1. Who We Are

CarboNature Ltd. (“CarboNature”, “we”, “us”, or “our”) operates the website carbonature.io and related digital platforms (collectively, the “Service”). We are a climate-tech company dedicated to unlocking agricultural carbon assets, enabling farmers to generate verified carbon credits and helping corporations achieve their Net Zero commitments.

2. Information We Collect

We collect information to provide and improve our Services. The types of information we may collect include:

Information You Provide Directly

• Account registration data: name, email address, phone number, company name, and role.
• Farmer & project data: farm location (GPS/coordinates), land area, crop types, soil data, and farming practice details submitted to our carbon assessment tools.
• Corporate buyer data: company size, carbon footprint goals, Net Zero commitments, and procurement preferences.
• Communication data: messages, inquiries, and information submitted through contact forms or emails.
• Meeting booking data: name, email, organisation, and preferred time slots when booking a meeting.

Information We Collect Automatically

• Usage data: pages visited, time spent on pages, links clicked, and features accessed.
• Device and technical data: IP address, browser type and version, operating system, and device identifiers.
• Cookies and tracking technologies: session cookies, analytics cookies, and similar technologies (see Section 7).
• Location data: approximate geographic location derived from your IP address.

Information from Third Parties

• Data from satellite imagery providers and remote sensing services integrated into our carbon measurement tools.
• Information from partner registries (e.g., Verra, Gold Standard) used to validate or enrich project data.
• Authentication data if you log in via Single Sign-On (SSO) providers.

3. How We Use Your Information

We process your personal data for the following purposes:

4. Sharing Your Information

We do not sell your personal data. We may share your information in the following circumstances:

• Service providers: Third-party vendors and contractors who assist in operating our platform (cloud hosting, analytics, email delivery, payment processing), bound by data processing agreements.
• Carbon registries and verification bodies: Where required to register, certify, or audit carbon credits on your behalf (e.g., Verra, Gold Standard, ISO-compliant auditors).
• Corporate buyers and agricultural partners: Aggregated or anonymised project data shared within the Marketplace to facilitate carbon credit transactions; personal data shared only with your explicit consent.
• Legal compliance: Where required by applicable law, regulation, or valid legal process.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality obligations.

5. International Data Transfers

CarboNature operates globally, including in Israel and Kenya. Where personal data is transferred outside the European Economic Area (EEA), we implement appropriate safeguards in accordance with applicable data protection laws, including:

• EU Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions, where recognised by the relevant authority.
• Other lawful transfer mechanisms as required by applicable law.

Israel has been recognised by the European Commission as providing an adequate level of data protection for personal data transferred from the EEA.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. Our general retention principles are:

• Account data: Retained for the duration of your account and for up to 5 years after account closure for legal and audit purposes.
• Carbon project data: Retained for the lifetime of the carbon credit and up to 10 years after project closure, as required by registry standards.
• Marketing communications: Until you withdraw consent.
• Analytics data: Up to 26 months in aggregated/anonymised form.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve our Service. Cookies may be:

• Strictly necessary: Required for the platform to function (session authentication, security tokens).
• Analytics: Help us understand how users interact with the site (e.g., Google Analytics).
• Functional: Remember your preferences and settings.
• Marketing: Used to deliver relevant content and measure campaign effectiveness (only with your consent).

You can manage your cookie preferences at any time through our Cookie Settings panel (available in the footer) or through your browser settings.

8. Your Rights

Subject to applicable law, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your personal data (“right to be forgotten”), subject to legal retention obligations.
• Right to restriction: Request that we limit processing of your data in certain circumstances.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent: Withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at Info@carbonature.io. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

9. Security

We implement industry-standard technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• End-to-end encryption for data in transit (TLS 1.2+) and at rest (AES-256).
• Role-based access controls and multi-factor authentication for platform access.
• Regular security assessments and penetration testing.
• Data minimisation and pseudonymisation practices.

In the event of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority as required by applicable law.

10. Children’s Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected such data, we will promptly delete it. If you believe a minor has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the “Last updated” date at the top of this page and, where appropriate, by sending you an email notification or displaying a prominent notice on our website.

Your continued use of the Service after such changes constitutes your acceptance of the updated Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please reach out to us: