Privacy Policy

ForestWatch AS (trading as ForestSync and Carbonomex)

Effective date: 1 May 2026

Last reviewed: 26 April 2026

Document version: 2026-05-01

1. Who We Are

This Privacy Policy describes how ForestWatch AS (Org. No. [TBD]), trading as ForestSync and Carbonomex, collects, uses, and protects personal data when you interact with our platforms.

ForestWatch AS is a Norwegian company incorporated in Norway. We operate two platforms under distinct product brands:

ForestSync ("the Registry") operates:

The public carbon credit registry at registry.forestsync.com
The administrative portal at admin.forestsync.com
The marketing website at forestsync.com

Carbonomex ("the Marketplace") operates:

The carbon credit trading marketplace at carbonomex.com

ForestWatch AS is the single data controller for all personal data collected across both platforms under the General Data Protection Regulation (GDPR). Where processing activities differ between platforms, this is described in Sections 3 and 4.

Data controller:

ForestWatch AS (trading as ForestSync and Carbonomex)

Email: [email protected]

Address: Sognsvannsveien 40C, 0372 Oslo, Norway

Org. No. 934 513 797

For privacy and data protection matters: [email protected]

2. Scope of This Policy

This policy applies to:

Visitors to forestsync.com and registry.forestsync.com (no account required)
Registered users of carbonomex.com (organisations and their authorised representatives)
Project Developers submitting carbon offset projects
Corporate buyers and beneficiaries purchasing or retiring carbon credits
Traders and users of the order book trading terminal

Sections 3–9 apply jointly. Sections 10 and 11 apply separately per entity where processing activities differ.

3. Personal Data We Collect

3.1 Data Collected by ForestSync (registry.forestsync.com, forestsync.com)

From all visitors (no account required):

IP address and approximate geographic location (country/region)
Browser type, operating system, device type
Pages visited, time spent, referral source
Cookie identifiers (see Section 12)

From Project Developers who submit projects via the registry process:

Organisation name, country, municipality
VAT or tax registration number
Contact email address (of the authorised representative)
Project coordinates and geographic data
Supporting documents (PDFs, methodology reports, MRV data) — these may contain personal data of individuals named in project documentation

From authorised observers and institutional partners:

Name, organisation, and email (if you contact us directly)

3.2 Data Collected by Carbonomex (carbonomex.com)

During registration and onboarding:

Email address and hashed password (via Supabase Auth)
Organisation name, legal entity type (company / individual / NGO)
Country and municipality of registration
VAT or tax identification number
Organisation description (optional)
IP address at registration and at each login

During KYC/KYB verification (sellers and traders only):

Legal identity documentation (processed by Stripe — see Section 6.2)
Bank account details for payouts (held by Stripe Connect)
Beneficial ownership information

During trading activity:

Order history (type, volume, price, status, timestamps)
Trade execution records
Settlement transaction records
Payment method tokens (held by Stripe — Carbonomex does not store full card numbers)
Stripe Customer ID and Stripe Connect Account ID

During credit retirement:

Retiring organisation name and details
Quantity and serial numbers of retired credits
Date and purpose of retirement (as entered by the user)
This information is incorporated into a publicly accessible retirement certificate

Automatically collected:

Session identifiers and authentication tokens (stored in HTTP-only cookies)
Server-side request logs (IP, timestamp, endpoint, response code)
Consent records (see Section 4.2)

4. How We Use Personal Data

4.1 ForestSync Platform (registry.forestsync.com) — Purposes and Legal Bases

| Purpose | Legal basis (GDPR Art. 6) |

|---------|--------------------------|

| Operate the public registry and transparency ledger | Art. 6(1)(f) — Legitimate interest: maintaining a trustworthy public carbon credit record |

| Respond to enquiries and partnership requests | Art. 6(1)(f) — Legitimate interest: business communication |

| Security monitoring and fraud prevention | Art. 6(1)(f) — Legitimate interest: protecting our systems and users |

| Analytics to improve the registry (aggregated, privacy-preserving) | Art. 6(1)(a) — Consent (cookie consent required) |

| Comply with legal obligations | Art. 6(1)(c) — Legal obligation |

4.2 Carbonomex Platform (carbonomex.com) — Purposes and Legal Bases

| Purpose | Legal basis (GDPR Art. 6) |

|---------|--------------------------|

| Account creation and user authentication | Art. 6(1)(b) — Performance of a contract |

| Onboarding and profile completion | Art. 6(1)(b) — Performance of a contract |

| Processing trade orders, settlement, and payments | Art. 6(1)(b) — Performance of a contract |

| KYC/KYB identity verification for sellers | Art. 6(1)(c) — Legal obligation (AML/CTF); Art. 6(1)(b) — Contract |

| Issuing and recording credit retirement certificates | Art. 6(1)(b) — Performance of a contract |

| Customer support | Art. 6(1)(b) — Performance of a contract |

| Security monitoring, fraud prevention, and abuse detection | Art. 6(1)(f) — Legitimate interest |

| Compliance with financial, tax, and regulatory obligations | Art. 6(1)(c) — Legal obligation |

| Audit trail maintenance for regulatory compliance | Art. 6(1)(c) — Legal obligation; Art. 6(1)(f) — Legitimate interest |

| Sending transactional emails (trade confirmations, settlement updates) | Art. 6(1)(b) — Performance of a contract |

| Sending marketing communications | Art. 6(1)(a) — Consent (separate opt-in required) |

| Recording Terms & Privacy Policy acceptance | Art. 6(1)(c) — Legal obligation (proof of lawful processing); Art. 6(1)(b) — Contract |

5. How Long We Keep Your Data

| Category | Retention period | Basis |

|----------|-----------------|-------|

| Account data (name, email, organisation) | Duration of account + 7 years after closure | Tax and regulatory obligations |

| Trade order records | 10 years from transaction date | Financial records retention (EU standards) |

| Settlement and payment records | 10 years from transaction date | AML/CTF and tax obligations |

| Retirement certificates | Permanently (public ledger) | Public interest in carbon accounting transparency |

| KYC/KYB documentation | 5 years after the end of the business relationship | AML Directive obligations |

| Server logs and access logs | 90 days (rolling) | Security and debugging |

| Consent records (T&C and privacy acceptance) | Duration of account + 7 years | Proof of lawful processing |

| Marketing consent records | Until withdrawn + 3 years | Proof of consent |

| Cookies (analytics) | Max 13 months | ePrivacy Directive |

When an account is closed upon user request, we anonymise identifiable fields within 30 days unless a legal retention obligation prevents it. Ledger records (transactions, retirements) are never deleted because they form part of the immutable public carbon credit registry.

6. Who We Share Data With

We do not sell personal data. We share data only as follows:

6.1 Processors (acting on our instructions)

|-----------|------|----------|-------------------|

6.2 Independent Data Controllers

Stripe, Inc. acts as an independent data controller for payment card data, Connect account identity data, and KYC/KYB data collected during Stripe-hosted flows. Stripe's own Privacy Policy governs that processing. When you complete Stripe Connect onboarding, you are entering into a direct relationship with Stripe.

6.3 Public Disclosures

The following information is intentionally made public as part of the transparency mission of the ForestSync Registry:

Organisation name and country of organisations whose projects are listed on the registry
Carbon credit serial numbers and retirement certificates (which include the retiring organisation's name)
Transaction records on the public ledger (The Glassroom)

No individual personal data (email, personal address, identity documents) is published publicly.

6.4 Legal Disclosures

We may disclose personal data to competent authorities (regulators, courts, law enforcement) when required by law, court order, or to defend our legal rights.

7. Your Rights Under GDPR

If you are in the European Economic Area, you have the following rights regarding your personal data:

Right of access (Art. 15): You may request a copy of the personal data we hold about you.

Right to rectification (Art. 16): You may request correction of inaccurate or incomplete data.

Right to erasure (Art. 17): You may request deletion of your data, subject to our legal retention obligations. Note that ledger records forming part of the public carbon credit registry cannot be deleted as this would corrupt the public record.

Right to restriction of processing (Art. 18): You may request that we restrict processing of your data in certain circumstances.

Right to data portability (Art. 20): You may request your data in a structured, machine-readable format where processing is based on consent or contract and carried out by automated means.

Right to object (Art. 21): You may object to processing based on legitimate interests. We will cease processing unless we have compelling legitimate grounds that override your interests.

Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to lodge a complaint: You have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at www.datatilsynet.no, or with the supervisory authority in your country of residence.

To exercise your rights, contact: [email protected]. We will respond within 30 days. Complex requests may take up to 3 months; we will notify you if this is the case.

8. International Data Transfers

Supabase stores your data within the EU (Ireland). Other processors (Stripe, AWS) are US-based. These transfers are governed by:

Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914)
Processor-specific Data Processing Agreements (DPAs) in place with each vendor

A record of our transfer impact assessments is maintained by our Data Protection Officer.

9. Security

ForestWatch AS implements the following security measures across both platforms:

All data transmitted over TLS 1.2+
Passwords stored as Supabase-managed bcrypt hashes (never in plaintext)
Row-Level Security (RLS) enforced at the database layer — users can only access their own organisation's data
Service-role database keys restricted to server-side administrative processes only
Authentication tokens stored in HTTP-only, Secure, SameSite cookies
Payment card data never stored by us — all payment data held by Stripe under PCI-DSS Level 1 certification
Internal admin access logged in a tamper-evident audit trail

In the event of a data breach likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and report to the supervisory authority within 72 hours as required by GDPR Art. 33–34.

10. Children

Our services are designed exclusively for organisations and their authorised adult representatives. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has created an account, please contact us immediately at [email protected].

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will notify you by email (for registered users) and update the "Last reviewed" date at the top of this page. Continued use of the services after the effective date of the revised policy constitutes your acceptance of the changes.

12. Cookie Policy

12.1 What Are Cookies

Cookies are small text files placed on your device when you visit our websites. We use cookies to operate our services, remember your preferences, and (with your consent) analyse usage.

12.2 Cookies We Use

Strictly necessary cookies (no consent required):

Authentication session cookie (`sb-auth-token`): required to keep you logged in. Expires at session end or after 7 days.
CSRF protection token: security requirement. Session-scoped.
Cookie consent preference: remembers your choice. Expires after 12 months.

Analytics cookies (consent required):

Analytics provider cookies: used to measure aggregate usage patterns. We anonymise IP addresses. Expires after 13 months.

12.3 Managing Cookies

You can manage or reject cookies via the cookie preference centre accessible at the bottom of any page. Rejecting analytics cookies will not affect your ability to use the service. You can also control cookies through your browser settings.

13. Contact

For any privacy-related questions, rights requests, or concerns:

ForestWatch AS: [email protected]

Support: [email protected]