Privacy Policy

1. Who we are

This Privacy Policy explains how Agochar Tech LLP, operating BuyCarbonOffsets.org ("we", "us"), collects, uses, and protects your personal data when you use our website and services. We are the data controller for that personal data.

We operate worldwide and aim to comply with the EU/UK General Data Protection Regulation (GDPR), India’s Digital Personal Data Protection Act (DPDP), and other applicable data-protection laws.

2. Data we collect

We collect only what we need to provide the Service:

• Account & order data — name, email address and, for businesses, company name and tax ID; the name you choose for your certificate or named retirement.
• Payment metadata — confirmation, amount, and a token from our payment processor. We never see or store full card numbers.
• Transaction records — orders, retirements, serial numbers, and certificates issued to you.
• Technical data — device and browser type, IP address and the approximate location derived from it, and the pages involved when something goes wrong. This comes from our server logs and from the error monitoring described in section 7; we do not run a web-analytics product.
• Communications — messages you send us, chatbot conversations, and newsletter preferences.

3. How we use your data

We use your personal data to:

• Process orders, purchase and retire credits, and issue and deliver your certificate;
• Manage subscriptions, billing, and your account;
• Provide customer support and respond to enquiries;
• Send transactional emails (order confirmations, certificates, receipts);
• Send product updates or newsletters where you have opted in;
• Maintain security, prevent fraud, and meet legal and accounting obligations;
• Improve and analyse the Service in aggregate.

4. Legal bases (GDPR)

Where GDPR applies, we rely on: performance of a contract (to fulfil your order and subscription); legitimate interests (to secure, operate, and improve the Service); consent (for marketing emails and non-essential cookies, which you can withdraw at any time); and legal obligation (for tax and accounting records).

4a. India — Digital Personal Data Protection Act, 2023 and Rules, 2025

We are an Indian Data Fiduciary. Under the DPDP Act and the DPDP Rules, 2025 (notified 13 November 2025; substantive obligations apply from May 2027), we process your personal data on the basis of your consent — given when you create an account, place an order, or subscribe to the newsletter — and, for orders, on the basis of legitimate use (you voluntarily provide your details for a purchase you have asked for). Each purpose below is itemised so you can see exactly what is collected and why:

• Fulfilling an order — name, email, billing address and country, and for Indian buyers the state (for GST) and any GSTIN: to buy and retire credits in your name, issue the certificate and the tax invoice, and send them to you.
• Running an account — name, email, password hash, language, tax profile, team memberships: so you can sign in, see your orders and reports, and manage subscriptions.
• Taking payment — the payment processor’s reference and the amount: to reconcile payments and refunds. We never receive card numbers.
• Newsletter — email address and the date you confirmed: to send the quarterly report you opted in to. Double opt-in; unsubscribe in every issue.
• Support and chat — messages you send and chatbot transcripts: to answer you and to follow up.
• Security and abuse prevention — IP address, device and request logs for a limited period: to rate-limit, detect fraud and investigate incidents.
• Partner programme — application details, payout destination (bank, PayPal or UPI as you supply it) and referral records: to attribute and pay commission.
• Withdrawing consent — you may withdraw consent as easily as you gave it: unsubscribe links, the account’s Settings → Your data page (export and closure), or an email to the Grievance Officer below. Withdrawal does not affect processing already carried out, and records we must keep by law (tax invoices, registry retirements) are retained as described in section 7.
• Grievance Officer — Agochar Tech LLP, legal@buycarbonoffsets.org. We acknowledge a grievance promptly and resolve it within the period the Rules prescribe. If you are not satisfied you may approach the Data Protection Board of India.
• Children — the Service is for adults; creating an account requires confirming you are 18 or older, and we do not knowingly process a child’s data without verifiable parental consent.
• Breach notification — if a personal-data breach affects you, we notify the Data Protection Board and you without undue delay and within the 72-hour window the Rules set, saying what happened, what it means for you and what we have done about it.

5. How we share data

We share the minimum data necessary with trusted service providers who process it on our behalf, and we never sell your personal data. These include:

• Payment processors — Stripe (worldwide), Razorpay (India) and PayPal;
• Carbon marketplaces & exchanges — such as Carbonmark, Patch, and Xpansiv — to source credits;
• Registries — such as Verra, Gold Standard, Puro.earth, and the American Carbon Registry — where, for named retirement, the name you provide appears on the public registry record;
• Email & infrastructure — our transactional email provider (e.g. Postmark), hosting and CDN providers, and our AI chatbot provider (e.g. OpenAI) for support;
• Error monitoring — Sentry (Functional Software, Inc., USA), which receives a technical fault report when something breaks in your browser or on our servers: the error, the page, your browser and OS version, and your IP address. It is configured not to attach your name, email address or request contents, and its session-replay feature is disabled, so it never records the contents of a page;
• Analytics (consent only) — Google LLC (Google Analytics 4) and Microsoft Corporation (Clarity), which receive page-view and interaction data as described in our Cookie Policy only after you accept analytics in the cookie banner;
• Professional advisers and authorities — where required by law.

6. International transfers

We are based in India and serve customers in the EU, the United Kingdom and worldwide, and some of our providers are located in other countries. Where we transfer personal data internationally, we use appropriate safeguards (such as standard contractual clauses) as required by applicable law. Our primary infrastructure is hosted in the EU (Germany).

7. How long we keep data

We keep data only as long as its purpose needs it, and then delete or anonymise it. The schedule:

• Tax invoices, orders, refunds and payment references — 8 years from the end of the financial year (Indian GST and LLP record-keeping rules), with your personal details removed from the live account on closure.
• Registry retirements and certificates — permanent. A retirement on a public registry is irreversible and public by design; the certificate is the record of it. On closure your name is removed from our account records, not from the registry.
• Account and profile data — while the account is active, then removed when closure is approved.
• Newsletter subscription — until you unsubscribe or close your account; a suppression entry (the address alone) is kept afterwards so we never mail an address that asked us to stop.
• Support messages and chat transcripts — 24 months, or until account closure if sooner.
• Security and request logs — 90 days.
• Partner commission and payout records — 8 years, as financial records.

8. Your rights

Depending on where you live, you have rights over your personal data, which may include the right to:

• Access the data we hold about you and request a copy;
• Correct inaccurate or incomplete data;
• Delete your data ("right to be forgotten"), subject to legal retention;
• Restrict or object to certain processing, including direct marketing;
• Data portability;
• Withdraw consent at any time; and
• Lodge a complaint with your data-protection authority.

9. Exercising your rights

From Settings → Your data in your account you can download a copy of everything we hold about you as a machine-readable file at any time, and request that your account be closed. Closure requests are reviewed by a person; you keep access until it is decided and can withdraw it. When approved, your personal details are removed. Order, tax-invoice and registry-retirement records are retained as described above, with your name removed from the account — a registry retirement is permanent and public by design. You can also contact us at legal@buycarbonoffsets.org; for India DPDP matters you may contact our Grievance Officer at the same address. We respond within the timeframes required by applicable law.

10. Cookies

We use essential cookies for checkout and session handling, and Sentry for error monitoring. Only if you choose “Accept all” in our cookie banner do we also run Google Analytics 4 (page views and a few named events, IP anonymised, no advertising signals) and, on the public site only, Microsoft Clarity (heatmaps and masked session recordings) — and optional performance measurement. Your choice is enforced: declining switches all of them off, and you can change it at any time from the "Cookie settings" link in the footer. We run no advertising trackers or profiling of any kind. See our Cookie Policy for the detail.

11. Security

We use technical and organisational measures to protect your data, including encryption in transit, restricted access, and not storing full card numbers (handled by our PCI-compliant payment processors). No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by law.

12. Children

The Service is not directed at children, and you must be at least 18 to purchase. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "last updated" date, and notify you of material changes where required.