PRIVACY POLICY

1. Controller

The controller responsible for processing personal data on this website is:

CarbonStack GmbH
c/o Digital Hub Logistics
Am Sandtorkai 32
20457 Hamburg
Germany

Represented by its managing director, Jesper Kolk

Email: info@carbonstack.de
Phone: +49 (0)40 555 77 873

If you have any questions about data protection, you can reach us using these contact details.

2. Key points at a glance

We process personal data to operate this website securely and analyse its use, to answer your enquiries and to run our grievance mechanism.
We only set analytics cookies with your consent. We do not use advertising or marketing trackers.

3. Hosting by Squarespace

This website is built and operated with Squarespace. The provider is Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, D08 N12C, Ireland (“Squarespace”).

When you visit our website, Squarespace processes technically necessary data on our behalf, in particular:

IP address
date and time of access
page visited and referrer URL (the page you came from)
browser, operating system and device type

This data is needed to deliver the website, keep it stable and secure, and prevent misuse. Fonts, images and videos are also delivered via Squarespace’s servers. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in operating the website securely and reliably.

We have a data processing agreement with Squarespace in accordance with Art. 28 GDPR (part of Squarespace’s terms of service). Data may also be transferred to the parent company, Squarespace, Inc., in the USA. Squarespace, Inc. is certified under the EU-U.S. Data Privacy Framework; such transfers are based on the European Commission’s adequacy decision (Art. 45 GDPR). More information: Squarespace privacy policy.

4. Cookies and your consent

Cookies are small text files stored by your browser. We treat similar technologies, such as your browser’s local storage, in the same way.

Necessary cookies are set without your consent because the website cannot otherwise function securely. They include “crumb” (protection against cross-site request forgery, deleted at the end of the session), “test” (checks whether your browser supports cookies), “ss_performanceCookiesAllowed” and “ss_marketingCookiesAllowed” (store your cookie choice, 30 days) and “squarespace-video-player-options” (stores video settings in local storage). The legal basis is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Art. 6(1)(f) GDPR.

Analytics cookies from Squarespace Analytics (“ss_cid”, “ss_cpvisit” and “ss_cvr”, each up to two years; “ss_cvisit” and “ss_cvt”, each 30 minutes) are only set if you consent in the cookie banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

You can change your choice and withdraw your consent at any time using the “Cookies” button at the bottom of the screen. You can also delete or block cookies in your browser.

5. Visitor statistics with Squarespace Analytics

Squarespace compiles statistics for us on how our website is used. This involves processing, in particular, the pages visited, date and time, referrer, browser, operating system and device type, and your approximate location (derived from your IP address). We only use this data for statistical analysis to improve the website and do not combine it with other data about you.

Without your consent, the statistics work without cookies: each page view is counted separately and your device is not recognised. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is understanding the reach and use of our website.

With your consent, Squarespace additionally sets the analytics cookies listed in section 4 to recognise repeat visits and related page views. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG; you can withdraw your consent at any time with effect for the future.

The provider is Squarespace (see section 3), again acting as our processor, with possible transfers to the USA under the EU-U.S. Data Privacy Framework.

6. Contact by email or phone

If you contact us by email or phone, we process the information you provide (e.g. name, contact details, content of your enquiry) in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR; our legitimate interest is responding to your enquiry. We delete the data once your request has been fully dealt with, unless retention obligations under commercial or tax law require us to keep it.

7. Grievance mechanism (Grievance Redress Mechanism)

For our project VCS 5485, we operate a grievance mechanism in accordance with the requirements of the Verified Carbon Standard (Verra). You can submit grievances and feedback using the form on our Grievances page.

Data processed: title and description of the grievance, whom the grievance is against, the interest group you represent, and your choices regarding follow-up and publication. First and last name, email address and organisation are voluntary: you can also submit your grievance without giving any personal details (anonymously). Without an email address, however, we cannot reply to you. Please only include personal data of other people where this is necessary to handle the grievance.

Purpose and legal basis: We use this information to review and respond to your grievance and to document the process. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future, and our legitimate interest in a proper and verifiable grievance mechanism under the Verra standard (Art. 6(1)(f) GDPR).

Recipients: Submissions are stored by Squarespace on our behalf (see section 3) and forwarded to us by email. Verra only receives a summary in the monitoring report that cannot be linked to individual persons. The project’s independent validation/verification body may inspect the records where this is necessary for validation or verification. Grievances are only published if you have agreed, and only without personal information.

Retention: We keep your information until the grievance has been fully dealt with and for as long as we need to demonstrate proper handling to Verra and the validation/verification body. We then delete or anonymise it.

Spam protection (Google reCAPTCHA): The form is protected against automated submissions by Google reCAPTCHA. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the page with the form is loaded, reCAPTCHA evaluates technical information such as your IP address, browser and device details and your behaviour on the page in order to distinguish humans from bots. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the form against spam and misuse. Where information is stored on or read from your device, this is strictly necessary to protect the form you are using (Section 25(2) no. 2 TDDDG). More information: Google privacy policy. If you prefer not to use the form, you can also send your grievance by email to info@carbonstack.de or by post.

8. Links to other websites

Our website contains links to other websites, for example to our LinkedIn profile, the Verra Registry, Google Maps and our partners. These are simple links, not embedded plug-ins: no data is transferred to these providers when you view our pages. Only when you click a link are you taken to the provider’s website, where its privacy policy applies.

9. SSL/TLS encryption

This website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

10. Obligation to provide data; automated decision-making

You are not obliged to provide us with personal data. However, the website cannot be displayed without the technically necessary data, and we cannot accept a grievance via the form without the required fields. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

11. Your rights

Under the GDPR, you have the right to

access the data we hold about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR).

To exercise these rights, simply contact info@carbonstack.de or write to the postal address in section 1.

12. Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

13. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.