Privacy policy & data protection

1. Introduction

CARBON4 FINANCE (“we”, “us”, or “our”) is committed to protecting the privacy and personal data of its website visitors, clients, and business partners. This Privacy Policy outlines how we collect, use, process, and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable data protection laws.

2. Data controller

The data controller responsible for the processing of your personal data is:

• Company name: CARBON4 FINANCE 
• Registered address: 54 rue de Clichy, 75009 Paris, France
• Registration: R.C.S. Paris B 814 626 511
• Contact email: dpo@carbon4finance.com

3. Personal data we collect

We collect personal data directly from you or automatically through third-party tools when you use our website or interact with our communications:

• Identity & contact data: name, job title, company name, professional email address, and phone number (e.g., when filling out a contact form, subscribing to a newsletter, or requesting a demo).
• Technical & usage data: IP address, browser type, operating system, referral source, pages visited, time spent, and specific event interactions on our website (e.g., button clicks, form submissions).
• Email & marketing engagement data: interaction metrics regarding our commercial communications and newsletters (e.g., open rates, click-through rates, and link tracking).

4. Purposes, legal bases & tools used

We process your personal data for the following specific purposes:

• Inquiries & Demo Requests
• • Category of data: Contact & identity data
  • Legal basis (GDPR): Pre-contractual measures or legitimate interest
  • Main service providers / tools: HubSpot
• B2B Outreach & CRM Management
• • Category of data: Contact & professional data
  • Legal basis (GDPR): Legitimate interest (B2B business development)
  • Main service providers / tools: HubSpot
• Email Marketing & Newsletters
• • Category of data: Contact data, open/click metrics
  • Legal basis (GDPR): Legitimate interest / Consent (where applicable)
  • Main service providers / tools: Mailchimp & HubSpot
• Email Engagement Tracking
• • Category of data: Open & click interaction data
  • Legal basis (GDPR): Legitimate interest (measuring campaign effectiveness)
  • Main service providers / tools: Tracking pixels via Mailchimp & HubSpot
• Website Analytics & Event Tracking
• • Category of data: Technical data, navigation events
  • Legal basis (GDPR): Consent (via Cookie Banner) / Legitimate interest
  • Main service providers / tools: Google Analytics via Google Tag Manager
• Website Performance & Security
• • Category of data: Technical & log data
  • Legal basis (GDPR): Legitimate interest (ensuring site stability and security)
  • Main service providers / tools: Hosting & Infrastructure Providers

5. Email tracking & analytics

Our commercial emails, newsletters, and automated workflows sent via HubSpot and Mailchimp may contain web beacons or tracking pixels.

• How it works: these pixels collect interaction data to inform us whether an email has been opened and which embedded links were clicked.
• Why we use it: this allows us to measure audience engagement, evaluate campaign performance, and tailor our follow-ups to match your professional interests.
• Your control: you can opt out or object to email tracking at any time by clicking the "Unsubscribe" link present in the footer of all our marketing emails, or by contacting us at dpo@carbon4finance.com.

6. Website analytics & tag management

We use Google Tag Manager (GTM) to deploy and manage scripts on our website, including Google Analytics.

• Google analytics: helps us measure user behavior, track specific events on the site (e.g., page views, resource downloads, form completions), and optimize user experience.
• Consent & cookies: analytics non-essential cookies and tracking scripts are deployed only if you consent via our website cookie consent banner. You can modify or withdraw your cookie consent at any time via the cookie settings on our website.

7. Data retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Prospect & marketing data: retained for up to 3 years from the date of collection or your last active contact with us.
• Client data: retained for the duration of the contractual relationship, plus applicable legal limitation periods (typically 5 to 10 years for legal and accounting records).

8. Data sharing & recipients

We do not sell, rent, or trade your personal data. We share data strictly with authorized service providers acting as Data Processors under binding data processing agreements ensuring compliance with the GDPR:

• Payload CMS / Headless content management system (Content management and website framework architecture)
• OVH (Cloud infrastructure and database hosting for our website and Payload CMS). 
• HubSpot, Inc. (CRM, marketing automation & lead management)
• The Rocket Science Group LLC Mailchimp / Intuit (email marketing & newsletters)
• Google Ireland Limited / Google LLC (Tag management & site analytics)

9. Your rights under the GDPR

You hold the following rights regarding your personal data:

• Right of access: request confirmation and a copy of the personal data we process about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure ("Right to be forgotten"): request deletion of your personal data where applicable.
• Right to object: object at any time to processing based on legitimate interest (including direct marketing and email tracking).
• Right to withdraw consent: withdraw your consent for web analytics cookies at any time without affecting prior lawful processing.
• Right to restriction: request the restriction of data processing under certain conditions.

To exercise any of these rights, please contact us at dpo@carbon4finance.com. If you consider that our processing violates data protection laws, you have the right to lodge a complaint with the French Data Protection Authority (CNIL – www.cnil.fr).

10. Security of your Data

We take the security of your data very seriously. We implement appropriate technical and organizational measures to protect your personal data against loss, theft, unauthorized access, disclosure, or modification.

In accordance with industry standards and the nature of the data we process, our security measures include, but are not limited to:

• Data encryption: all data transmitted between your browser and our website is encrypted using secure protocols (SSL/HTTPS). Sensitive data stored on our systems is also encrypted at rest.
• Restricted access: access to personal data is strictly limited to authorized personnel who need it to perform their job duties. All access is subject to strict authentication and confidentiality obligations.
• Network & infrastructure protection: our servers and networks are protected by firewalls, intrusion prevention systems, and regular security monitoring to prevent unauthorized intrusion.

While we continuously update and test our security technologies to maintain the highest level of protection taking into account the state of the art, no method of transmission over the Internet is 100% secure. In the event of a suspected or confirmed security breach affecting your personal data, we will take immediate action and notify you and the relevant regulatory authorities in accordance with applicable laws.

11. Updates to this policy

We reserve the right to modify this Privacy Policy to reflect regulatory evolution or changes in our operational tools. The current version will always be published on https://www.carbon4finance.com with an updated revision date.