Privacy Policy and Personal Data Notice
Effective date: [EFFECTIVE DATE] · Version: [VERSION]
This notice explains how your personal data is processed when you visit the Carbonity website, request a demo, use the Carbonity application as a user of a customer account, or enter data through the supplier portal. It combines the information required by Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, to the extent it applies, Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR").
1. Who we are and how to contact us#
| Controller | [COMPANY NAME] ("Carbonity", "we") |
| Address | [ADDRESS] |
| MERSIS no. | [MERSIS NO] |
| Trade registry | [TRADE REGISTRY OFFICE AND NUMBER] |
| info@carbonity.ai | |
| Registered electronic mail (KEP) | [KEP ADDRESS] |
| Representative in the EU (GDPR Art. 27) | [EU REPRESENTATIVE NAME AND ADDRESS — if appointed; otherwise remove this row] |
No data protection officer has been appointed. For any question about your personal data, write to info@carbonity.ai.
2. Who this notice covers and Carbonity's role#
Carbonity is a business-to-business software service that lets companies manufacturing products from CBAM-covered inputs calculate embedded emissions per product. Our role in processing personal data depends on who you are:
| You are | Carbonity's role | Explanation |
|---|---|---|
| A website visitor / a person requesting a demo | Controller | We collect the information you enter in the demo request form and use it to get back to you. |
| A user of a customer account (customer administrator, analyst, viewer) | Mostly processor; controller for limited matters | Your account is opened by our customer, your employer (or by us on its behalf). For the personal data held in the application, our customer is the controller; we process that data on its instructions and on its behalf. We are the controller for managing the customer relationship (contacting the authorised person for contract and account administration) and for keeping the service secure. |
| A supplier's contact person / a person using the supplier portal | Mostly processor | Your contact details are entered into the application by our customer that requests emission data from you. The controller for that data is the company requesting data from you (named in the email and in the portal). We process the data on its behalf. |
Where we act as processor, we recommend sending requests about your rights first to the relevant customer (your employer, or the company requesting data from you); we forward requests that reach us to that customer.
3. What personal data we process#
3.1. Website and demo request#
- Demo request form: full name, company name, work email (these three are required); phone, country, range of the number of products to be calculated, and your free-text note (optional); the interface language in which you submitted the form and the time of submission. The staff member handling your request may add a status (new / contacted / closed) and an internal note to the record.
- Your IP address is not stored. To prevent abuse, the number of requests from one IP address is limited; for this purpose the IP address is held only in a counter in the server's memory for the counting window (at most one hour); it is not written to the database or to the demo request record.
- The form contains a hidden field and a minimum fill-time check to tell automated submissions apart. These are not stored. No third-party verification service (CAPTCHA) is used.
- The website uses no analytics, advertising or tracking tools; no profile is built about your visit.
3.2. Customer account users#
- Identity and account data: full name, email address, role (customer administrator / analyst / viewer), whether the account is active, the customer account you belong to.
- Authentication data: an irreversible hash of your password (the password itself is not stored); if you use two-step verification, the secret key paired with your authenticator app, the number of failed verification attempts and any temporary lock; hashes of session refresh tokens with their issue and expiry times.
- Preferences: interface language, email notification preference, whether the onboarding guide has been shown and completed.
- Activity records (audit log): the create, update and delete actions you perform in the application are recorded with your name, the time, the type of record concerned and the previous and new values of the changed fields. Your user identifier is kept on files you upload and on decisions you make (e.g. accepting or rejecting a supplier submission, finalising a calculation).
- Notifications and emails: in-app notifications shown to you; the recipient address, subject, content, language, delivery status and time of emails sent to you.
- Technical records: server logs contain the request method, request path, response code and duration. The application's own request logs do not record IP addresses. The access logs of the [HOSTING PROVIDER AND COUNTRY] infrastructure (which may contain IP addresses) are separate.
3.3. Supplier contact persons and supplier portal users#
- Contact details entered by our customer: the supplier company's name, tax number and address, together with the contact person's name, email address and phone; the email address the data request is sent to.
- Portal use: the fact and time that your personal link was opened; submissions made through the link and their times; the email address to which the link used for the submission was issued. The portal requires no account and no password.
- Data you enter: emission values per installation and product (CN code), the data year, the production route; the verifier's name, accreditation number and validity date, the verification report's number, date and opinion; the verification report file you upload (including any names and signatures inside it). This is essentially your company's business data; it is covered by this notice to the extent it contains personal data.
- Sharing consent: when you confirm sharing a record you entered earlier with another of our customers, we record the email address the link was issued to and the time of the confirmation.
- Emails sent to you: the recipient address, content, delivery status and time of data request, reminder, acceptance and rejection messages.
3.4. Data we do not process#
We neither request nor process special categories of personal data (health, biometric data, etc.). The service is intended for business users; please do not enter special-category or unnecessary personal data in free-text fields or uploaded files. No decision producing legal effects about you is taken solely by automated processing; no profiling takes place.
4. Purposes and legal bases#
| Purpose | Data | KVKK Art. 5 | GDPR Art. 6 |
|---|---|---|---|
| Answering your demo request, contacting you, preparing an offer | Demo request data | Art. 5/2(c) directly related to the conclusion of a contract; Art. 5/2(f) legitimate interest | Art. 6(1)(b) pre-contractual steps; Art. 6(1)(f) legitimate interests |
| Opening and administering the customer account, performing the contract, contacting the customer's authorised person | Account and contact data | Art. 5/2(c) performance of a contract; Art. 5/2(f) | Art. 6(1)(b); Art. 6(1)(f) |
| Authentication, session management, preventing unauthorised access and abuse | Authentication data, session records, rate-limit counter | Art. 5/2(f); Art. 5/2(ç) with regard to the data security obligation under Art. 12 | Art. 6(1)(f); Art. 6(1)(c) (Art. 32) |
| Keeping calculations and their underlying data traceable and intact (audit log) | Activity records | Art. 5/2(c); Art. 5/2(f); Art. 5/2(e) establishment, exercise or protection of a right | Art. 6(1)(b); Art. 6(1)(f) |
| Collecting emission data from suppliers: data request, reminder, acceptance and rejection notices | Supplier contact data, portal records | Our customer is the controller and determines the legal basis (typically Art. 5/2(c) and 5/2(f)) | Determined by our customer (typically Art. 6(1)(f)) |
| Sending in-app notifications and transactional emails | Email address, notification preference | Art. 5/2(c); Art. 5/2(f) | Art. 6(1)(b); Art. 6(1)(f) |
| Complying with legal obligations, protecting rights in disputes | Relevant records | Art. 5/2(ç); Art. 5/2(e) | Art. 6(1)(c); Art. 6(1)(f) |
We do not carry out any processing based on consent. We do not use demo request data to send you marketing messages. Where we rely on legitimate interests, our interest is to provide the service securely, to answer your request and to keep calculations auditable.
If you do not provide information marked as required, the related action cannot be carried out (e.g. a demo request cannot be accepted without a work email; you cannot sign in without email and password).
5. Where we obtain your data#
- Directly from you: the demo request form, the sign-in and account screens, the supplier portal; entirely by automated means (electronic form and application).
- From our customer (indirect collection): the name, email and role of customer account users are entered by the administrator who opens the account; a supplier contact person's name, email and phone are entered or uploaded by users of our customer that requests data from you. In that case your data reaches us from that company; we do not collect data from publicly available sources.
6. Who we share your data with#
We do not sell your personal data and do not share it with anyone for advertising. Data is disclosed only to the recipients below, for the stated purpose:
| Recipient | Purpose | Note |
|---|---|---|
| Hosting and infrastructure provider: [HOSTING PROVIDER AND COUNTRY] | Hosting the application, database and files | As processor, under contract |
| Email delivery provider: [EMAIL SERVICE PROVIDER AND COUNTRY] | Delivering transactional emails | Only if email sending is enabled; recipient address and message content are transferred |
| Our customer (the company your account belongs to, or that requests data from you) | Providing the service | The customer's authorised users see the data in their own account, the audit log and the list of emails sent from the account |
| Other customers with whom you share data for the same installation | Sharing an emission record with the supplier's approval | Only when the supplier expressly confirms in the portal; see the note below |
| Competent public authorities and courts | Legal obligation | Only where and to the extent required by law |
| Legal, accounting and audit advisers | Protecting rights, legal obligations | Under a duty of confidentiality, to the extent necessary |
Note on the shared installation and emissions registry. Identifying details of source installations (installation code, name, address, country, operator name, CBAM registry number if any, production route) are kept in a registry shared by Carbonity customers and are searchable by all customers; which other customers use an installation is not shown. An installation's emission record and verification document can be seen only by the customer that entered the record or with whom the supplier has confirmed sharing it. The email address to which the link used for the submission was issued is shown to the customers that can see that record.
The application uses no third-party analytics, advertising, social media or error-tracking service; fonts and other interface files are loaded from Carbonity's own server, and your browser sends no request to a third-party server.
7. International transfers#
Your data is stored on servers of [HOSTING PROVIDER AND COUNTRY].
- If the servers are located outside Türkiye, your data is transferred abroad. Such a transfer is made under KVKK Art. 9: on the basis of an adequacy decision for the country concerned or, in its absence, one of the appropriate safeguards listed in Art. 9/4 (such as signing the standard contract published by the Personal Data Protection Board and notifying it to the Board): [INTERNATIONAL TRANSFER MECHANISM].
- Where the GDPR applies, transfers outside the European Economic Area (including to Türkiye) are made in accordance with Chapter V GDPR; for countries without an adequacy decision, on the basis of the European Commission's standard contractual clauses or another appropriate safeguard under Art. 46. You may request a copy of the safeguards from info@carbonity.ai.
- If our customer or the supplier contact person is in another country, the data is by the nature of the service also viewed by the relevant users in that country (e.g. the EU buyer of a manufacturer in Türkiye, or its supplier in a third country).
8. How long we keep your data#
We keep your data for as long as necessary for the purpose for which it is processed and for the retention and limitation periods laid down by applicable law; when the period ends we erase, destroy or anonymise it.
| Data | Retention |
|---|---|
| In-app notifications | 90 days from creation; then deleted automatically |
| Session access token | 15 minutes (browser memory only) |
| Session refresh cookie | 14 days; replaced at every refresh, invalidated on sign-out |
| Supplier portal link | The period set by the customer (14 days by default, 90 days at most); the link stops working when it expires |
| IP address in the rate-limit counter | For the counting window (at most 1 hour), in memory only |
| Demo request records | [DEMO REQUEST RETENTION PERIOD] |
| User account data | For the term of the contract with the customer and [ACCOUNT DATA RETENTION PERIOD] after it ends |
| Supplier contact data and portal submissions | As instructed by our customer; [POST-CONTRACT RETENTION PERIOD] after the contract ends |
| Records of emails sent | [OUTBOX RETENTION PERIOD] |
| Audit log, finalised calculations, emission records and verification documents | These records are kept in a form that cannot be altered or deleted, so that calculations can be verified later; they are retained for [AUDIT LOG RETENTION PERIOD] (see section 11) |
| Server logs | [LOG RETENTION PERIOD] |
9. Cookies and browser storage#
Carbonity uses only the cookies and browser storage that are necessary for the service to work. There are no analytics, advertising, social media or third-party cookies. Merely visiting the website writes no cookie to your device; if you choose a language, your choice is stored in your browser.
| Name | Type | Purpose | Duration | When it is set |
|---|---|---|---|---|
carbonity_rt | Cookie (first-party; HttpOnly, SameSite=Strict, Secure over HTTPS; sent only to the /api/v1/auth path) | Keeping you signed in (refresh token) | 14 days; renewed at every refresh | When you sign in |
carbonity.session | Local storage | A marker that a session may be open in this browser (value "1"); contains no secret and grants no access | Until you sign out or the session ends | When you sign in |
carbonity.language | Local storage | The interface language you chose | Until you delete it | When you choose a language or your saved preference is loaded |
carbonity.tour.v1.<user id> | Local storage | The step you reached in the onboarding guide | Until you delete it | When a signed-in user uses the guide |
carbonity.portal.language | Session storage | The language you chose in the supplier portal | Until the tab is closed | When you choose a language in the portal |
Because these are strictly necessary to provide the service, or remember a preference you expressly requested, your consent is not asked. You can delete or block cookies and site data in your browser settings; if you block the session cookie you cannot sign in.
10. How we protect your data#
The technical measures in place in the application today are:
- Passwords are stored only as an irreversible hash (PBKDF2); a password must be at least 12 characters.
- Two-step verification (a one-time code from an authenticator app) is mandatory for customer administrators and system administrators; after five consecutive failed attempts the account is locked for 15 minutes.
- The access token is short-lived (15 minutes) and held only in browser memory. The refresh token sits in a cookie that browser scripts cannot read (HttpOnly), changes at every use, and only its hash is stored in the database; if reuse of an already used token is detected, the whole session chain is revoked.
- Each customer's data is logically separated from the others: customer-specific records can be queried only within that customer's session. Permissions are enforced by role on the server.
- The supplier portal link is randomly generated, time-limited and restricted to the installation and product codes in the request; the database holds a hash of the link and an encrypted (AES-256-GCM) copy. The link is never shown again to any user inside the application.
- IP-based rate limiting is applied to the sign-in, session refresh, supplier portal and demo request endpoints.
- Create, update and delete actions are written to an append-only audit log; secret fields such as the password hash and the two-step verification key are not written to it.
- File type and size limits apply to uploaded files.
No method provides absolute security. In the event of a breach affecting your personal data we make the notifications required by law. To keep your account secure, do not share your password or your personal portal link with anyone.
11. Your rights#
Under KVKK Art. 11 you may apply to the controller to: learn whether your personal data is processed; request information if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties to whom it is transferred in Türkiye or abroad; request rectification if it is incomplete or inaccurate; request erasure or destruction under the conditions of Art. 7; request that rectification and erasure be notified to third parties to whom the data was transferred; object to a result to your detriment arising from analysis of the data exclusively by automated systems; and claim compensation if you suffer damage due to unlawful processing.
Where the GDPR applies you also have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and not to be subject to a decision based solely on automated processing (Art. 22).
A limit on erasure requests. The audit log, finalised calculations, emission records and verification documents are technically kept in a form that cannot be altered or deleted, so that calculations can be verified later. Requests to erase personal data contained in those records (e.g. the name of the user who performed an action, the email address a submission was made from) are assessed in the light of the legal grounds and retention periods that require those records to be kept; if your request cannot be met, you will be told why.
How to apply#
You may send your application, in line with the Turkish Communiqué on the Principles and Procedures for Applications to the Data Controller:
- in writing (with wet signature) to [ADDRESS],
- to the registered electronic mail address [KEP ADDRESS],
- with a secure electronic signature or mobile signature, or
- to info@carbonity.ai from the email address you previously gave us and that is recorded in our system.
The application must include your name and surname, your signature (for written applications), your Turkish ID number (for foreign nationals: nationality and passport or ID number), your residential or business address for notifications, your email address and phone number if any, and the subject of your request. We may ask for additional information to verify your identity.
We conclude your application as soon as possible and within thirty days at the latest, free of charge; if the action entails a separate cost, the fee in the tariff set by the Board may be charged. Requests under the GDPR are answered within one month; depending on the complexity of the request this period may be extended to the extent the law allows.
Applications concerning data for which we are processor (user and supplier contact data in a customer account) are forwarded to the relevant customer, and we assist in answering them.
Right to complain#
If your application is refused, the answer is unsatisfactory or no answer is given in time, you may lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr) within thirty days of learning of the answer and in any event within sixty days of the application date. Where the GDPR applies, you have the right to lodge a complaint with the data protection supervisory authority of the EU Member State of your habitual residence, your place of work or the place of the alleged infringement.
12. Children#
Carbonity is a service for business users; it is not directed at persons under 18 and we do not knowingly collect data from persons under 18.
13. Changes to this notice#
We update this notice when the service or the law changes. The current text is published on this page with its effective date. Material changes are also announced to customer account users in the application or by email.
14. Contact#
[COMPANY NAME] · [ADDRESS] · info@carbonity.ai