Privacy notice

This notice explains what personal data CarbonPrice.co.uk collects, why, and your rights under UK data protection law. CarbonPrice.co.uk is the controller of your data. You can reach us at hello@carbonprice.co.uk or through our contact form.

What we collect

• Price alerts: your email address and the alerts you chose, used only to send those alerts.
• Enquiries and CBAM help requests: the details you give us (name, email, company, phone, what you import and your message), used to reply to you.
• Accounts: your email address, the plan you are on and when you signed in. Sign-in codes and links are stored only as one-way hashes and expire after 15 minutes.
• Purchases: your email, company details and the answers you enter to build a Carbon Reduction Plan or UK CBAM pack (such as energy use, supplier names and contacts), used to make and deliver what you bought and to let you download it again. Your Carbon Reduction Plan also has a web copy that anyone with its link can open; it is not listed on the site or in search engines. Card payments are handled by Stripe, and we never see your full card number.
• CarbonPrice Pro: the import and supplier records you add, used to run your workspace and threshold tracker.
• Abuse prevention: a one-way hash of your IP address, used to stop spam and repeated submissions. We cannot turn it back into your IP address.
• Analytics: Google Analytics records how the site is used, such as pages viewed and device type, so we can see which pages help people and improve them. We use it for aggregate statistics only, with Google signals and ad personalisation switched off.

Cookies and similar technologies

• cpc_session keeps you signed in, and cpc_in tells the menu you are signed in. They are only set when you sign in.
• Your browser’s local storage keeps your Carbon Reduction Plan answers as you type, so you do not lose them if you leave the page.
• Google Analytics cookies (named _ga and _ga_ followed by an ID) measure use of the site as described above. We rely on the exception for statistical purposes in the Privacy and Electronic Communications Regulations, so we do not ask for consent, but you can object at any time below. If your browser sends a Global Privacy Control signal, we treat it as an objection.
• cpc_noga remembers that you turned analytics off.

Our lawful basis

• Accounts, purchases and Pro: to perform our contract with you.
• Alerts: your consent, which you can withdraw with the unsubscribe link in every email.
• Enquiries, analytics and abuse prevention: our legitimate interests in replying to people who contact us, improving the site and keeping it safe.
• Sales records: our legal obligation to keep tax records.

Who we share it with

We use trusted processors to run the site: Vercel (hosting), Supabase (database), Resend (email), Stripe (payments), Telegram (internal alerts to us about new enquiries and orders) and Google (analytics). Some of them process data outside the UK; where they do, the transfer is covered by UK adequacy regulations or the standard contractual protections UK law requires. We do not sell your data. If you ask us to put you in touch with a CBAM provider, we will only pass on your details with your agreement.

How long we keep it

• Alert subscriptions: until you unsubscribe.
• Enquiries: up to 24 months, then deleted.
• Orders and payment records: 6 years, to meet tax record-keeping rules.
• Accounts and Pro workspace records: while your account is open, and deleted within 90 days of you asking us to close it, apart from order records.

Your rights

You can ask to see, correct, delete or download your data, or to restrict or object to how we use it, by emailing hello@carbonprice.co.uk. You can also complain to the Information Commissioner’s Office at ico.org.uk.