Privacy Policy

1. Data controller

Carbonacc is a service operated by NGS Finland Oy (business ID 2964068-5).

NGS Finland Oy
Yliopistonkatu 31
20100 Turku, Finland
Email: hello@carbonacc.com
VAT: FI29640685

2. What data we collect and why

We collect personal data in the following situations:

Account registration and service delivery

When you create an account, we collect your name, email address, phone number (optional), company name, and company details. We use this data to deliver the carbon accounting service you have purchased.

Legal basis: Performance of a contract (GDPR Art. 6(1)(b)).

Contact form

When you submit a contact form, we collect your name, company name, email address, and message. We use this data only to respond to your enquiry.

Legal basis: Legitimate interest in responding to enquiries (GDPR Art. 6(1)(f)).

Cookies and analytics

We use cookies for website analytics and advertising measurement. Non-essential cookies are only set after you give explicit consent via the cookie banner.

Legal basis: Consent (GDPR Art. 6(1)(a)).

Essential cookies required for the website to function (such as session cookies for logged-in users) do not require consent.

3. Cookies used on this site

4. Data retention

Account data is retained for the duration of the service relationship and for 5 years after the last project is completed (for accounting and record-keeping purposes).

Contact form submissions are retained for 12 months after the enquiry is resolved, then deleted.

Analytics data is retained according to Google Analytics default settings (up to 14 months), and only collected with your consent.

5. Who we share data with

We use the following third-party services to operate Carbonacc:

• Vercel (website hosting) — data may be processed in the US under Standard Contractual Clauses
• Supabase (database and authentication) — EU data region
• Resend (transactional email) — US, Standard Contractual Clauses
• Stripe (payment processing) — Stripe acts as an independent data controller for payment data
• Google (Analytics and Ads) — only with your consent, US, Standard Contractual Clauses

We do not sell your personal data to anyone.

6. International data transfers

Some of our service providers process data outside the EU/EEA (primarily in the United States). Where this occurs, we rely on the EU-U.S. Data Privacy Framework or Standard Contractual Clauses approved by the European Commission to ensure an adequate level of data protection.

7. Your rights

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time (for cookies and analytics)

To exercise any of these rights, contact us at hello@carbonacc.com.

8. Right to lodge a complaint

If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuojavaltuutettu):

Office of the Data Protection Ombudsman
Lintulahdenkuja 4, 00530 Helsinki
tietosuoja.fi
tietosuoja@om.fi

9. Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We recommend checking this page periodically.