This explains what personal data Carbon Advisory Limited collects through this website and through the 360° Impact Portfolio service, why we hold it, how long we keep it, and what you can ask us to do about it.
Last updated to be completed.
360° Impact Portfolio is a trading name of Carbon Advisory Limited, registered in England and Wales, company number 13584867. Carbon Advisory Limited is the data controller for everything described here.
| What we collect | Why | Lawful basis | How long |
|---|---|---|---|
| Name, organisation and work email address, given through the enquiry form | To reply to your enquiry and know who we are speaking to | Legitimate interests — responding to a business enquiry we were asked to answer | to be completed, if the enquiry does not become an engagement |
| Intended claim, Impact Band, approximate volume, reporting deadline and whether credits are already held | To understand what you need and to tell you honestly whether it can be sourced | Legitimate interests — the same enquiry | As above |
| Contract, engagement and evidence-pack records, including the names of the people we deal with | To perform the contract, and to keep the record standing behind a claim you have made publicly | Performance of a contract, and legal obligation for accounting records | to be completed |
| Web server log data: IP address, request, timestamp and browser user agent | Keeping the site available, diagnosing faults and detecting abuse | Legitimate interests — security and availability | to be completed |
| Email delivery failure records | Making sure an enquiry that failed to send is not silently lost | Legitimate interests — the same enquiry | to be completed |
We do not ask for special category data and the form has no field that invites it. Please do not include health, political, religious, biometric or similar information in a free-text field. If you do, we will delete it.
The form carries one hidden field that people never see and automated submissions usually fill in. If it is completed, the submission is discarded and nothing is stored or sent.
Not essential ones, not analytics, not advertising. No session is started and no identifier is stored on your device. That is why there is no cookie banner: there is nothing to consent to.
One thing the pages need is served by a third party rather than by us, so your browser requests it directly and that provider receives your IP address and browser details as a normal part of serving a file. We do not receive anything back, and it is not used to identify or track you.
fonts.googleapis.com and fonts.gstatic.com.That request can be avoided by blocking third-party requests in your browser; the site will still work, though the typefaces will fall back to your system defaults. Everything else — stylesheets, scripts and images — is served from this domain.
We do not sell, rent or trade personal data, and we do not share it for anyone else’s marketing. It reaches other organisations in four circumstances only.
Our hosting provider
to be completed, which operates the servers this site runs on, located in to be completed. They process data on our instructions under a written agreement and for no purpose of their own.
Our email provider
to be completed, which carries and stores the enquiry once it is sent, in to be completed. Same terms.
Carbon credit registries, during an engagement
When credits are retired on your organisation’s behalf, the retirement record names your organisation as beneficiary and becomes publicly visible on the registry. That is the point of it: a retirement that names you is evidence, and a share of a bulk retirement is not. The record names the organisation rather than an individual.
Where the law requires it
To a regulator, a court or a law enforcement body where we are legally obliged to disclose, and to our professional advisers where we need advice. We do not volunteer data outside these situations.
Where a provider named above processes data outside the United Kingdom, the transfer is made under the safeguards UK data protection law requires, such as an adequacy decision or the International Data Transfer Agreement. The third-party requests described in the previous section may involve transfers to the United States as a consequence of your browser requesting a file.
The site is served over an encrypted connection and enquiries are transmitted to our inbox over an authenticated, encrypted mail connection. Access to enquiry and engagement records is limited to the people who need it to do the work. No transmission over the internet can be guaranteed completely secure, and we do not claim otherwise.
These rights are not absolute, and some do not apply to records we are required to keep. Where we cannot do what you have asked, we will tell you why rather than simply decline.
Access
Ask for a copy of the personal data we hold about you, and for an explanation of how we use it.
Rectification
Ask us to correct anything inaccurate, or complete anything incomplete.
Erasure
Ask us to delete data we no longer need. This does not extend to records we are required to keep, or to the evidence supporting a claim already made publicly.
Restriction
Ask us to pause processing while a question about accuracy or legitimate interests is resolved.
Objection
Object to processing that rests on our legitimate interests. If you object, we stop unless we can show compelling grounds that override your rights.
Portability
Ask for the data you gave us in a structured, commonly used, machine-readable form, or ask us to send it to someone else.
We do not rely on consent for the enquiry form, so there is no consent to withdraw. We make no automated decisions producing legal or similarly significant effects, and we do not profile you.
Exercising any of the rights above costs nothing, and we will respond within one month. Where a request is complex we may extend that by up to two further months, and we will tell you inside the first month if we need to.
By email at to be completed, or by post to Carbon Advisory Limited, 27 Old Gloucester Street, London, England, WC1N 3AX. We may ask you to confirm your identity before acting on a request, so that we do not disclose someone’s data to the wrong person.
If you are not satisfied with how we have handled your personal data or your request, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you raised it with us first so we have a chance to put it right, but you do not have to.
We update this notice when what we do changes. The date at the top of the page is the date of the current version. Where a change materially affects how we use data you have already given us, we will tell the people affected rather than rely on them noticing.
360° Impact Portfolio is a trading name of Carbon Advisory Limited, registered in England and Wales. Company number 13584867. Registered office: 27 Old Gloucester Street, London, England, WC1N 3AX. ICO registration to be completed.