Privacy Policy of the 7G Carbon Platform ecosystem

1 General provisions

1.1. This Privacy and Personal Data Processing Policy (hereinafter — the “Policy”) sets out the rules for the processing and protection of personal data by HPBS LLC (hereinafter — the “Controller”, “we”) in the use of the digital ecosystem of the 7G Carbon Platform.

1.2. The Policy has been developed in accordance with the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of 2 July 2019 in its current wording, other applicable acts of the legislation of the Republic of Uzbekistan, and also taking into account the Controller's contractual obligations towards clients and users.

1.3. By using the websites, creating an account, submitting a form or continuing to work in the personal account after having familiarised themselves with the Policy, the user confirms that they have read its terms. Where the law requires consent, the Controller requests it separately in a form that allows the fact of receipt to be confirmed.

1.4. If a user provides the data of another person, they confirm that there is a lawful basis for such transfer and are obliged to inform that person about this Policy.

1.5. The Policy does not replace separate consent to the processing of personal data, consent to marketing messages, a contract, a user agreement or the terms of a specific service, where such documents are required.

2 Scope

2.1. The Policy applies to the following ecosystem resources, including their pages, subdomains, forms and software interfaces:

• carbonplatform.asia — corporate greenhouse gas (GHG) emissions accounting
• carbonfin.asia — financed emissions accounting (PCAF)
• carbonmodel.asia — project modelling and MRV
• carboncbam.asia — preparation of CBAM data and calculations
• carbonmarket.asia — carbon unit market services
• 7G.carbonplatform.asia — unified personal account and workspace
• registry.carbonmodel.asia — registry of climate projects
• registry.carbonmarket.uz — registry of climate statements and carbon units.

2.2. The Policy also applies to enquiries made through feedback forms, event registrations, requests for demonstrations and commercial proposals, the support service, integrations with CRM and other information systems used to provide the services.

2.3. Third-party websites and services to which external links lead operate under their own rules. The Controller does not determine the purposes and methods of data processing by such independent persons.

3 Key concepts

4 What data we process

4.1. The composition of the data depends on the chosen resource, the user's role, the terms of the contract and the function being used. The Controller may process:

• identification data: surname, first name, patronymic, position, organisation, role in the project or system;
• contact data: work and personal email address, telephone number, address for communication;
• account data: login, user identifier, information about roles and access rights, profile settings, account status; the password is stored in a protected form and is not displayed to the Controller's employees;
• enquiry and interaction data: the content of requests, correspondence, support enquiries, feedback, consents and refusals;
• contractual and payment information: details of the client or counterparty, information about representatives, contracts, invoices and payments; bank data is processed only to the extent necessary for settlements and accounting;
• project and corporate data, which may contain information about employees, experts, auditors, verifiers, suppliers and other participants in the processes;
• registry data: information about applicants, rights holders, participants in climate projects, experts and verifiers, where provided for by the rules of the relevant registry;
• technical data: IP address, date and time of access, type of device and browser, operating system, language, referral URL, session identifiers, event logs, information about errors and security;
• usage data: sections visited, actions performed, settings selected, responses to the interface and aggregated usage indicators;
• information from cookies and similar technologies within the settings selected by the user.

4.2. The Controller does not request special personal data, biometric or genetic data for ordinary registration and use of the services. If their processing becomes necessary for a separate function, it will be carried out only on a basis provided for by law and with separate notification of the user.

4.3. The environmental, energy, financial and production indicators of a legal entity are not in themselves personal data. However, the provisions of this Policy apply to them if they allow an individual to be identified directly or indirectly.

5 Sources of data

5.1. The Controller obtains data:

• directly from the user when completing forms, registering, concluding a contract, configuring a profile and contacting support;
• from the client or the user's employer, who provides the user with access to the workspace;
• from authorised representatives, partners, contractors, auditors and verifiers within the framework of a project or contract;
• automatically when using the websites and the personal account;
• from lawfully available state, corporate and public sources, where this is necessary to verify a project, counterparty, climate statement or registry entry;
• through integrations permitted by the user and imported files.

6 Purposes and legal bases of processing

7 Processing procedure

7.1. Processing may be carried out by automated, non-automated or mixed means. The Controller performs only the actions necessary for the stated purposes.

7.2. Access to data is granted according to a role model and to the extent necessary for an employee, client, expert, verifier or contractor to perform their tasks. Actions in the system may be recorded in audit logs.

7.3. Within a corporate client, the workspace administrator may manage users, roles, projects and data visibility within the powers granted. The client is responsible for the lawfulness of uploading the personal data of its employees and other persons.

7.4. The platform's automated calculations and recommendations are intended for informational and operational support. Decisions creating legal consequences for an individual must not be taken solely on their basis without the human review provided for by law or contract.

8 Publication of data in registries

8.1. Registries may contain a publicly accessible part of the information about climate projects, statements and carbon units. Before publication, the user receives information about the composition of the published data and, where required, gives separate consent to its dissemination.

8.2. Contact data, documents, signatures, identifiers and other information of restricted access are not published unless publication is expressly provided for by law, the registry rules or the separate consent of the data subject.

8.3. A user may submit a request to clarify, restrict access to or delete published personal data. The Controller considers the request taking into account the requirements to preserve the accuracy, integrity and history of registry entries.

9 Cookies and analytics

9.1. The websites may use the following categories of cookies:

• essential — ensure security, authorisation, session retention and the operation of core functions;
• functional — remember the language, interface and other user settings;
• analytical — help assess traffic, performance and usability in aggregated form;
• marketing — used only when actually connected and with the required consent.

9.2. Optional cookies are activated in accordance with the user's choice in the settings panel. The user may change the choice, delete cookies or restrict their use through browser settings. Disabling essential cookies may disrupt authorisation and certain functions.

9.3. If third-party analytics, chat, map, video or anti-bot tools are connected to the websites, the user is provided with the necessary information before they are activated, and data transfer is carried out on a lawful basis.

10 Transfer of data to third parties

10.1. The Controller may transfer data only to the necessary extent to the following categories of recipients:

• providers of hosting, infrastructure, backup, communications, technical support and information security;
• providers of CRM, business communication and enquiry management services;
• auditors, consultants, verifiers and experts engaged in a specific project;
• partners and contractors involved in providing the ordered service;
• banks and payment organisations when making settlements;
• state bodies, courts and other authorised persons in the cases and in the manner provided for by legislation;
• a new owner or successor upon reorganisation or transfer of the relevant business, with confidentiality requirements preserved.

10.2. Persons processing data on the Controller's instruction undertake to observe confidentiality, to use the data only for the established purposes and to apply appropriate protection measures.

10.3. The Controller does not sell personal data and does not transfer it for independent advertising use without the user's separate consent.

11 Cross-border transfer and place of storage

11.1. The Controller organises the storage and cross-border transfer of personal data taking into account the requirements of the legislation of the Republic of Uzbekistan.

11.2. Personal data subject to mandatory storage on the territory of the Republic of Uzbekistan is stored on the territory of the Republic of Uzbekistan. Other data may be stored or processed outside it where the conditions provided for by law and sufficient protection guarantees exist.

11.3. Before connecting an external cloud service, the Controller assesses the place of processing, the contractual terms, the security measures and the admissibility of the transfer. Where necessary, separate consent of the data subject is requested.

12 Storage periods and destruction

12.1. Data is stored no longer than is necessary for the purposes of processing, the term of the consent or the performance of the contract, unless a longer period is established by legislation or is required to protect legitimate rights.

12.2. The following guidelines apply unless another period is established by the contract or mandatory rules:

• account data — during the period of its validity and for a reasonable period after closure for handling enquiries and security;
• requests and correspondence — for the period of handling the enquiry and the subsequent confirmation of its fulfilment;
• contractual, accounting and payment documents — for the periods of mandatory storage;
• security logs and technical backups — for the periods established by internal regulations, taking into account risks and the need to investigate incidents;
• marketing contacts — until consent is withdrawn or the relevant mailing is discontinued;
• registry information — in accordance with the registry rules and the requirements of accuracy and preservation of the history of entries.

12.3. Once the purpose has been achieved, the data is destroyed, depersonalised or blocked if its further storage is not required by law. Deletion from backups is carried out during the established cycle of their renewal while access restrictions are maintained.

13 Data protection

13.1. The Controller applies legal, organisational and technical measures appropriate to the nature of the data and the risks of processing, including:

• delimitation of access by roles and the principle of minimum necessary powers;
• identification and authentication of users, management of sessions and passwords;
• encryption of secured connections and, where applicable, of data at rest;
• logging of actions, monitoring of events and response to incidents;
• backup and verification of restoration;
• updating of software, control of vulnerabilities and configurations;
• training of employees and contractual obligations of confidentiality;
• assessment of contractors and restriction of their access;
• periodic review of protection measures.

13.2. The user is obliged to keep account credentials confidential, to use a strong password, not to transfer access to other persons and to report suspicious activity immediately.

13.3. No method of transmitting and storing information ensures absolute security. If an incident is detected, the Controller takes measures to localise it, eliminate the consequences and notify the affected persons and authorised bodies, where this is required by legislation.

14 User rights

14.1. Within the limits provided for by legislation, the user has the right to:

• learn whether the Controller holds their personal data and receive information about its composition and processing;
• require clarification of incomplete, outdated or inaccurate data;
• withdraw consent where the processing is based on consent;
• require temporary suspension of processing or destruction of the data where lawful grounds exist;
• opt out of marketing messages;
• receive information about the conditions for granting access to the data;
• apply to an authorised state body or court to protect rights and legitimate interests.

14.2. Withdrawal of consent does not affect the lawfulness of processing carried out before it was received and does not terminate processing that is necessary to comply with legal requirements or to protect the rights of the Controller and other persons.

15 Procedure for submitting requests

15.1. A request may be submitted through the feedback form or using the contact details of HPBS LLC published in the “Contacts” section on the ecosystem resources.

15.2. In the request it is recommended to state the surname and first name, a contact for the response, the resource used, the substance of the requirement and information allowing the relevant data to be found. The Controller is entitled to request confirmation of identity and of the representative's authority in order to prevent unlawful disclosure or modification of data.

15.3. The Controller considers the request within the period and in the manner established by legislation. If the fulfilment of the requirement is limited by law, the terms of the contract or the rights of other persons, a reasoned response is sent to the user.

16 Data of minors

16.1. The services are intended primarily for professional and corporate use and are not aimed at independent use by minors.

16.2. If the Controller becomes aware that a minor's data was obtained without the required consent of a legal representative, it will take measures to restrict processing and delete the data, unless another lawful basis exists.

17 Obligations of corporate clients

17.1. A client that uploads data to the platform or provides access to its employees independently ensures the existence of a lawful basis, the informing of data subjects, the correctness of the composition of the data and compliance with access restrictions.

17.2. If HPBS LLC processes data exclusively on the documented instruction of the client, the distribution of the duties of the owner and the operator of the personal data base is determined by the contract. The client must not upload special, biometric, genetic or excessive data without prior written agreement.

18 Amendment of the Policy

18.1. The Controller is entitled to amend the Policy in the event of the development of the services, changes in processing processes or legislation. The new revision enters into force on the date of publication, unless it states otherwise.

18.2. In the event of material changes affecting the rights of users or the purposes of processing, the Controller places a prominent notice on the ecosystem resources and, where necessary, requests consent again.

19 Contacts of the Controller

Personal data controller: HPBS LLC, Republic of Uzbekistan.

Enquiries on personal data matters are accepted through the feedback form and using the current details published in the “Contacts” section on the websites of the 7G Carbon Platform ecosystem.

20 Regulatory basis

Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of 2 July 2019, current wording: LexUZ