Privacy Policy
Data controller
carbonmeld.com
Email: [email protected]
What data we collect and why
Contact, consulting, advertising, and document submission forms
When you fill in a form on the site (contact, consulting request, advertising inquiry, document submission), we collect the data you enter: name, email, company, and message content.
Legal basis: pre-contractual measures at your request (Art. 6.1.b GDPR). We collect this data only because you provide it voluntarily to receive a response or a service.
Retention: form data is retained for 24 months from last contact, then deleted unless an active contractual relationship exists.
Payments
Payments for document submissions are handled by NOWPayments (nowpayments.io). CarbonMeld does not collect or store payment data. NOWPayments acts as a data processor solely for payment processing.
Legal basis: performance of contract (Art. 6.1.b GDPR).
Traffic analytics
The site uses Google Analytics to collect anonymous usage data: pages visited, session duration, device, approximate geographic area, traffic source. We do not collect data that directly identifies a user.
Legal basis: legitimate interest of the controller in understanding and improving the service (Art. 6.1.f GDPR). You may object to this processing at any time — see "Your rights" below.
Form protection
The site uses Cloudflare Turnstile to protect forms from automated abuse. Turnstile may collect technical session data to distinguish human users from bots.
Legal basis: legitimate interest of the controller in service security (Art. 6.1.f GDPR).
Language preference
The site saves your language preference in a browser localStorage key (cm_lang). This data stays on your device and is not transmitted to CarbonMeld.
Newsletter subscription
If you subscribe to the CarbonMeld newsletter, we collect your email address and language preference. This data is stored in Cloudflare KV (key-value storage infrastructure) and used exclusively to send you the newsletter and a one-time welcome email on first subscription.
Legal basis: your consent (Art. 6.1.a GDPR), freely given by submitting the subscription form.
Retention: until you request deletion. To unsubscribe, visit carbonmeld.com/unsubscribe/ or write to [email protected].
Right to withdraw consent: you may withdraw your consent at any time with the same ease as giving it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Cookies and similar technologies
CarbonMeld uses:
- Google Analytics analytics cookies (for the purposes described above)
- Cloudflare Turnstile (technical cookies for form protection)
- localStorage (
cm_lang) for language preference
CarbonMeld does not use its own advertising cookies and does not carry out profiling.
Recipients of data
Personal data may be shared with:
- Google LLC (Google Analytics) — traffic analysis
- Cloudflare Inc. (Turnstile, KV storage) — form protection and newsletter subscriber storage
- Resend Inc. (resend.com) — transactional and newsletter email delivery
- NOWPayments (NOWPayments OU) — payment processing
These parties act as data processors or independent controllers, each under their own privacy policy.
CarbonMeld does not sell, transfer, or share personal data with third parties for marketing purposes.
Transfers outside the EU
Google Analytics, Cloudflare, and Resend may transfer data to the United States. These transfers are made on the basis of the EU-US Data Privacy Framework (for certified entities) and/or Standard Contractual Clauses approved by the European Commission.
NOWPayments (registered in Estonia) processes payment data within the EU.
Retention periods
| Data | Retention |
|---|---|
| Contact form data | 24 months from last contact |
| Contractual data (consulting, document submission) | Duration of relationship + 10 years (tax obligations) |
| Google Analytics data | 14 months (GA4 default setting) |
| Newsletter subscription data (email, language) | Until unsubscription request |
| Language preference (localStorage) | Until deleted by the user |
Your rights
Under the GDPR, you have the right to:
- Access: obtain confirmation that processing exists and a copy of your data
- Rectification: correct inaccurate or incomplete data
- Erasure: request deletion of your data, within legal limits
- Restriction: request restriction of processing in certain cases
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interest, including traffic analytics
- Withdrawal of consent: where processing is based on consent (newsletter subscription), withdraw it at any time by unsubscribing
To exercise these rights, write to [email protected]. We will respond within 30 days.
Right to lodge a complaint
If you believe that the processing of your data violates the GDPR, you may lodge a complaint with your national supervisory authority. If you are in the EU, you may also contact the supervisory authority in your country of residence. A list of EU supervisory authorities is available at edpb.europa.eu.
Changes to this policy
Any changes will be published on this page with the update date. In the event of material changes, we will update the date prominently.