Updated July 2026.

Carbo Culture Oy (“Carbo Culture” or “we”) respects the privacy of the personnel (“data subject” or “you”) of its corporate customers and service providers, and is committed to processing, maintaining, and using their personal data responsibly. Carbo Culture is the data controller for these processing activities.

In this Privacy Policy, we describe how we process your personal data when you interact with us as a representative of Carbo Culture’s corporate customer or service provider. This Privacy Policy may be updated from time to time.

• Data Controller

Name: Carbo Culture Oy

Company ID: 2750471-9

Address: c/o EMU, PL1188, 00101 Helsinki, Finland

Email: legal@carboculture.com

• Personal Data Processed and Sources of Personal Data

We primarily receive personal data directly from you by telephone, letter, e-mail, in shared documents, or on our website. We also collect personal data from you when you use our online services, including through cookie technologies.

We might, however, to the extent permitted by applicable laws, also collect personal data from third parties.

We may collect the following data from the representatives, employees, or other personnel of our corporate customers and service providers:

• Contact data: Data of contact persons, such as name, address, e-mail address, and phone number.
• Personnel data: Data of our corporate customers’ or service providers’ personnel, such as title and position.
• Contractual and financial administration data: Data necessary for financial and contractual management, such as purchase order references, invoicing addresses, bank account and IBAN/BIC details, VAT and other tax identification numbers, insurance policy references and coverage information, payment status and remittance records.
• Compliance and background-check information: Where required for compliance reasons, we may process data such as sanctions list screening results, conflict of interest status, politically exposed person status, export control classifications, and anti‑money laundering documentation, where applicable.
• Technical and authentication data: Data necessary for system access, such as usernames, log‑in credentials, access rights, audit trail logs, IP addresses, device identifiers.
• Communication data: Data necessary for communication, such as correspondence records, call recordings, meeting invitations and minutes, survey responses, feedback, and other messages exchanged with us.
• Data relating to marketing: Information about a corporate customer’s or service provider’s newsletter subscriptions and any brochures or other materials ordered, and information about whether you have prohibited direct marketing messages.
• Data necessary for event participation: Such as event registrations, attendance records, travel and accommodation details, dietary and accessibility requirements and badge information. We may also process photos and videos of Carbo Culture’s events.
• Publicly available information: Data gathered from public sources, such as publicly accessible websites, social media, business cards, press releases.
• Other data provided to us: Any other information voluntarily provided by you or your employer or otherwise required for the establishment, performance or termination of the customer relationship.

We also collect, use and share aggregated data, such as statistical or demographic data, for any purpose. Aggregated data may be derived from your data but is not considered personal data as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

We do not intentionally collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

• How We Use Your Personal Data

We will only use your data when applicable laws allow us to.

We use the personal data of the personnel and the representatives of our corporate customers and service providers for the following purposes:

• To establish, manage, and maintain customer and service provider relationships: We use your data to identify and engage with corporate customers / service providers, maintain contact records, distribute reports and invitations, respond to queries and feedback, and otherwise foster transparent communication.
• Compliance and legal obligations: We process your data to meet corporate, securities, anti‑money laundering and other regulatory requirements, to protect our legal rights and, where needed, to enforce our rights.
• Marketing: We use your data to send you updates, press releases, event invitations, survey requests, and other marketing communications about Carbo Culture’s activities that may interest you, in line with your communication preferences.
• Legal Basis for Processing

Our legal bases for processing your personal data are:

• Consent: Where required, we will obtain your consent for specific data processing activities.

• Contractual Necessity: Processing necessary to fulfil our contract with the corporate customer / service provider or to take pre-contractual steps at your or the corporate customer’s / service provider’s request.

• Legitimate Interests: We process data to pursue our legitimate business interests, provided your rights and interests do not override these.

• Legal Compliance: Processing is necessary for compliance with our legal and regulatory obligations under applicable laws.

Where we need to collect data under applicable laws, or under the terms of a contract and you do not provide that data when requested, we may not be able to perform the contract.  In this case, we may have to cancel a service that the corporate customer / service provider you represent has with us.

• Personal Data Recipients

Your personal data is only processed by employees who need such data to perform their duties. In addition, your personal data is processed by subcontractors and sub-processors working for us and on our behalf, such as IT service providers, AI tools (including Microsoft Copilot and Anthropic Claude), service providers carrying out marketing and analytics measures and partners participating in the organization of campaigns. Subcontractors process personal data for Carbo Culture and on Carbo Culture’s behalf.

We generally do not share personal data with third parties outside of our organization, but we may do so for legal reasons. We may share your personal data with other organizations or individuals when it is reasonably necessary to: (1) meet any applicable law, regulation, legal process or request of a suitable governmental body or public authority e.g. under a relevant court production order; (2) enforce applicable legal terms and conditions or our other legal rights, including investigation of potential violations; or (3) protect against or prevent harm to the rights, property or safety of Carbo Culture, our customers or the public as required or permitted by law.

• Data Transfers Outside of EEA

Your personal data is mainly processed within the European Economic Area.

However, in certain cases, we may transfer or access personal data outside the European Economic Area. In such cases, we provide adequate protection for the transfers of personal data to countries outside of the European Economic Area through a series of agreements with our service providers based on the Standard Contractual Clauses or through other appropriate safeguards, such as the EU-U.S. Data Privacy Framework.

• Your Rights

Right to access

You have a right to access the personal data processed by us. This means that you may contact us, and we will inform you what personal data we have collected and processed regarding you and the purposes such data are used for.

Right to withdraw consent

In case the processing is based on a consent granted by you, you may withdraw the consent at any time.

Right to correct

You have the right to have incorrect, imprecise, incomplete, outdated, or unnecessary personal data we have stored corrected or completed. You have the right to update for example your contact information or your other personal data.

Right to deletion

You may also ask us to delete your personal data from our systems. We will comply with such a request unless we have legitimate grounds to not delete the data.

Right to restriction of processing

You may request us to restrict the processing of personal data, for example when your data erasure, rectification or objection requests are pending and/or when we do not have legitimate grounds to process your data.

Right to object

You may have the right to object on grounds relating to your particular situation to the processing of your personal data based on our legitimate interest. We will comply with such objection unless we have legitimate grounds not to.

Right to data portability

You have the right to receive the personal data you have provided us with in a structured and commonly used format.

How to use your rights 

If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us by using the contact information given at the beginning of this Privacy Policy.

• Use of Artificial Intelligence Tools

We use AI-assisted tools, including Microsoft Copilot and Anthropic Claude, to support internal business processes such as drafting communications, reviewing documents, and analysing information. These tools may process personal data contained in documents, correspondence, or customer relationship management systems (including our CRM platform, HubSpot) in the course of these activities.

We do not use AI tools to make solely automated decisions that produce legal or similarly significant effects on individuals. All AI-assisted outputs are subject to human review before being acted upon.

AI tools used by Carbo Culture operate under enterprise agreements that include appropriate data processing terms. Where these tools process personal data outside the EEA, we ensure adequate transfer safeguards are in place, such as Standard Contractual Clauses. Our staff are instructed to apply data minimisation principles when using AI tools and to avoid inputting personal data beyond what is necessary for the task at hand.

• Information Security

We are committed to keeping your data safe and secure. We use a variety of organizational and technical safeguards to protect the personal data we collect and process. Our security controls are designed to maintain an appropriate level of data confidentiality and integrity.

The personal data stored under this Privacy Policy shall only be processed on a need-to-know basis. The use of personal data is protected by appropriate user rights, passwords, and rights of use.

• Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

To determine the appropriate retention period for data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of data, the purposes for which we process data and whether we can achieve those purposes through other means, and the applicable legal requirements.

We regularly review the data we hold taking into account the lawful purpose for which we hold it and any data that is deemed no longer relevant or required is deleted where it is practicable to do so.

• Lodging a Complaint

In case you consider our processing of personal data to be inconsistent with the applicable data protection laws, you have the right to lodge a complaint with the local supervisory authority for data protection.

Last Updated: August 2025

1. Introduction and Contact Information of the Controller

We are Carbo Culture, an international organization with companies in different countries. The parent company is Carbo Culture Oy (a company incorporated in Finland). We, the parent company, are the controller of personal data for the purposes of this Privacy and Cookies Policy.

We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy and Cookies Policy outlines how we collect, use, and protect your information when you visit our website and interact with us in doing so.

Name: Carbo Culture Oy
Company ID: 2750471-9
Address: c/o EMU, PL1188, 00101 Helsinki, Finland
Email: legal@carboculture.com 

2. Personal Data We Collect

When you visit our website, if you are enquiring about our products or services, signing up to receive information from us, it may be necessary for you to provide certain personal data to us to process.

We process the following personal data:

• Identity and Contact Data: We may collect personal data such as your name, address, email address, phone number, company name, and any other information you provide when contacting us, or signing up for newsletters..
• Usage Data: We collect information about your interactions with our website, including IP addresses, browser type and version, time zone setting, location, pages, viewed and page interaction information, and time spent on the site.
• Cookies and Tracking Technologies: We use cookies and similar technologies to enhance your experience on our website, analyze site traffic, and personalize content.
• Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences.
• Other Data You Provide to Us: We may process any other personal data you provide us with, in example in connection with commercial cooperation.

We also collect, use and share Aggregated Data, such as statistical or demographic data, for any purpose. Aggregated Data may be derived from your data but is not considered personal data as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy and Cookies Policy.

3. How We Use Your Information

We will only use your data when the law allows us to, for the following purposes:

• For Marketing: With your consent, we may send you marketing communications about our products, services, and industry updates.
• Compliance and Legal Obligations: We process your data to comply with legal and regulatory requirements and to protect our legal rights.
• Site Improvement and Analytics: We use data analytics to monitor and improve the performance and functionality of our website.

4. Legal Basis for Processing

Our legal bases for processing your personal data are:

• Consent: Where required, we will obtain your consent for specific data processing activities, such as targeted advertising or website analytics.
• Contractual Necessity: Processing necessary to fulfill our contract with you or to take pre-contractual steps at your request.
• Legitimate Interests: We process data to pursue our legitimate business interests, provided your rights and interests do not override these.
• Legal Compliance: Processing necessary for compliance with our legal and regulatory obligations under applicable laws.

5. Data Sharing and Transfers

Carbo Culture Group: We may share your data within Carbo Culture and the Carbo Culture group (i.e. our officers, staff and contractors) to service your requests or provide you with information.  We may also share your data if a change happens in our business such as a merger or acquisition. If that happens, the new owners may use your data in the same way as set out in this Privacy and Cookies Policy.

Third-Party Service Providers: We may share your data with trusted third-party service providers who assist us in operating our website, conducting our business, or serving you. These providers are legally and contractually obligated to protect your data.

Legal Compliance: We may also share your data with other organizations or individuals when it is reasonably necessary to: (1) meet any applicable law, regulation, legal process or request of a suitable governmental body or public authority e.g. under a relevant court production order; (2) enforce applicable legal terms and conditions or our other legal rights, including investigation of potential violations; (3) detect, prevent, or otherwise address financial crime; or protect against or prevent harm to the rights, property or safety of Carbo Culture, our customers or the public as required or permitted by law.

International Data Transfers: Given our global operations, your data may be transferred to and processed in countries outside the European Union and the European Economic Area and United Kingdom. We ensure appropriate safeguards are in place to protect your data, such as standard contractual clauses approved by relevant authorities.

6. Your Rights

As a data subject, you have the following rights under applicable data protection laws:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request correction of inaccurate or incomplete data.
• Right to Erasure: You can request the deletion of your data in certain circumstances.
• Right to Object: You can object to the processing of your data based on legitimate interests.
• Right to Data Portability: You can request to receive your data in a structured, commonly used format.
• Right to Withdraw Consent: If processing is based on consent, you can withdraw it at any time.
• Right to Restriction of Processing: You may request us to restrict the processing of personal data, for example when your data erasure, rectification or objection requests are pending and/or when we do not have legitimate grounds to process your data.

To exercise any of these rights, please contact us at legal@carboculture.com

7. Cookies and Tracking Technologies

What Are Cookies?: Cookies are small text files stored on your device when you visit our website. They help us understand how you interact with our site and improve your browsing experience.

Types of Cookies We Use:

Strictly necessary Cookies: Essential for website functionality and security.  For example, they help support the structure of the pages that are displayed to you, help to improve navigation and allow you to return to pages you have previously visited. This type of Cookie only lasts for the duration of the time you are visiting the website. When you leave the website they are deleted automatically.

Performance or Analytics Cookies: Help us understand how users interact with our site.  This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily. The data is aggregated and anonymised, which means we cannot identify you as an individual. We use Google Analytics, which tracks and shares with us and our partners some user information, which includes some personal data. For further information on this, please consult the website provided by Google: https://policies.google.com/technologies/partner-sites?hl=en-US.

Functionality or Marketing Cookies: Used to track visitors across websites for personalized advertising.  This enables us to personalise our content for you, greet you by name and remember your preferences. These Cookies will remain on your device until you choose to clear it.

You can control or disable cookies through your browser settings. However, disabling cookies may affect your user experience on our site.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or destruction. This includes encryption, access controls, and regular security assessments.  In addition, we limit access to data to those of our staff and other third parties who have a business need to know. They will only process data on our instructions and they are subject to a duty of confidentiality.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements.

To determine the appropriate retention period for data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of data, the purposes for which we process data and whether we can achieve those purposes through other means, and the applicable legal requirements.

For example, if you are a customer, we will generally keep your data for the longer of six years from the date of the last interaction with you or until the applicable statutory limitations period has expired.

We regularly review the data we hold taking into account the lawful purpose for which we hold it and any data that is deemed no-longer relevant or required is deleted where it is practicable to do so.

10. Updates to This Policy

We may update this Privacy and Cookies Policy periodically to reflect changes in our practices or legal requirements. We encourage you to review this policy regularly to stay informed about how we protect your data.

11. Third Party Websites
    We may have links to third party websites on our website. Those third parties are responsible for the content, privacy and security of their websites.
12. Lodging a Complaint

In case you consider our processing of personal data to be inconsistent with the applicable data protection laws, you have the right to lodge a complaint with the local supervisory authority for data protection.

12. Contact Us

If you have any questions or concerns about this Privacy and Cookies Policy, or if you wish to exercise your rights, please contact us at:

Attn: General Counsel
legal@carboculture.com