Privacy Policy

Effective Date: 01 October 2026

Version 2.0

Table of Contents

  • Introduction

  • Who We Are and How to Contact Us

  • UK and EU Representatives

  • Information We Collect

  • Lawful Bases for Processing

  • The GCMU Registry Demonstration Environment

  • Use of the Website and Application

  • Cookies and Tracking Technologies

  • Marketing Communications

  • Sharing and Disclosure

  • Where we process your data

  • United States Privacy Laws

  • Data Rights

  • Data Retention

  • Security

  • Automated Decision-Making

  • Children’s Privacy

  • Questions or Complaints

  • Schedule: Contact details of our representatives in the EU, EEA and UK

Introduction

Welcome to Global Carbon Market Utility LLC, a limited liability company formed under the laws of the State of Delaware whose principal place of business is at 712 Fifth Avenue, Floor 19, New York, NY 10019, United States of America ("GCMU", "we", "our", or "us").

GCMU is an organization providing market infrastructure to help grow the carbon market.

We respect your privacy and are committed to protecting your personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and, where it applies to our processing, Regulation (EU) 2016/679 (the EU GDPR).

We are established in the United States and are also subject to applicable United States federal and state privacy and data security laws. The section headed "United States Privacy Laws" below explains how those apply to us.

This Privacy Policy explains how we collect, use, share, and safeguard your information when you use our application, website, the GCMU Registry Demonstration Environment or related services ("Services"). We may update this Policy periodically to reflect changes in our practices or legal requirements. Any updates will be posted with a new "Effective Date."

Who We Are and How to Contact Us

The controller of your personal data is Global Carbon Market Utility LLC of 712 Fifth Avenue, Floor 19, New York, NY 10019, United States of America. You can contact us about this Policy or about your personal data at privacy@gcmu.net, or by post at the address above.

UK and EU Representatives

GCMU, which processes the personal data of individuals in the European Union, European Economic Area and UK, in the role of ‘data controller’ has appointed DataRep as its Data Protection Representative for the purposes of GDPR in the EU/EEA and The Data Protection Act 2018 / UK GDPR (as amended) in the UK.

If GCMU has processed or is processing your personal data, you may be entitled to exercise your rights under GDPR in respect of that personal data. For more details on the rights you have in respect of your personal data, please refer to the European Commission (https://ec.europa.eu/info/law/law-topic/data-protection/data-protection-eu_en) or the national Data Protection Authority in your country.

GCMU takes the protection of personal data seriously, and has appointed DataRep as their Data Protection Representative in the European Union so that you can contact them directly in your home country. DataRep has locations in each of the 27 EU countries, the UK and Norway & Iceland in the European Economic Area (EEA), so that GCMU’s customers can always raise the questions they want with them.

If you want to raise a question to GCMU, or otherwise exercise your rights in respect of your personal data, you may do so by:

  • Sending an email to DataRep at datarequest@datarep.com quoting <GCMU> in the subject line;

  • Contacting us on our online webform at www.datarep.com/data-request; or

  • Mailing your inquiry to DataRep at the most convenient of the addresses in the Schedule hereto.

PLEASE NOTE: when mailing inquiries, it is ESSENTIAL that you mark your letters for “DataRep” and not “GCMU”, or your inquiry may not reach DataRep. Please refer clearly to GCMU in your correspondence. On receiving your correspondence, GCMU is likely to request evidence of your identity, to ensure your personal data and information connected with it is not provided to anyone other than you.

If you have any concerns over how DataRep will handle the personal data they will require to undertake their services, please refer to their privacy notice at www.datarep.com/privacy-policy.

Information We Collect

GCMU collects limited personal information from its users and customers, which may include:

  • name

  • job title

  • employer name

  • work address

  • work email

  • work phone number

  • We also collect usage and technical data, such as:

  • IP address and approximate location

  • Browser type and operating system

  • Device identifiers

  • Pages visited and app interactions

  • Records of your access to, and activity within, the GCMU Registry Demonstration Environment, including sign-in events, the tutorial steps you complete and the simulated actions you take

  • Your acceptance of the demonstration environment Terms of Access, including the date and time of acceptance

We monitor and log activity within the demonstration environment in order to protect the security and integrity of the environment and to understand how the product is used. We do not use demonstration environment activity to make any decision that has a legal or similarly significant effect on you.

We use this information to:

  • Provide, operate, and maintain our Services

  • Communicate with you, including responding to requests and providing support

  • Improve functionality, security, and performance

  • Comply with legal obligations and enforce agreements

  • Analyze usage trends to improve user experience

We do not sell personal information to anyone. We share it only with trusted service providers as necessary to deliver our Services or where required by law.

Lawful Bases for Processing

We rely on the following lawful bases under the UK GDPR and, where applicable, the EU GDPR:

  • Performance of a contract (Article 6(1)(b)): to provide you with access to the demonstration environment and our Services once you have accepted the applicable terms.

  • Our legitimate interests (Article 6(1)(f)): to operate, secure, monitor and improve our Services and the demonstration environment; to understand how our products are used; to communicate with business contacts about our products; and to establish, exercise or defend legal claims. Our legitimate interest is in running and developing carbon market infrastructure safely and effectively. We have considered your interests and rights and consider that this processing does not override them.

  • Consent (Article 6(1)(a)): to send you marketing communications where we are required to obtain your consent to do so. You may withdraw your consent at any time.

  • Compliance with a legal obligation (Article 6(1)(c)): where we are required to process your personal data to comply with applicable law.

The GCMU Registry Demonstration Environment

The GCMU Registry Demonstration Environment is a demonstration environment. All units, projects and crediting programmes shown in it are fictitious. Access to the demonstration environment is governed by the demonstration environment Terms of Access.

We do not carry out know-your-customer or know-your-business checks in connection with the demonstration environment, and we do not ask you to provide identity documents in order to access it. Please do not upload identity documents, special category personal data, or personal data relating to anyone other than yourself, into the demonstration environment.

Access to the demonstration environment does not create any account on, or any right of access to, the live GCMU registry, and does not bind you or your organisation to the Registry Rules.

Use of the Website and Application

When you use our website, our app or the demonstration environment, we automatically collect technical information (such as IP address, browser, and device type) to ensure security, optimise functionality, and understand user behaviour to improve the experience.

Cookies and Tracking Technologies

On our website at gcmu.net, we use cookies that are strictly necessary for its operation and security, and analytics cookies set by Squarespace, our website platform, which give us aggregate information about how visitors use the site. Analytics cookies are set only if you accept them through the cookie banner, and you can withdraw that acceptance at any time. We do not use advertising, profiling or other non-essential cookies or tracking technologies, and we do not use session recording. Our application and the demonstration environment use only strictly necessary cookies. If that changes, we will update this Policy and, where required, obtain your consent through a cookie banner before setting any non-essential cookie. Further information is available in our Cookie Policy.

Marketing Communications

Where you have asked to be notified about GCMU product launches, or have otherwise consented to receive marketing communications from us, we will use your name and work email address to send you those communications. You can opt out at any time by using the unsubscribe link in any message or by emailing privacy@gcmu.net. Opting out will not affect your access to the demonstration environment. Consent to receive marketing is not a condition of accessing the demonstration environment or any of our Services.

Sharing and Disclosure

We may share your personal data with:

  • Service providers and partners who support our operations (e.g., hosting, analytics, and cloud storage)

  • Regulatory or legal authorities if required to comply with laws or protect rights

  • Authorized agents or representatives acting on your behalf

  • Event partners for GCMU-hosted or co-sponsored events

  • Members of the GCMU group of companies, including any entity that in the future owns or administers the GCMU registry

All third-party partners are required to handle your data securely and in accordance with UK GDPR and, where applicable, EU GDPR standards.

Where we process your data

GCMU is established in the United States. When you provide personal data to us, for example by completing our sign-up form, contacting us or using the demonstration environment, you provide it to us directly and we collect and process it in the United States. We do not receive your personal data from any exporter in the United Kingdom or the European Economic Area.

The United States is not the subject of a United Kingdom or European Commission adequacy decision covering GCMU, and United States law may not provide the same level of protection for personal data as the law of the United Kingdom or the European Economic Area. In particular, personal data held in the United States may in certain circumstances be accessible to United States public authorities. You may wish to take this into account when deciding whether to provide personal data to us.

Where we engage service providers to process personal data on our behalf, we put written data protection terms in place with them and, where a transfer mechanism is required for that processing, we use an appropriate one such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses.

United States Privacy Laws

GCMU is a Delaware limited liability company operating from New York. A number of US states have comprehensive consumer privacy laws, each of which applies only to businesses above stated thresholds of revenue, numbers of consumers, or revenue derived from selling personal information. GCMU does not currently meet the applicability thresholds of any of them, including the California Consumer Privacy Act. If that changes, we will update this Policy and provide the additional disclosures and rights those laws require.

We do not sell or share your personal information, as those terms are defined under US state privacy laws, and we do not use it for targeted or cross-context behavioural advertising.

Wherever you are located, you may exercise the rights described in the section headed "Data Rights" below by contacting us at privacy@gcmu.net. We will honour those requests regardless of whether a particular law requires us to do so.

If a security incident affecting your personal information occurs, we will notify you and the relevant authorities where required by applicable US state data breach notification laws.

Our marketing emails comply with the CAN-SPAM Act. Every marketing message identifies GCMU, gives our postal address, and contains a working unsubscribe link.

Data Rights

Under the UK GDPR and, where it applies, the EU GDPR, you have the following rights:

  • Access: Request access to the personal data we hold about you.

  • Rectification: Correct inaccurate or incomplete data.

  • Erasure: Request deletion of your personal data ("right to be forgotten").

  • Restriction: Limit how we process your information.

  • Portability: Receive your data in a structured, machine-readable format.

  • Objection: Object to certain types of processing, including marketing.

  • Automated Decision-Making: Request human review of automated decisions.

To exercise these rights, contact us at privacy@gcmu.net. We will respond within one month as required by law. You also have the right to complain to a supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ico.org.uk). If you are located in the European Union or the European Economic Area, you may complain to the data protection authority of the country in which you live or work.

Data Retention

We retain your data only for as long as necessary:

  • To provide and maintain our Services

  • To comply with legal or regulatory obligations

  • For limited internal analysis or archival purposes

In particular, we retain demonstration environment sign-up data and demonstration environment activity logs for 12 months following the date on which your access to the demonstration environment ends, unless you ask us to delete them sooner or we are required to keep them for longer. Marketing contact data is retained until you opt out or until 36 months after our last meaningful contact with you, whichever is earlier. When data is no longer needed, it will be securely deleted or anonymised. All personal data that GCMU controls may be deleted upon verified request from Data Subjects or their authorized agents. You can request deletion at any time by contacting us at: privacy@gcmu.net.

Security

We implement appropriate technical and organisational measures to protect your personal data from unauthorized access, loss, or misuse. While no system is completely secure, we continuously review and update our security controls.

Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Children’s Privacy

Our Services are not directed to individuals under 18 years of age. We do not knowingly attempt to solicit or receive information from children.

Questions or Complaints

If you have questions or concerns about this Privacy Policy or wish to exercise your rights, please contact us at:

GCMU

Global Carbon Market Utility LLC, 712 Fifth Avenue, Floor 19, New York, NY 10019, United States of America

privacy@gcmu.net

If you are not satisfied with our response, you may complain to the Information Commissioner’s Office at ico.org.uk or, if you are in the European Union or European Economic Area, to your national data protection authority.