Consent to the processing of personal data

1 Information about the Controller

The Consent applies to carbonplatform.asia, carbonfin.asia, carbonmodel.asia, carboncbam.asia, carbonmarket.asia, 7G.carbonplatform.asia, as well as to the official subdomains, forms and mobile versions of these resources, where a link to this Consent is placed in the interface.

2 Statement of the data subject

I freely, of my own will and in my own interest, give HPBS LLC consent to the processing of my personal data to the extent and for the purposes set out below. I confirm that I provide accurate data, that I have read the Privacy Policy and that I understand the consequences of giving consent.

3 Personal data

• surname, first name and patronymic, where they are requested by the relevant form;
• telephone number, email address and preferred method of communication;
• position, place of work, name of the organisation and information about the authority of its representative;
• account identifier, authorisation information, selected language and profile settings;
• the content of enquiries, requests, support requests, correspondence and information voluntarily provided in attached files;
• technical data: IP address, cookies and similar identifiers, type of device and browser, date and time of access, login and action logs, source of referral;
• information about the use of the services, tariff, orders, contracts and payment status, without the Controller storing full bank card details.

The Controller does not ask users to provide special, biometric or genetic personal data through the ordinary forms of the websites. If a separate function requires such data, the Controller obtains separate consent in the form provided for by law.

4 Purposes of processing

• registration, identification and management of the user's account;
• provision of access to the GHG, PCAF, MRV, CBAM, Market products and the related registries;
• processing of the request, preparation of a proposal, conclusion and performance of a contract, issuing of invoices and client support;
• responses to enquiries, technical support, notifications about the operation of the service and information security;
• protection of accounts, prevention of abuse, investigation of failures and maintenance of audit logs;
• analysis and improvement of the websites and services using aggregated and, where possible, depersonalised data;
• compliance with legal requirements and protection of the legitimate rights of the Controller and users.

5 Actions and methods of processing

The Controller is entitled to carry out collection, recording, systematisation, accumulation, storage, clarification, modification, supplementation, extraction, use, provision to authorised processors, transfer, depersonalisation, blocking and destruction of personal data. Processing may be carried out by automated and non-automated means, including mixed processing.

Automated processing may be used for routing requests, access management, detection of suspicious activity, analytics and personalisation of the interface. Decisions that produce legal consequences for the user or otherwise significantly affect their rights are not taken exclusively automatically without a separate lawful basis and the necessary safeguards.

6 Transfer of data

To achieve the stated purposes, the Controller may entrust the processing of data to providers of hosting and cloud infrastructure, CMS and CRM, authorisation, email and notification services, analytics, technical support, backup, payment organisations, auditors and consultants. They receive only the necessary data, and access is granted on the basis of a contract and with an obligation to observe confidentiality and security requirements.

Cross-border transfer is permitted only in compliance with the requirements of the legislation of the Republic of Uzbekistan, including the rules on adequate protection, applicable contractual guarantees and other lawful bases. If the transfer is carried out to a state without a recognised adequate level of protection and the consent of the data subject is required, this Consent includes consent to such transfer only to the extent necessary for the service selected by the user, with prior information about the relevant recipient or category of recipients.

7 Validity period and storage

The Consent is valid from the day it is given until the stated purposes of processing are achieved or until it is withdrawn, unless longer storage is required by law, contract or for the protection of legitimate claims. After the lawful bases cease, the data is destroyed or depersonalised in the established manner. Information confirming the fact of consent and the user's actions may be stored for the period necessary to comply with legislation and protect the rights of the Controller.

8 Rights of the data subject and withdrawal of consent

I am notified that I have the right to:

• receive information about the existence, composition, bases, purposes, methods and periods of processing of my data;
• require clarification, temporary suspension of processing or destruction of the data in the cases provided for by law;
• withdraw consent in the same manner in which it was given, or send a written or electronic request to the Controller;
• apply to an authorised state body or court to protect my rights.

Withdrawal is sent to privacy@carbonplatform.asia or to the postal address of the Controller. The request must state information allowing the applicant and the relevant account or enquiry to be identified. Withdrawal does not affect the lawfulness of processing carried out before it was received and does not terminate processing for which the Controller retains another lawful basis.

9 Form of giving consent

Consent is deemed to have been given when the user ticks an independent, pre-unticked checkbox and then presses the button to submit the form, register or continue working. The electronic record of consent must contain the date and time, the version of the text, the page address, the identifier of the form or account and other technical information allowing the fact of its receipt to be confirmed.

10 Separate consent to marketing messages

Receiving advertising and marketing messages is not a condition of registration or of using the core functions of the platform. A separate voluntary consent applies to such messages:

☐ I agree to receive news, invitations, offers about products and events from HPBS LLC by email and telephone. I may opt out at any time via the link in the message or by contacting the Controller.

11 Recommended text for website forms

☐ I give HPBS LLC consent to the processing of personal data in accordance with the Consent and confirm that I have read the Privacy Policy.

The words “Consent” and “Privacy Policy” must be active links and must open before the form is submitted.

12 Confirmation for a paper form

Regulatory basis

Law of the Republic of Uzbekistan “On Personal Data” of 2 July 2019 No. ZRU-547 in its current wording, including the amendments introduced by the Law of 26 March 2026 No. ZRU-1125.