Privacy Policy

Introduction

This Privacy Policy describes how Carbon Footprint Ltd ("we," "us," or "our") collects, uses, and shares personal information when you visit or use our website https://carbonoffsetratings.org/ (the "Site"). Carbon Footprint Ltd is the data controller. CRISP is one of several Carbon Footprint Ltd tools that share a single account system, so parts of this policy refer to that shared account.

Information We Collect

• Contact Form Data: When you use our contact form, we collect your name, email address, and the content of your message. We collect this information to respond to your inquiries and provide you with support. The legal basis for processing this data is our legitimate interest in providing effective customer service and responding to your requests.
• Account Data: If you create or sign in with a Carbon Footprint account, we process your email address and a unique account identifier. Accounts are shared across Carbon Footprint Ltd tools, so you can use the same sign-in here as elsewhere. If you choose to sign in with Google or Microsoft, we receive your email address from that provider; we never see or store your Google or Microsoft password. We use this information to sign you in and to show signed-in content such as the full rating breakdown. The legal basis is the performance of our agreement with you to provide the account (contract), and our legitimate interest in keeping the service secure. The account identity itself is held in the shared Carbon Footprint account system, hosted by Supabase in the EU (Ireland).
• Rating Requests: When you ask us to rate a project, we store the details you give us (project name, registry, registry ID or link, standard, country and any note) together with your account email address and identifier, the date of the request, its progress, and whether you agreed to be contacted about it. We use this to research and rate the project, to show you the progress of your requests, to avoid duplicate requests and to limit misuse. We will only email you about a request if you tick the box agreeing to it. Requests may be reviewed by our staff and processed with automated tools, including AI, to help research the project. The legal basis is the performance of the service you have asked us for (contract), and your consent where you agree to be contacted. Any automated research uses an AI provider acting as our processor, which receives the project details only and never your identity.
• Followed Projects: If you choose to follow a project, we store your account identifier, the project's identifier and the date you followed it, together with the date you last viewed your Following page. We use this to show you the projects you follow and what has changed about them. Your list is private to you; our staff can see which account identifiers follow which projects, but not your email address alongside them. We do not use this information for marketing unless you separately agree to that. The legal basis is the performance of the service you have asked us for (contract).
• Sign-in Storage: When you sign in, your browser keeps a sign-in token in its local storage so you stay signed in between pages. It is removed when you sign out. While you fill in a rating request, your answers are kept in your browser's session storage so they are not lost if you need to sign in first; they are cleared once the request is sent or the browser tab is closed.
• Access Logs: Our hosting provider keeps standard access logs (IP address, browser type and the pages requested) to operate and secure the Site. We do not log your email address or the content of your requests alongside them. The legal basis is our legitimate interest in keeping the Site secure.
• Cookies: Our Site uses cookies to enhance your browsing experience. Cookies are small text files that are placed on your computer or mobile device when you visit a website. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site. (See "Cookies" section below for more details.)

Data Retention

We will retain your contact form data for up to 5 years for record-keeping purposes and to improve our services.

We keep your account for as long as it is active in any Carbon Footprint Ltd tool. We keep rating requests for up to 5 years after they are closed, so we have a record of why a project was or was not rated. Followed-project lists are kept while your account is active. Access logs are kept for up to 90 days. You can ask us to delete your requests, your followed projects or your account at any time (see "Data Subject Rights" below); because the account is shared, deleting it removes your access to all Carbon Footprint Ltd tools.

Data Security

We take reasonable measures to protect the information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. These measures may include encryption, access controls, and secure storage.

Data Subject Rights

You have the following rights regarding your personal data:

• Right of access: You have the right to request access to your personal data that we hold.
• Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data that we hold about you.
• Right to erasure: You have the right to request that we erase your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing: You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to data portability: You have the right to receive a copy of the personal data you have given us in a commonly used electronic format.
• Right to object to processing: You have the right to object to the processing of your personal data in certain circumstances, such as when the processing is based on our legitimate interests.

To exercise any of these rights, please contact us at info@carbonfootprint.com. We will respond within one month. You also have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we handle your data.

Third-Party Data Sharing

We may share your personal data with trusted third-party service providers who assist us with website hosting, data analysis, and other essential functions. These include Supabase, which provides the shared account sign-in service (hosted in the EU), and Vercel, which hosts this Site and stores rating requests and followed-project lists. If you choose to sign in with Google or Microsoft, they process your sign-in under their own privacy policies. Project pages embed a map from OpenStreetMap and show project images hosted by Flickr; those services receive the standard request information (such as your IP address) needed to display them. We have data processing agreements in place with our service providers to ensure that your data is protected. Where a provider processes data outside the UK or EEA, we rely on the UK International Data Transfer Agreement or Addendum. We do not share your data with any other third parties, and we do not sell it.

Cookies

What We Set

• Strictly Necessary: a cookie that remembers you have seen our cookie notice, and the sign-in token described above, which is kept in your browser's local storage rather than a cookie. These are needed for the Site to work and are not used to track you.
• Performance Measurement: we use Vercel Web Analytics to count visits and see which pages are used. It does not set cookies and does not identify you; the information is aggregated and anonymous.

We do not use advertising, social media or other tracking cookies on this Site. If we ever add a cookie that is not strictly necessary, we will ask for your consent first and update this page.

Cookie Notice

Because we only set strictly necessary cookies, the banner on the Site is a notice rather than a consent request. Dismissing it sets the cookie that stops it appearing again.

How to Control Cookies

You can control and/or delete cookies as you wish – for details, see aboutcookies.org. You can delete all cookies that are already on your computer and you can set most browsers to prevent them from being placed. If you do this, you may need to sign in again and the cookie notice will reappear.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make any material changes, we will notify you by posting the updated Privacy Policy on the Site.

Contact Us

If you have any questions about this Privacy Policy, please contact us at info@carbonfootprint.com.

GDPR Compliance

This Privacy Policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the EU GDPR. We ensure that our processing of personal data, including the use of cookies, is conducted in accordance with their principles.