Privacy Policy & Notice at Collection

Notice at Collection (Cal. Civ. Code § 1798.100 & 11 CCR § 7012)

At or before the point of collecting your personal information, Carbonatoz informs you of the categories of personal information and sensitive personal information collected, the purposes for which they are collected and used, whether such information is sold or shared, and our retention criteria.

• Zero Data Sales / Sharing: Carbonatoz does not sell or share personal information of any consumer for monetary or cross-context behavioral advertising.
• Sensitive Personal Information (SPI): We collect SPI (such as facility IoT geolocation or corporate identity credentials) solely to deliver requested SaaS functionality, maintain system security, and comply with environmental laws. We do not use SPI to infer characteristics about individuals.
• Retention Standards: We retain personal information only for the duration necessary to fulfill the specific operational purposes disclosed below, comply with statutory mandates (e.g. EU CBAM / India CCTS preservation), or resolve disputes.

Who is responsible for this data (Data Roles)

CarbonAtoZ Pvt. Ltd.("we", "us", "Carbonatoz") acts in two distinct statutory capacities:

• Data Fiduciary / Business / Controller (DPDP s2(i) / CCPA § 1798.140(d) / GDPR Controller): For personal data collected directly through this public website, demo booking requests, sales inquiries, subscriber communications, and customer administrator account credentials.
• Data Processor / Service Provider (DPDP s2(n) / CCPA § 1798.140(ag) / GDPR Processor): For customer enterprise operational data — including facility activity streams, raw GHG emissions data, supplier product carbon footprints, and CBAM declaration filings uploaded to the Carbonatoz SaaS platform by tenant organizations under enterprise Data Processing Agreements (DPAs).

What we collect, and why — by purpose

Each category below is collected for the specific purpose listed next to it. We do not use one category of data for an unrelated purpose without providing additional notice.

California Consumer Privacy Act (CCPA/CPRA) Rights

If you are a California resident, you have specific statutory rights under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), as amended by the California Privacy Rights Act (CPRA):

• Right to Know / Access (§ 1798.110): You have the right to request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, and the business purposes.
• Right to Delete (§ 1798.105): You have the right to request deletion of your personal information, subject to statutory retention exemptions (such as completing transactions or complying with legal reporting).
• Right to Correct (§ 1798.106): You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale / Sharing (§ 1798.120): You have the right to opt out of the sale or sharing of your personal information. Carbonatoz does not sell or share personal information.
• Right to Limit Use of Sensitive Personal Information (§ 1798.121): You have the right to direct a business to limit its use and disclosure of sensitive personal information to that necessary to perform the services.
• Right to Data Portability (§ 1798.100(d)): You have the right to receive a portable copy of personal information provided to us in a readily usable format.
• Right to Non-Discrimination (§ 1798.125): We will not discriminate or retaliate against you for exercising any of your CCPA/CPRA rights. We will not deny you services, charge you different prices or rates, or provide a different level of quality.

B2B and Workforce Personnel Data Coverage (§ 1798.145)

Following the expiration of California's statutory B2B and employment data exemptions on January 1, 2023, all California-based corporate representatives, enterprise contacts, job applicants, contractors, and personnel whose data is collected by Carbonatoz are fully covered data subjects entitled to the privacy rights described above.

Minors Under 16 Data Policy (DPDP s9 & CCPA § 1798.120(c) / 11 CCR §§ 7070–7072)

Carbonatoz is an enterprise B2B industrial SaaS platform intended exclusively for corporate environmental and compliance professionals. We do not sell personal information, we do not market to or target minors under 16 years of age, and we have no actual knowledge of collecting or selling personal information of consumers under 16 years of age. All registered users are verified corporate representatives. If we discover inadvertent collection of a minor's data, it will be erased immediately.

Reasonable Security Safeguards (Cal. Civ. Code § 1798.150)

Carbonatoz maintains robust administrative, technical, and physical security safeguards appropriate to the nature of personal information to protect against unauthorized access, destruction, use, modification, or disclosure:

• Encryption: Mandatory AES-256 encryption at rest for all database volumes and TLS 1.3 in transit with Strict-Transport-Security (HSTS).
• Access Governance: Multi-factor authentication (MFA) enforcement on privileged roles, automated session locking, and strict multi-tenant database isolation.
• Integrity: Immutable cryptographic audit logging for all statutory compliance records.
• Resilience: Continuous vulnerability management, annual disaster recovery drills, and statutory incident response protocols.

Data Storage, Residency & Cross-Border Transfers

Primary application infrastructure and database clusters for Carbonatoz are hosted in Mumbai, India to ensure data sovereignty and residency. Cross-border transfers of personal data comply with Section 16 of the DPDP Act 2023, GDPR Chapter V Standard Contractual Clauses (SCCs), and CCPA Service Provider transfer agreements.

Designated Submission Methods & Grievance Officer

You may exercise any statutory data right through our two designated methods:

• Designated Method 1 (Interactive Forms): Use our online Data Rights Form, Opt-Out Form, or Limit SPI Form.
• Designated Method 2 (Direct Email): Send an email directly to our privacy team and Grievance Officer at privacy@carbonatoz.com.

We acknowledge receipt of requests within 10 business days for CCPA Track A requests (11 CCR § 7021(a)) and 3 business days for DPDP grievances. Final statutory resolutions are delivered within 45 calendar days for CCPA Know/Delete/Correct, 15 business days for Opt-Out/Limit-SPI, and within statutory ceilings for DPDP/GDPR.