Privacy Policy

Before this goes live. The company name and address below are placeholders — replace them with your registered details and ABN. Australia has no Impressum-style requirement, so nothing further is legally mandated on the site itself. This document has not been reviewed by a lawyer.

1. Who is responsible

The entity responsible for the personal information described here is:

CarbTrust Pty Ltd
Level 4, 91 William Street
Melbourne VIC 3000, Australia
Email: carbtrust@gmail.com

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are in the EU or UK, the GDPR also applies to us under Art. 3(2) because we offer services to people there — your rights under section 8 cover both regimes.

If you have any question about this policy, email the address above and a person will answer it.

2. The short version

This website sets no cookies, runs no analytics, and stores nothing in your browser. We only receive personal data if you choose to send it — by submitting the contact form or subscribing to the newsletter. Nothing on this page is loaded from a third party, so no other company sees your visit.

3. What we collect, and why

Data	When	Purpose	Basis
First and last name, work email, organisation, role, your message	You submit the contact form	To answer your enquiry	APP 3 — collected directly from you for a stated purpose. EU/UK: Art. 6(1)(b) GDPR
Email address	You subscribe to the newsletter	To send you the newsletter	APP 3.3 — your consent. EU/UK: Art. 6(1)(a) GDPR
IP address, browser user-agent, requested URL, timestamp	Every page request	Server logs kept by our hosting provider for delivery, security and abuse prevention	APP 3 — reasonably necessary to run a secure site. EU/UK: Art. 6(1)(f) GDPR

We do not use your data for profiling, we do not make automated decisions about you, and we do not sell or rent it to anyone.

4. Who else processes your data

We use a small number of providers. Each acts as a processor on our instructions under a data processing agreement.

Web3Forms — receives and relays contact form and newsletter submissions to our inbox. See the Web3Forms privacy policy.
Cloudflare Pages — serves this website and keeps short-lived server logs.

5. No third-party requests

This site loads everything from its own domain — fonts, stylesheets, scripts and images. There are no CDN calls, no font services, no embedded players and no tracking pixels.

That means your browser makes no request to any third party while reading this site, so no other company receives your IP address or learns that you visited. The only time data leaves our domain is when you deliberately submit the contact or newsletter form, which is described in section 3.

6. Overseas disclosure

Our providers operate globally, so your information may be handled on servers outside Australia — including in the United States and the European Union. Under Australian Privacy Principle 8 we take reasonable steps to ensure any overseas recipient handles your information consistently with the Australian Privacy Principles, and we remain accountable for it.

For visitors in the EU or UK, transfers out of the EEA are covered by the European Commission's Standard Contractual Clauses. Ask us if you would like a copy of the safeguards that apply.

7. How long we keep things

Contact enquiries — kept while we are in conversation with you and for up to 24 months afterwards, then deleted. Where commercial law requires retention of correspondence, we keep it for the statutory period.
Newsletter subscriptions — until you unsubscribe.
Server logs — retained by our hosting provider for a short period, typically no more than 30 days.

8. Your rights

Under the Australian Privacy Principles, and under the GDPR if you are in the EU or UK, you have the right to:

Access (Art. 15) — ask what data we hold about you and receive a copy.
Rectification (Art. 16) — have inaccurate data corrected.
Erasure (Art. 17) — have your data deleted where no legal obligation requires us to keep it.
Restriction (Art. 18) — limit how we process your data while a dispute is resolved.
Portability (Art. 20) — receive your data in a structured, machine-readable format.
Object (Art. 21) — object to processing based on our legitimate interests.
Withdraw consent (Art. 7(3)) — at any time, without affecting processing that already took place.

Email carbtrust@gmail.com to exercise any of these. We will respond within one month. There is no charge.

9. Complaints

If you think we have handled your information badly, please tell us first — we would rather fix it. If you are not satisfied with our response, you can complain to the regulator:

Office of the Australian Information Commissioner (OAIC)
GPO Box 5218, Sydney NSW 2001, Australia
oaic.gov.au

If you are in the EU or UK, you may instead complain to your own national data protection authority.

10. Cookies and tracking

This site sets no cookies and uses no localStorage, sessionStorage, analytics, advertising pixels or session recording. That is why you are not seeing a cookie banner — there is nothing to consent to. If we ever add analytics, this policy will be updated and consent will be requested first.

11. Security

The site is served over HTTPS with HSTS, a Content Security Policy, and clickjacking and MIME-sniffing protections. Form submissions are transmitted over TLS. No system is perfectly secure, but we do not store personal information on this website at all — it is relayed straight to our inbox.

12. Changes to this policy

If we change how we handle personal data, we will update this page. Material changes affecting people who have already contacted us will be communicated directly.