Privacy Notice
Last updated: 9 August 2026
This privacy notice explains how Carbon Verified (CarbonVerified.org) ("we", "us", "our") handles your personal data when you use our website and services. We are a trading style of Digital Search Group Limited (company number 06950800), registered at 20-22 Wenlock Road, London, N1 7GU.
1. Who we are
The data controller responsible for your personal data is Digital Search Group Limited, a company registered in England and Wales (company number 06950800), trading as Carbon Verified (CarbonVerified.org).
Our registered office is at 20-22 Wenlock Road, London, N1 7GU.
For all privacy and data protection enquiries, contact Joe Ryan at privacy@carbonverified.org.
2. What personal data we collect
We collect the following categories of personal data:
- Account data — your name, email address and password when you create an account.
- Organisation data — your organisation name, industry, country and employee range, provided during onboarding.
- Website data — the website URLs you ask us to assess. These may include domains operated by third parties if you are an agency acting on a client's behalf.
- Assessment data — PageSpeed and carbon emission results derived from the URLs you submit, including page weights, request counts and estimated CO2 figures.
- Evidence data — files you upload to support a verification application (for example, screenshots, hosting confirmations or server logs).
- Communication data — the content of messages you send to privacy@carbonverified.org or through our support channels.
- Usage data — standard server log information (IP address, browser type, pages visited and timestamps) collected automatically when you use the site.
We do not collect or process special category personal data (such as health, race, religion or biometric data).
3. How we use your data and our lawful basis
We use your personal data for the following purposes, each with a lawful basis under the UK GDPR and EU GDPR:
| Purpose | Lawful basis | Data used |
|---|---|---|
| Providing the assessment and verification service | Contract (Art 6(1)(b)) | Account, organisation, website and assessment data |
| Processing payments for subscriptions | Contract (Art 6(1)(b)) | Account and billing data |
| Communicating about your account, assessments and verification | Contract (Art 6(1)(b)) | Account and communication data |
| Sending the URLs you submit to Google PageSpeed Insights for analysis | Contract (Art 6(1)(b)) | Website URLs |
| Checking whether a domain uses green hosting via the Green Web Foundation | Contract (Art 6(1)(b)) | Domain names |
| Maintaining site security and preventing abuse | Legitimate interests (Art 6(1)(f)) | Usage data, account data |
| Improving our service and methodology | Legitimate interests (Art 6(1)(f)) | Aggregated assessment data |
| Storing your cookie consent preference | Consent (Art 6(1)(a)) | Consent record (see Cookie Notice) |
5. Data retention
We keep your personal data only as long as necessary for the purposes set out above. Our retention periods are:
| Data category | Retention period |
|---|---|
| Account and organisation records | Deleted 30 days after you request account closure |
| Assessment and page data | 24 months from the assessment date |
| Assessment history behind an issued verification | 12 months (badge validity) plus 6 years after expiry |
| Uploaded evidence files | 6 years from the verification decision |
| Access, activity and security logs | 12 months |
| Billing records | 6 years (UK tax requirement) |
| Cookie consent record | 12 months, or until you withdraw consent |
When a retention period ends, we delete or anonymise the data so that you can no longer be identified from it.
6. International data transfers
Our hosting and database platform (Lovable Cloud) and some of our subprocessors operate servers outside the UK and European Economic Area. Where your data is transferred to a third country, we rely on an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism under the UK GDPR and EU GDPR.
See our Subprocessor list at /subprocessors for details of where each processor operates.
8. Your rights
Under the UK GDPR and EU GDPR, you have the following rights:
- Right of access — you can ask for a copy of your personal data.
- Right to rectification — you can ask us to correct inaccurate data.
- Right to erasure — you can ask us to delete your personal data (subject to retention obligations).
- Right to restrict processing — you can ask us to limit how we use your data.
- Right to data portability — you can ask for your data in a structured, machine-readable format.
- Right to object — you can object to processing based on legitimate interests.
- Right to withdraw consent — for processing based on consent, you can withdraw it at any time.
- Rights related to automated decision-making — we do not use automated decision-making that produces legal effects.
To exercise any of these rights, email privacy@carbonverified.org. We will respond within one month. This may be extended by two months for complex requests; if so, we will explain why within the first month.
9. Complaints
If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. You can also complain to your local data protection authority if you are in the EEA.
10. Children's data
Our service is intended for businesses and professionals. We do not knowingly collect personal data from anyone under 16. If you believe we have collected a child's data, contact privacy@carbonverified.org and we will delete it.
11. Changes to this notice
We may update this privacy notice from time to time. The "Last updated" date at the top of the page shows when it was last revised. If we make material changes, we will notify you by email or through a notice on the site.
12. Contact
For any questions about this privacy notice or your personal data, contact Joe Ryan at privacy@carbonverified.org, or write to us at Digital Search Group Limited, 20-22 Wenlock Road, London, N1 7GU.