Privacy Policy

1. Who We Are

Atmosphere Carbon Ltd ("Atmosphere Carbon", "we", "us", "our") operates the website at atmospherecarbon.com. We are the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and where applicable the EU GDPR.

Contact our Privacy team at: privacy@atmospherecarbon.com
Postal address: Atmosphere Carbon Ltd, United Kingdom

2. Data We Collect

We may collect the following categories of personal data:

• Contact information: name, email address, company name, phone number — when you submit a contact or enquiry form.
• Purchase information: name, organisation, carbon offset tonnage — when you use the Buy Today / Offset Today section.
• Communications: the content of messages you send to us via contact forms or email.
• Technical data: browser type, operating system, referring URLs, and pages visited — collected via our web server logs for security purposes only.
• Preference data: your cookie notice dismissal status, stored in your browser's localStorage (not transmitted to us).

We do not collect financial payment data. Any future payment processing will be handled directly by PCI-DSS certified third-party processors.

3. Cookies & Local Storage

Atmosphere Carbon uses strictly necessary browser storage only.

We do not use advertising cookies, analytics cookies (e.g. Google Analytics), or any third-party tracking pixels. If this changes we will update this policy and present a consent banner before setting any non-essential cookies.

4. Legal Basis for Processing

• Legitimate interests (Art. 6(1)(f) UK GDPR): Responding to enquiries, maintaining site security, and detecting fraud.
• Contractual necessity (Art. 6(1)(b)): Processing purchase-related data to fulfil or prepare to fulfil a carbon offset transaction.
• Consent (Art. 6(1)(a)): Where you have explicitly opted in to marketing communications.

5. How We Use Your Data

• Responding to contact form submissions and enquiries
• Processing carbon offset purchases and issuing certificates
• Maintaining website security and preventing fraud
• Complying with legal obligations
• Sending service-related communications (not marketing, unless consented)

6. Data Sharing & Third Parties

We do not sell your personal data. We may share data with:

• Service providers: hosting, email delivery, and form processing — bound by data processing agreements.
• Regulatory authorities: where required by law or for carbon credit verification and registry purposes (e.g. Gold Standard, Verra).
• Professional advisers: lawyers, auditors, and insurers under confidentiality obligations.

7. International Transfers

Where personal data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions). Atmosphere Carbon's primary operations are based in the United Kingdom.

8. Data Retention

• Contact form data: retained for up to 2 years from last contact.
• Purchase records: retained for 7 years to comply with financial and tax regulations.
• Server logs: retained for 90 days for security purposes.

9. Your Rights

Under UK and EU GDPR you have the right to:

• Access — obtain a copy of your personal data we hold
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion ("right to be forgotten") where legally permissible
• Restriction — limit how we process your data in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — at any time where processing is consent-based

To exercise any right, email privacy@atmospherecarbon.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) (UK) or your local supervisory authority.

10. Children's Privacy

This website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, please contact us immediately.

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include HTTPS encryption, access controls, and regular security reviews. No method of transmission over the internet is 100% secure.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the site after changes constitutes acceptance of the revised policy.

13. Contact Us

For any privacy-related queries, requests to exercise your rights, or to report a concern: