Privacy Notice
Decarbonate Customer Privacy Notice
Data Controller: Carbo Certus Limited (trading as Decarbonate), registered in England and Wales (company number 16875065), registered office: 61 Bridge Street, Kington, Herefordshire, HR5 3DJ.
We are the controller of your personal data. This privacy notice tells you what to expect us to do with your personal information.
Contact: contact@decarbonate.io
Service Enquiries
This section explains how we process personal data collected through our enquiry form.
Data We Collect
- Full name, email address, organisation, and role
- Service interest and requirements description
- IP address (for rate limiting and security only)
Purpose and Lawful Basis
| Purpose | Lawful Basis |
|---|---|
| Responding to your enquiry | Legitimate interest (necessary to respond to service enquiries and assess suitability) |
| Providing services and ongoing communication | Performance of a contract (necessary to deliver services you have requested) |
| Service improvement and analytics | Legitimate interest (necessary for service improvement purposes) |
| Rate limiting and platform security | Legitimate interest (necessary to provide our services and prevent abuse) |
| Marketing communications (only if you opted in) | Consent (you may withdraw your consent at any time by contacting us) |
Retention Periods
- Active engagements: Duration of service plus 12 months
- Declined enquiries: 6 months from decision
- IP addresses for rate limiting: 7 days
- All enquiry data (long-stop): 6 years from last interaction (Limitation Act 1980)
Automated Decision-Making
All enquiries are reviewed manually. No automated decision-making or profiling is used.
Right to Object
Where we rely on legitimate interest as our lawful basis, you have the right to object to processing at any time. To exercise this right, contact contact@decarbonate.io. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
What Information We Collect, Use, and Why
For providing and securing your account:
- Email address, name, and company name
- Securely hashed password (we cannot read your password)
- Session tokens and refresh tokens
- Two-factor authentication enrolment status
- IP addresses and timestamps for security monitoring
- Consent preferences (analytics, marketing)
For service updates or marketing purposes:
- Names and contact details
- Marketing preferences
- IP addresses
For dealing with queries, complaints or claims:
- Names and contact details
- Correspondence
For business development and service discussions:
- Names and contact details
- Records of meetings and decisions
- Information relating to compliments or complaints
Your Rights
Under UK data protection law, you have the following rights:
- Right of access — You have the right to ask us for copies of your personal information.
- Right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
- Right to erasure — You have the right to ask us to delete your personal information.
- Right to restriction of processing — You have the right to ask us to limit how we can use your personal information.
- Right to object to processing — You have the right to object to the processing of your personal data, including where we rely on legitimate interest.
- Right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
- Right to withdraw consent — When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month. Contact contact@decarbonate.io to exercise any of these rights.
How Long We Keep Information
- Account Data: Retained while your account is active; deleted within 30 days of account erasure request
- Security Logs: IP addresses, login events, and audit trails retained for 90 days
- Session Tokens: Automatically expire after 30 minutes (access) or 7 days (refresh); revoked on logout
- Contact Form Queries: Deleted after 12 months unless ongoing business relationship
- Business Development Discussions: Retained for 24 months or duration of active commercial relationship
- Marketing Consent Records: Retained until consent is withdrawn
- Legal Compliance Data: Retained as required by applicable UK law and regulatory obligations
Who We Share Information With
Data Processors:
- Cloudflare Inc. (United States, EU data centres) — Website hosting (Cloudflare Pages), database (D1, EU region), CDN, and DDoS protection. Personal data is stored in Cloudflare's EU data centres.
- Resend Inc. (United States) — Transactional email provider for application confirmations, account notifications, and password resets.
- Namecheap Inc. (United States) — Domain registration services.
Others we may share personal information with:
- Professional or legal advisors under duty of confidentiality
- Relevant regulatory authorities where required by law
- Organisations we are legally obliged to share personal information with
We do not sell your personal data. We do not share your data with third parties for their marketing purposes.
Sharing Information Outside the UK
Our primary database is hosted in Cloudflare's EU data centres. Where data processing involves US-incorporated service providers (Cloudflare, Resend), appropriate safeguards are in place in accordance with UK GDPR, including each provider's data processing addendum.
Providing Your Data
Providing personal data through the pilot application form is not a legal requirement. However, if you do not provide the required information, we will be unable to process your application.
How to Complain
If you have any concerns about our use of your personal data, you can make a complaint to us at contact@decarbonate.io.
If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the ICO:
Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint