Privacy Policy

1. Who we are

CarbonSync is a carbon emission tracking and CSRD compliance platform operated by CarbonSync AB, registered in Sweden. Our registered address is Stureplan 4C, Stockholm 114 35, Sweden. You can reach us at [email protected].

CarbonSync acts as the data controller for personal data processed through our website and platform.

2. What personal data we collect

We collect personal data in the following circumstances:

• Contact and demo requests: name, company name, email address, and any information you include in your message.
• Platform accounts: name, email address, job title, company name, and account credentials.
• Website usage: IP address, browser type, pages visited, time spent, and referring URL, collected via functional cookies and server logs.
• Communications: content of emails or messages you send us.

We do not collect special category data (such as health data, political opinions, or biometric data) through our website or platform.

3. Legal basis for processing

We process your personal data on the following legal bases:

• Contract: processing necessary to provide the services you have requested or signed up for.
• Legitimate interests: processing for fraud prevention, security, improving our services, and communicating with prospective customers who have expressed interest. We have assessed that these interests are not overridden by your rights.
• Legal obligation: processing required to comply with applicable laws, including tax and financial reporting obligations.
• Consent: where we rely on consent (for example, for optional marketing communications), you may withdraw it at any time.

4. How we use your data

We use personal data for the following purposes:

• Responding to demo requests and enquiries
• Providing and managing platform access
• Sending service communications (onboarding, updates, security alerts)
• Improving website functionality and user experience
• Complying with legal and regulatory obligations
• Preventing fraud and protecting platform security

We do not sell personal data. We do not use personal data for automated profiling that produces legal or similarly significant effects without human review.

5. Who we share data with

We share personal data with third parties only where necessary:

• Service providers: hosting, email delivery, customer support tooling, and analytics providers acting as data processors under written agreements that include GDPR-compliant data processing terms.
• Professional advisors: lawyers, accountants, and auditors under obligations of confidentiality.
• Regulatory authorities: where required by law or court order.

All service providers are required to implement appropriate technical and organizational security measures and may not use your data for their own purposes.

6. International transfers

Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or an adequacy decision for the receiving country.

7. How long we keep your data

We retain personal data for as long as necessary for the purposes described in this policy:

• Enquiry and contact data: up to 2 years from last contact
• Platform account data: for the duration of the contract plus 3 years
• Invoice and transaction records: 7 years (Swedish accounting law requirement)
• Website log data: up to 12 months

When we no longer need data, we delete or anonymize it securely.

8. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your data where there is no legitimate reason to continue processing it
• Restriction: request that we limit processing in certain circumstances
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se, or with the supervisory authority in your EU member state.

9. Security

We implement technical and organizational measures to protect personal data against unauthorized access, loss, or destruction. These include encryption in transit and at rest, access controls, and regular security assessments. No system is completely secure; if you have reason to believe your data has been compromised, contact us immediately at [email protected].

10. Cookies

We use cookies to keep the site functional and understand usage patterns. We do not use advertising or profiling cookies. For full details, see our Cookie Policy.

11. Changes to this policy

We may update this policy periodically. Material changes will be notified via email to registered users or by a prominent notice on this page. The date at the top of this page reflects the most recent revision.

12. Contact

Questions about this policy or your personal data:

CarbonSync
Stureplan 4C, Stockholm 114 35, Sweden
[email protected]