
Close-up of a dark green leaf showing its textured surface and central vein against a muted background.
Smiling young man with short hair poses against a dark background, wearing a green button-up shirt.
Close-up of a tree stump showing growth rings and a textured brown wood surface.
A smiling young man with crossed arms, wearing a plaid shirt and white t-shirt, poses against a dark background.
Close-up of a tree stump showing growth rings and a textured brown wood surface.