This Privacy Policy applies to data processing by Goodcarbon GmbH ("Goodcarbon”, "Controller", "we" or "us").
When you visit our website https://www.goodcarbon.earth/ ("Website") or use our platform for the investment and trading of climate solutions to democratize access to the voluntary carbon market for anyone (the “Platform”) personal data is collected and processed, which we process in compliance with the applicable data protection regulations. Personal data is any information relating to an identified or identifiable natural person, e.g. name, address, and e-mail address. When processing your personal data, we observe the applicable data protection laws, especially the provisions of the General Data Protection Regulation (“GDPR”) and applicable local data protection laws.
This Privacy Policy describes which personal data we process, for which purposes and on which legal basis.
1. Name and Contact Details of the Controller
Your data is processed by the following data controller:
goodcarbon GmbH, Münzstraße 18, 10178 Berlin, Germany, e-mail: support@goodcarbon.earth
2. Collection and Storage of Personal Data as well as Method and Purpose of their Processing, relevant Legal Basis and Storage Period
2.1. Informative Use of our Website
During the mere informative use of our Website, i.e. if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server (so-called server log files), whereby logging only takes place to the technically necessary extent. The following information is collected:
The legal basis for the collection of this data is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest in collecting this data results from the following purposes:
2.2. Use of the Platform
If you want to use our Platform, you need to register with us and create an account. In this case, we collect the following data from you during registration:
In addition, we will ask you for a password that you can use to log into your account at any time in the future. We process the aforementioned data in order to fulfil the user contract for your Goodcarbon account as well as the purchase contract for the products with you. The legal basis of the data processing is therefore Art. 6 para. 1 lit. b) GDPR.
2.3. Contacting us per contact form or e-mail
When you contact us by contact form or e-mail, the data you provide (e.g. your e-mail address, name and telephone number, if applicable) will be processed by us in order to answer your questions.
We use your data exclusively for the purpose of answering your inquiry. The legal basis for this is Art. 6 para. 1 lit. f) GDPR (legitimate interest of processing inquiries and other requests). Your data will be deleted after processing your request unless further storage is necessary, e.g. when we have concluded a contract with you. In this case we process your data on the basis of Art. 6 para. 1 lit. b) GDPR.
2.4. Website Optimisation and Website Analysis
(a) Functional Cookies
Our Website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on your computer. The cookie contains a string of characters that allows your system to be uniquely identified when you return to the Website.
Most of the cookies we use ("Session Cookies") and the data stored and transmitted in them are automatically deleted at the end of your visit. Other cookies ("Persistent Cookies") remain stored on your end device until you delete them.
Some elements of our Website require that the calling browser can be identified even after a page change. Cookies may be stored for this purpose, which enable us to recognise your browser on your next visit. If personal data are processed by the cookies, we process them on the basis of a balancing of interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, which always also takes your interests into account.
(b) Analysis Cookies
We set various cookies only after your consent, which you can select during your visit to our website using the cookie consent tool. The functions are only activated in the event of your consent and may serve in particular to enable us to analyse and improve the use of our website, to make it easier for you to use it via different browsers or terminal devices or to recognise you when you visit us again. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. a GDPR. The revocation of your consent is possible at any time without affecting the permissibility of processing until the revocation.
c) Applied Services
We use the following Analysis Cookies:
Google Analytics
For the analysis of your use of our Website, we use "Google Analytics" a service of the Google LLC group, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Google LLC is an organization which participates in the EU-U.S. Data Privacy Framework. The certified US companies are listed in a database , which you can view here: https://www.dataprivacyframework.gov/list.
Google Analytics uses cookies. The information generated by cookies about your use of our Website is usually transferred to a Google server in the USA and stored there. The storage of Google Analytics cookies and the use of this analysis tool are based on your express consent in accordance with Art. 6 para. 1 lit. a) GDPR. Your consent can be revoked at any time.
We have activated the IP anonymisation function. This means that your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted to the USA. Google will use this information on our behalf for the purpose of evaluating your use of the Website, compiling reports on Website activity and providing other services relating to Website activity and Internet usage. You have the option to prevent the storage of cookies by changing the settings of your browser software accordingly.
You can also prevent the collection of data generated by the cookie and related to your use of the Website (including your IP address) by Google and the processing of this data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en. For more information about the processing of user data by Google Analytics, please refer to Google's privacy policy at: https://support.google.com/analytics/answer/6004245?hl=en.
Hubspot
For the analysis of your use of our website we use “Hubspot”, a service of HubSpot, Inc, 25 First Street, Cambridge, MA 02141 US
HubSpot Inc. is an organization which participates in the EU-U.S. Data Privacy Framework. The certified US companies are listed in a database , which you can view here: https://www.dataprivacyframework.gov/list. HubSpot tracks visitors using browser cookies.
Every time a visitor lands on our website, HubSpot will check for an existing tracking cookie. If one does not exist, a cookie will be associated with that visitor and will log every page that person visits moving forward. The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. a GDPR. The revocation of your consent is possible at any time without affecting the permissibility of processing until the revocation.
SoPro
For the analysis of your use of our website we use “SoPro”, a service of Prospect Global Ltd, Reg. UK Co. 09648733. You can view their privacy policy here: http://sopro.io. Sopro are registered with the ICO Reg: ZA346877
SoPro tracks various statistics, such as the number of unique visitors and page views generated.
The legal basis for this processing is Art. 6 para. 1 sentence 1 lit. a GDPR. The revocation of your consent is possible at any time without affecting the permissibility of processing until the revocation.
2.5. Newsletter
If you give us your explicit consent, we will send you information about our services and offers by e-mail. For this purpose, we process your name and e-mail address as well as optionally your company name. This processing is based on your consent in accordance with Article 6 para 1 sentence 1 lit a) GDPR. When you register for our newsletter, we use the double opt-in procedure.
This means that after you have registered with your e-mail address, we will send you an e-mail to the specified e-mail address in which we ask you to confirm that you actually wish to receive the newsletter. For sending newsletters, we use the service SendGrid (or also "Twilio SendGrid") of the company Twilio Inc., 375 Beale Street, Suite 300, San Francisco, CA 94105, United States. We have concluded a Data Processing Agreement (“DPA”) according to Art. 28 GDPR with Twilio Inc.
The sending of our newsletters is organized and analyzed by this service provider. By using SendGrid we notice whether an e-mail has been opened or not. For this purpose, SendGrid uses so-called "web beacons". This is a reference to a small graphic that is embedded in the text of the e-mail. When you open the e-mail, your e-mail program calls up this graphic from SendGrid's web server. Just like when you visit a website, the web server now stores from where the graphic was accessed and can therefore determine that you have viewed and read this email. SendGrid collects the following data from you:
With the help of SendGrid, it is possible for us to analyze our newsletter campaigns. For example, we can see which links in the newsletter, if any, were clicked. In addition, we can see whether certain previously defined actions were performed after opening/clicking (conversion rate). We can thus recognize, for example, whether you have visited our website after clicking on the newsletter.Analyzing the use of our newsletter to understand how we can improve our service is based on our legitimate interest. The legal basis is Art. 6 para. 1 lit. f GDPR.
2.6. Job Applicants
If you apply for a position at Goodcarbon, we will collect and process the personal data you send us for the purpose of carrying out the application procedure. We will collect in particular the following data: your first and last name, your e-mail address, your contact details and the information contained in any application documents such as cover letter, resume and references.
We process your application data solely to determine whether your skills and qualifications match our requirements profile. The legal basis for processing of your application data is Art. 6 para. 1 lit. b) GDPR in connection with Section 26 German Federal Data Protection Act (“BDSG”) If your application is successful, we will transfer the application data collected during the application process to your personnel file.
If your application is not successful, we will generally store your application data for a maximum of 6 months after completion of the relevant application procedure in order to be able to defend ourselves against any legal claims. The legal basis for this storage is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest in this context stems from the burden of proof in proceedings, e.g. in a procedure under the German General Equal Treatment Act (AGG).
3. Storage Period
We process and store your personal data only for the period necessary to achieve the aforementioned purposes or as far as this is granted or demanded by the European legislator or other legislators in laws or regulations to which we are subject to. In case we have concluded a contract with you regarding the provision of services we store your data as long as it is necessary for the processing of the existing agreement with you, i.e. until the expiry of the statutory or possible contractual warranty rights. After expiry of this period, we retain the information of the contractual relationship as long as this is required under applicable commercial and tax law.
4. Recipients or categories of recipients of your personal data
We sometimes use external service providers to process your data (e.g. IT service providers). In part these service providers process your personal data as data processors on our behalf, in accordance with our instructions and under our supervision exclusively for the purposes described in this Privacy Policy according to Art. 28 GDPR, in part they act as independent data controllers. In the last case we only forward your personal data if necessary for the fulfillment of the contract, in which case the legal basis for the transfer is Art. 6 para. 1 lit. b) GDPR.
4.1. DigitalOcean Hosting
We store the data that we process on servers operated by DigitalOcean LLC, 101 Avenue of the Americas 10th Floor New York, NY 10013 United States, (“DigitalOcean”). We store data that you enter yourself on our website on the servers of DigitalOcean (registration data such as email address) as well as data that we automatically collect from you when you visit our website and use our app (such as your IP address and your location). We have concluded a DPA with DigitalOcean according to Art. 28 GDPR. Your personal data is stored exclusively on servers in Frankfurt and is therefore not transferred to data recipients outside the European Union. For more information about data protection at Digital Ocean, please visit https://www.digitalocean.com/legal.
5. Transfer of Data to Third Party Countries
Your personal data may be transferred or disclosed to third party companies which can be located outside the European Economic Area (EEA), i.e. in third countries. This concerns the use of the following service:
Twilio Inc, Google LLC and HubSpot Inc. are organizations which participates in the EU-U.S. Data Privacy Framework. The certified US companies are listed in a database, which you can view here: https://www.dataprivacyframework.gov/list.
6. Data Security
All personal data transmitted by you is transferred using the secure and proven SSL (Secure Socket Layer) standard. We also use appropriate technical and unauthorized security measures to protect stored personal data against manipulation, partial or complete loss and unauthorized access by third parties. Our security measures are continuously improved in line with technological developments. In particular, we ensure that sensitive personal data is only stored on servers hosted in the EU that are certified in accordance with DIN ISO/IEC 27001 (as amended from time to time).
7. Your Rights
In relation to our processing of your personal data, you are entitled to the following rights free of charge:
1) You have the following rights vis-à-vis us as the controller with regard to the personal data concerning you:
2) You also have the right to complain to a data protection supervisory authority about the processing of your personal data by us.
The supervisory authority responsible for us is:
Die Berliner Beauftragte für Datenschutz und Informationsfreiheit
Anschrift: Alt-Moabit 59-61, 10555 Berlin
Telefon: +49 30 13889-0
Fax: +49 30 2155050
E-Mail: mailbox@datenschutz-berlin.de
8. Automated Individual Decision-Making including Profiling pursuant to Art. 22 GDPR
We do not process your data for automated decisions in individual cases, including profiling within the meaning of Art. 22 GDPR.
Berlin, September 5, 2024