Privacy policy

This policy is effective as of 10 August 2021. Last updated: 4 September 2026.

Your privacy is important to us. It is DitchCarbon's policy to respect your privacy and comply with any applicable law and regulation regarding any personal information we may collect about you, including across our website, https://www.ditchcarbon.com, and other sites we own and operate.

Personal information is any information about you which can be used to identify you. This includes information about you as a person (such as name, address, and date of birth), your devices, payment details, and even information about how you use a website or online service.

In the event our site contains links to third-party sites and services, please be aware that those sites and services have their own privacy policies. After following a link to any third-party content, you should read their posted privacy policy information about how they collect and use personal information.

Who we are and what this policy covers

The data controller for personal information collected through our website and marketing is Ditch Carbon Ltd, trading as DitchCarbon, company number 13487671, registered office 167-169 Great Portland Street, London W1W 5PF. You can reach us at enquiries@ditchcarbon.com.

This policy covers personal information: information about identifiable individuals. Business data that customers and suppliers provide through our platform and API, such as spend files, supplier lists, uploaded documents and emissions data, is governed by our Terms and Conditions, in particular the confidentiality, data protection and sub-processor clauses in Part A and Schedule 1. Where that business data contains personal information, typically the business contact details of supplier or counterparty staff, we process it as a processor on the customer's behalf under those terms, and the customer is the controller.

Information We Collect

Information we collect includes both information you knowingly and actively provide us when using or participating in any of our services and promotions, and any information automatically sent by your devices in the course of accessing our products and services.

Log Data

When you visit our website, our servers may automatically log the standard data provided by your web browser. It may include your device's Internet Protocol (IP) address, your browser type and version, the pages you visit, the time and date of your visit, the time spent on each page, and other details about your visit.

Additional Log Data

Additionally, if you encounter certain errors while using the site, we may automatically collect data about the error and the circumstances surrounding its occurrence. This data may include technical details about your device, what you were trying to do when the error happened, and other technical information relating to the problem. You may or may not receive notice of such errors, even in the moment they occur, that they have occurred, or what the nature of the error is. Please be aware that while this information may not be personally identifying by itself, it may be possible to combine it with other data to personally identify individual persons.

Personal Information

We may ask for personal information which may include your name, business email address, job title, organisation, telephone number, and the content of any messages, forms or support requests you send us. When you use our platform we also hold your account login details and a record of your activity within the platform.

Lawful bases for processing your personal information

We only collect and use personal information where UK data protection law gives us a lawful basis to do so, and we collect only what is reasonably necessary. The bases we rely on are: performance of a contract, where you or your organisation use our platform, claim a profile or ask us for a service; our legitimate interests, for example responding to enquiries, keeping our website and platform secure, understanding how they are used, and contacting people in business roles about products relevant to their work, where those interests are not overridden by your rights; your consent, for non-essential cookies and where you have opted in to marketing, which you can withdraw at any time; and compliance with a legal obligation, such as keeping records we are required to keep.

Collection and Use of Information

We may collect personal information from you when you do any of the following on our website: Use a mobile device or web browser to access our content Contact us via email, social media, or on any similar technologies When you mention us on social media We may collect, hold, use, and disclose information for the following purposes, and personal information will not be further processed in a manner that is incompatible with these purposes: to provide you with our platform's core features and services to contact and communicate with you Please be aware that we may combine information we collect about you with general information or research data we receive from other trusted sources.

Security of Your Personal Information

When we collect and process personal information, and while we retain this information, we will protect it within commercially acceptable means to prevent loss and theft, as well as unauthorized access, disclosure, copying, use, or modification. Although we will do our best to protect the personal information you provide to us, we advise that no method of electronic transmission or storage is 100% secure, and no one can guarantee absolute data security. We will comply with laws applicable to us in respect of any data breach. You are responsible for selecting any password and its overall security strength, ensuring the security of your own information within the bounds of our services.

How Long We Keep Your Personal Information

We keep your personal information only for as long as we need to. This time period may depend on what we are using your information for, in accordance with this privacy policy. If your personal information is no longer required, we will delete it or make it anonymous by removing all details that identify you. However, if necessary, we may retain your personal information for our compliance with a legal, accounting, or reporting obligation or for archiving purposes in the public interest, scientific, or historical research purposes or statistical purposes.

Children's Privacy

We do not aim any of our products or services directly at children under the age of 13, and we do not knowingly collect personal information about children under 13.

Disclosure of Personal Information to Third Parties

We may disclose personal information to: a parent, subsidiary, or affiliate of our company third party service providers for the purpose of enabling them to provide their services, for example, IT service providers, data storage, hosting and server providers, advertisers, or analytics platforms our employees, contractors, and/or related entities our existing or potential agents or business partners courts, tribunals, regulatory authorities, and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise, or defend our legal rights third parties, including agents or sub-contractors, who assist us in providing information, products, services, or direct marketing to you third parties to collect and process data

Your Rights and Controlling Your Personal Information

You always retain the right to withhold personal information from us, with the understanding that your experience of our website may be affected. We will not discriminate against you for exercising any of your rights over your personal information. If you do provide us with personal information you understand that we will collect, hold, use and disclose it in accordance with this privacy policy. You retain the right to request details of any personal information we hold about you. If we receive personal information about you from a third party, we will protect it as set out in this privacy policy. If you are a third party providing personal information about somebody else, you represent and warrant that you have such person's consent to provide the personal information to us. If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time. We will provide you with the ability to unsubscribe from our email-database or opt out of communications. Please be aware we may need to request specific information from you to help us confirm your identity. If you believe that any information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, please contact us using the details provided in this privacy policy. We will take reasonable steps to correct any information found to be inaccurate, incomplete, misleading, or out of date. If you believe that we have breached a relevant data protection law and wish to make a complaint, please contact us using the details below and provide us with full details of the alleged breach. We will promptly investigate your complaint and respond to you, in writing, setting out the outcome of our investigation and the steps we will take to deal with your complaint. You also have the right to contact a regulatory body or data protection authority in relation to your complaint.

Where your personal information is stored

Our platform and its database are hosted in Frankfurt, Germany, in the European Union, which the UK recognises as providing adequate protection for personal data. Some of our service providers, such as email, support and analytics tools, process data outside the UK and EU. Where they do, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on the provider's certification under the UK Extension to the EU-US Data Privacy Framework. The location of each provider is listed in Schedule 1 of our Terms and Conditions.

Your rights under UK data protection law

You have the right to ask for a copy of the personal information we hold about you, to have inaccurate information corrected, to have information erased where we no longer need it, to restrict or object to processing (including objecting to direct marketing at any time), to receive information you gave us in a portable format, and to withdraw consent where consent is the basis for processing. To exercise any of these rights, email enquiries@ditchcarbon.com. We will respond within one month. If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, although we would welcome the chance to resolve it with you first.

Use of Cookies

We use cookies and similar technologies on our website and platform. Essential cookies keep the site and platform working, for example remembering that you are logged in, and do not require consent. Analytics cookies help us understand how the site is used; we use Google Analytics 4 and Microsoft Clarity for this, with form input fields masked. Marketing cookies from HubSpot let us recognise returning visitors and measure our campaigns. Analytics and marketing cookies are set only if you accept them in the cookie banner, and you can change your choice at any time through the banner or your browser settings. Blocking essential cookies may stop parts of the site or platform from working.

Limits of Our Policy

Our website may link to external sites that are not operated by us. Please be aware that we have no control over the content and policies of those sites, and cannot accept responsibility or liability for their respective privacy practices.

Changes to This Policy

At our discretion, we may change our privacy policy to reflect updates to our business processes, current acceptable practices, or legislative or regulatory changes. If we decide to change this privacy policy, we will post the changes here at the same link by which you are accessing this privacy policy. If required by law, we will get your permission or give you the opportunity to opt in to or opt out of, as applicable, any new uses of your personal information.

Use of SBTi data

The SBTi bears no responsibility for any inaccuracies in the transfer of data via the API. The SBTi is not affiliated with DitchCarbon. The SBTi has no responsibility or involvement in the platform operated by DitchCarbon.

Subprocessors

To support our services, DitchCarbon engages third-party subprocessors who process customer data on our behalf. These subprocessors provide infrastructure, customer relationship management, and productivity tools that enable us to deliver and maintain our services.

Our current sub-processors, what each one does and where it processes data are listed in Schedule 1 of our Terms and Conditions at ditchcarbon.com/license-agreement. We give customers 30 days' notice before adding or replacing a sub-processor.

We ensure that each subprocessor maintains appropriate technical and organizational security measures consistent with applicable data protection laws and our contractual obligations.

Contact Us

For any questions or concerns regarding your privacy, you may contact us using the following details:

Privacy officer
enquiries@ditchcarbon.com