Managing Your Cookie Preferences

When you first visit our website, you’ll see a cookie banner allowing you to accept or customize cookie settings. You can also control cookies via your browser settings at any time. Please note that disabling some cookies may impact the functionality of certain parts of our website.

8. Use of Your Information

We only use your personal data for specific, legitimate purposes — always in line with your expectations and GDPR requirements.

Here’s how we may use the information we collect:

To deliver carbon reports we use your uploaded invoices, receipts, or financial information solely to calculate your business’s carbon emissions and generate your report, to communicate with you, to send you your requested report or respond to inquiries, to provide updates on your submission or service request, to send newsletters or offers (only if you’ve opted in), to improve our website and services, to monitor usage and visitor behavior using analytics tools, to troubleshoot issues and optimize site performance, to understand which features are most helpful to users, to maintain security and compliance, to prevent fraud or misuse of our services, to comply with legal obligations under Dutch and EU law. We never use your personal data for automated decision-making or profiling.

9. Legal Basis for Processing (GDPR)

Under the EU General Data Protection Regulation (GDPR), we are required to explain the legal grounds we rely on to process your personal data.

At CarbonSquare, we process data based on the following legal bases:

• Consent: When you voluntarily provide information (e.g., to request a report or sign up for emails).

• Legitimate interest: To operate, improve, and secure our platform (e.g., website analytics, troubleshooting, feature optimization).

• Contractual necessity: To deliver your requested carbon report and communicate regarding the service.

• Legal obligation: To comply with tax, accounting, or regulatory requirements, if applicable.

10. Sharing Your Information with Third Parties

We do not sell your personal data. However, we may share it with trusted third parties to help us deliver our services and operate the CarbonSquare platform.

We may share your information with: Google Analytics to understand website performance, Mailchimp to manage newsletters and marketing emails, and our hosting provider (e.g. Vebex) to store and secure data. In some cases, we may also share your data with professional advisors (such as accountants or legal consultants) if necessary for compliance or platform improvement. All third-party partners are contractually obligated to keep your data secure and only use it for the intended purpose.

11. Where Your Data Is Stored

Your personal data is securely stored on the servers of our hosting and third-party service providers. This may include storage on servers located within the European Economic Area (EEA), or in other jurisdictions that offer adequate data protection standards as recognized by the European Commission. While we currently host the CarbonSquare platform with third-party providers (e.g. Vebex), we only work with partners who meet strict privacy and security requirements in line with GDPR. We do not store any payment information on our servers.

12. How Long We Keep Your Data

We only keep your personal data for as long as it’s needed to fulfill the purposes outlined in this Privacy Policy — such as delivering your carbon report, communicating with you, or complying with legal requirements. Unless you request deletion earlier, we may retain your data for up to 24 months after your last interaction with CarbonSquare. Uploaded files (like invoices or receipts) are securely stored only for the time required to generate your report and may be deleted sooner. You can request to have your data deleted at any time by contacting us at support@carbonsquare.earth.

13. How We Protect Your Data

We take data security seriously. CarbonSquare uses appropriate technical and organizational measures to protect your personal data against unauthorized access, misuse, alteration, or loss. These include: secure server environments, encrypted communication (SSL), access controls, and working only with third-party providers who comply with GDPR or equivalent standards. While no digital system is 100% immune to risk, we regularly review our security practices to reduce vulnerabilities and protect your information as responsibly as possible.

14. International Data Transfers

CarbonSquare operates from the Netherlands, and we aim to store and process your data within the European Economic Area (EEA) whenever possible.

However, some of our service providers — such as email or analytics platforms — may process data outside the EEA. When this happens, we ensure that appropriate safeguards are in place, such as: Standard Contractual Clauses (SCCs) approved by the European Commission, Data processing agreements with our third-party providers, Use of services that are certified under recognized data protection frameworks. We only work with partners who meet high standards of privacy and security, regardless of where they are based.

15. Your Data Protection Rights (GDPR)

As a user based in the European Economic Area (EEA), you have important rights under the General Data Protection Regulation (GDPR):

• Right to access – You can request a copy of the personal data we hold about you.

• Right to correction – You can ask us to correct inaccurate or incomplete information.

• Right to deletion – You may request that we delete your personal data.

• Right to restrict processing – You can ask us to limit how your data is used.

• Right to object – You may object to certain uses of your data, such as marketing.

• Right to data portability – You can request your data in a format you can transfer to another service.

To exercise any of these rights, contact us at support@carbonsquare.earth. We may need to verify your identity before fulfilling the request. If you’re unsatisfied with how we handle your data, you also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

16. How to Access or Update Your Data

You’re in control of your information. If you want to review, correct, update, or delete the personal data we hold about you, you can email us anytime at support@carbonsquare.earth. We’ll respond to your request within 30 days, and in most cases much sooner. To protect your privacy, we may ask for verification before making changes. Please note: some data (like invoices or receipts used in a report) may no longer be accessible once deleted. If you unsubscribe from marketing emails, we’ll still send essential service messages if needed.

17. Email and Marketing Communications

If you’ve opted in to receive emails from CarbonSquare, we may send you: service updates or reminders, newsletters and insights on carbon reporting and sustainability, special offers or new feature announcements. You can unsubscribe at any time by clicking the “Unsubscribe” link in the footer of any marketing email — or by emailing us at support@carbonsquare.earth. We will never send spam or sell your contact details to third parties. If you only submitted your email to receive a report, we’ll only use it for that purpose — unless you give us permission otherwise.

18. Third-Party Services We Use

To operate CarbonSquare efficiently and deliver our services, we rely on a few trusted third-party tools. These providers may process your data on our behalf, under strict privacy and security standards: Google Analytics – to understand website traffic and improve user experience, Mailchimp – to manage newsletter subscriptions and send marketing emails, Hosting Provider (e.g. Vebex or equivalent) – to store data securely and ensure platform reliability, Form integrations – to collect user input and support carbon report requests. All third-party providers are GDPR-compliant or operate under appropriate safeguards such as Standard Contractual Clauses (SCCs). We only share the minimum data necessary and never for unrelated purposes.

19. Children’s Privacy

CarbonSquare is intended for business users and is not designed for or directed toward individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has submitted personal information without verified parental consent, we will take immediate steps to delete that data. If you believe a child has provided us with personal information, please contact us at support@carbonsquare.earth.

20. Links to Other Websites

Our website may include links to third-party websites or services that we do not control. Please note that this Privacy Policy applies only to CarbonSquare. Once you leave our site or interact with content hosted by a third party, their own privacy terms and policies apply. We encourage you to review the privacy policies of any external websites before providing personal information.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data practices. When we do, we’ll update the “Last updated” date at the top of this page. Significant changes will be clearly communicated via our website or email (if applicable). We encourage you to review this policy periodically to stay informed about how we protect your data. Your continued use of CarbonSquare after any updates means you accept the revised policy.

22. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, we’re here to help.

You can reach us at:

Email: support@carbonsquare.earth

Location: Linnaeuskade 32 Amsterdam, The Netherlands

KvK / CCI Registration Number: 92849121

We aim to respond to all inquiries within a few business days.