Privacy statement
Carbon Standards International respects your privacy. We therefore process your personal data strictly in accordance with the applicable data protection law, which includes the Swiss Data Protection Act and, where relevant, the EU General Data Protection Regulation (GDPR). We reserve the right to revise this privacy statement from time to time. Each time you open or visit the website, the then current version that is available there applies.
What does this privacy policy govern?
This privacy statement contains information on how we at Carbon Standards International collect and process personal data on our website www.carbon-standards.com.
How can you reach us?
If you have any questions regarding the processing of your personal data or would like to exercise your data subject rights, please feel free to contact our service team at [email protected].
What personal data do we collect and process?
Personal data is data that can be used to identify you or that we can otherwise attribute to you. We process personal data that you provide to us voluntarily, namely when you communicate with us by email or through points of sale. The following data types/categories may be collected, processed and used by Carbon Standards International:
- Personal master data (e.g., surname, first name, address)
- Communication data (e.g., telephone, e-mail)
- Contract master data (e.g., contractual relationship, product or contractual interest)
- IT usage data (e.g., UserID, passwords, roles, IP address, referrer URL)
- Bank details (e.g., account details / credit card number)
How and for what purposes do we use your data?
We use your personal data in the administration of our customer relationship with you, for communication purposes, for job applications, the processing of contracts, invoicing, information on services and their marketing, support in technical matters and the evaluation and further development of services and products.
How do we use your data in relation to the contact form?
If you contact us via the contact form or the form to register your interest, we process the data you enter: title, first name, family name, company, country, e-mail address, phone number and message, how you heard about us (voluntary), and your confirmation that you have read this privacy statement. With the form for a public consultation we process your feedback, your organisation, the contact person and the e-mail address. With every form we also store the page from which you sent it, the time of sending and, for security and abuse prevention, your IP address and the browser/device type. We use these data only to answer your enquiry or to evaluate your feedback, and for the related follow-up.
Your entry is stored in the database of our website (server in Germany, see hosting) and sent by e-mail to [email protected]. The e-mail is sent from [email protected] through our e-mail service provider Brevo (Sendinblue SAS, France), which acts as our processor. Spam protection: see Cloudflare Turnstile.
The entries in the website database are deleted automatically after 90 days; e-mails in our mailbox are kept according to our general retention rules. (Legal basis: steps prior to entering into a contract or our legitimate interest in answering enquiries, Art. 6(1)(b) and (f) GDPR.)
Newsletter
If you subscribe to our newsletter, we use the double opt-in procedure: after signing up you receive an e-mail asking you to confirm your subscription; only after that confirmation will you receive the newsletter. We store your title, first name, last name, company, e-mail address, language, the page on which you signed up, the time of sign-up and of confirmation and the IP address used, so that we can send you the newsletter in your language and prove your consent.
We send the newsletter with Brevo (Sendinblue SAS, France), which processes the data on our behalf on servers in the EU. Your sign-up is handed to Brevo straight away; the copy in the database of our website is deleted automatically 30 days later. Brevo also records whether a newsletter was delivered and opened and which links were clicked, so that we can improve our newsletter.
You can unsubscribe at any time via the link at the end of every newsletter or by e-mail to [email protected]; your address is then marked as unsubscribed in Brevo so that no further newsletter is sent to it, and on request we delete it completely. More information: https://www.brevo.com/legal/privacypolicy/. (Legal basis: your consent, Art. 6(1)(a) GDPR.)
Comments on news articles
When we offer the comment function on our news articles, the following applies. To publish a comment we process your name, your e-mail address, your comment, the time of the comment and, for security and abuse prevention, your IP address and browser information. Every comment is checked by us before it is published; only your name, the date and the comment are shown, your e-mail address is never published. We are notified of new comments by e-mail at [email protected]. The comment form is protected against spam by Cloudflare Turnstile (see Cloudflare). We set no cookies for comments: your name and e-mail address are not remembered in your browser.
Comments are stored in the database of our website (server in Germany, see hosting). Comments that are not published are deleted after 30 days. The IP address and the browser information of a comment are deleted after 14 days. Published comments are kept as long as the article is online and are deleted on request: you can ask us at any time to correct or delete your comment by e-mail to [email protected]. (Legal basis: your consent when sending the comment and our legitimate interest in an open discussion free of abuse, Art. 6(1)(a) and (f) GDPR.)
Is your data exchanged within the EASY-CERT group?
For the purpose of processing, your information may be forwarded internally by Carbon Standards International to group members of the EASY-CERT group AG and also to the Global Carbon Register Foundation. They will be further processed there depending on the service you have requested.
When is your data otherwise passed on to third parties?
We will pass on your personal user data to third parties in aggregated form if you have made your data publicly available on Carbon Standards International.
Furthermore, we only pass on your personal user data to third parties in the following cases: (1) if you have given your express consent to do so, (2) if the disclosure is necessary for the assertion, exercise or defense of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data, (3) if there is a legal obligation for the transfer or if it is necessary for the processing of contractual relationships with you.
How do we use plugins, tools and cookies?
Cookies. Cookies are small text files that are stored in your browser when you visit a website; similar technologies store information in your browser's local storage. We use necessary cookies that the website needs to work (e.g. to remember your language and your cookie choice); they are set without consent.
We use analytics and marketing cookies (Google Analytics, Meta Pixel, LinkedIn Insight Tag) only if you agree: when you first visit the website, a banner lets you choose between "Accept all" and "Only necessary". Before you choose, and if you choose "Only necessary", none of these tools are loaded. Your choice is stored in a cookie for 6 months; after that we ask again. You can change your choice at any time with the link "Cookie settings" at the bottom of every page; if you withdraw your consent, the analytics and marketing cookies set on our website are deleted.
You can also block or delete cookies in your browser settings; the website still works with necessary cookies only. The cookies and similar technologies used on our website are listed in the cookie table below.
- Google Tag Manager:
The Google Tag Manager (GTM) is a tool for websites to reload additional tools. In order for Google to monitor the stability, performance and installation quality of the system and to obtain data for diagnosis, Google Tag Manager collects certain aggregated data for tag triggering. This data does not include IP addresses or measurement IDs linked to a specific individual. Google Tag Manager does not collect, store or share information about visitors. For more information about the data collected by Google Tag Manager and Google's privacy policy, please visit https://policies.google.com/privacy and https://support.google.com/tagmanager/answer/9323295?hl=en. We load Google Tag Manager (provider: Google Ireland Limited, Ireland) only after you have chosen "Accept all"; through it we load Google Analytics, the Meta Pixel and the LinkedIn Insight Tag. - Facebook Pixel:
Our website uses Facebook Pixel (Meta Pixel), a tool that allows us to measure the effectiveness of our advertising campaigns on Facebook and Instagram and to show you relevant ads based on your activity on our website. This tool is only activated after your consent via our cookie banner ("Accept all"). Provider: Meta Platforms Ireland Limited (Ireland). Data may be transferred to the parent company in the USA; Meta is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. You can withdraw your consent at any time under "Cookie settings". For more information, please visit Meta's privacy policy at https://www.facebook.com/privacy/policy. (Legal basis: your consent, Art. 6(1)(a) GDPR.) - LinkedIn Insight Tag:
Our website uses LinkedIn Insight Tag, a tool that allows us to track conversions from advertising campaigns on LinkedIn and to better understand the professional profile of our website's visitors. This tool is only activated after your consent via our cookie banner ("Accept all"). Provider: LinkedIn Ireland Unlimited Company (Ireland). Data may be transferred to the parent company in the USA; LinkedIn is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. You can withdraw your consent at any time under "Cookie settings". For more information, please visit LinkedIn's privacy policy at https://www.linkedin.com/legal/privacy-policy and its cookie policy at https://www.linkedin.com/legal/cookie-policy. (Legal basis: your consent, Art. 6(1)(a) GDPR.) - Google Search Console:
Search Console tools and reports help us measure our website's Google search traffic and performance, and troubleshoot problems. They also ensure that our website can be found through search queries on Google. For more information on Google's privacy policy, please visit https://policies.google.com/privacy?hl=en. - YouTube videos:
Some pages contain videos from YouTube (provider: Google Ireland Limited, Ireland). The videos are embedded in the privacy-enhanced mode (youtube-nocookie.com) and are loaded only when you click on the video; before that no connection to YouTube is made. When you start a video, your IP address and technical data are transmitted to YouTube/Google, and YouTube may store information in your browser. Data may be transferred to the USA; Google is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. More information: https://policies.google.com/privacy. (Legal basis: your consent by clicking on the video, Art. 6(1)(a) GDPR.)
Cookie table
| Name | Provider / set by | Purpose | Lifetime | Category |
|---|---|---|---|---|
csi_consent |
carbon-standards.com (this website) | Stores your cookie choice ("Accept all" or "Only necessary") | 6 months | Necessary |
wp-wpml_current_language |
carbon-standards.com (this website) | Remembers the language you are using (EN/DE) | 1 day | Necessary |
__cf_bm |
Cloudflare (on carbon-standards.com) | Distinguishes people from bots; set only if Cloudflare's bot protection is switched on for the domain (not set with the current settings) | 30 minutes | Necessary |
| Cloudflare Turnstile (no cookie) | Cloudflare (challenges.cloudflare.com) | Spam protection of our forms; processes IP address and browser data when a page with a form is opened | - | Necessary |
_ga |
Google Analytics 4 (on carbon-standards.com) | Distinguishes visitors for usage statistics | 2 years (browsers may shorten to 400 days) | Analytics, only after "Accept all" |
_ga_VMLTH6DJWZ |
Google Analytics 4 (on carbon-standards.com) | Keeps the state of a visit (session) | 2 years (browsers may shorten to 400 days) | Analytics, only after "Accept all" |
_fbp |
Meta Pixel (on carbon-standards.com) | Recognises the browser to measure the success of ads on Facebook/Instagram | 90 days | Marketing, only after "Accept all" |
lastExternalReferrer, lastExternalReferrerTime (local storage) |
Meta Pixel (on carbon-standards.com) | Stores the last external page you came from | until deleted (removed when you withdraw consent) | Marketing, only after "Accept all" |
Cookies on linkedin.com (e.g. bcookie, lidc, li_sugr, UserMatchHistory, AnalyticsSyncHistory) |
LinkedIn Insight Tag (set by LinkedIn on its own domain) | Measures the success of LinkedIn ads; lifetimes according to LinkedIn's cookie table | up to 1 year | Marketing, only after "Accept all" |
Cookies on facebook.com (e.g. fr) |
Meta (set by Meta on its own domain, if you are logged in to Facebook/Instagram) | Ad delivery and measurement; see Meta's cookie policy | up to 90 days | Marketing, only after "Accept all" |
| YouTube (youtube-nocookie.com) | Only after you click on a video; YouTube may store information in your browser after playback | - | Loaded on click |
How do we use web analytics tools?
- We use Google Analytics 4 (provider: Google Ireland Limited, Ireland) only if you have chosen "Accept all" in the cookie banner. To constantly improve and optimise our website, we use Google Analytics as a web analysis tool. This provides us with statistics and graphics that give us information about the use of our website. Google Analytics 4 does not log or store IP addresses. The usage data are processed by Google, also in the USA; Google is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework. The data are kept for 2 months and then deleted automatically. You can withdraw your consent at any time under "Cookie settings". (Legal basis: your consent, Art. 6(1)(a) GDPR.)
The easiest way to prevent Google Analytics is to choose "Only necessary" in our cookie settings. You can also prevent the collection of data generated by cookies and related to your use of the website by Google, as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link https://tools.google.com/dlpage/gaoptout?hl=en.
If you do not want the provider to collect data about you via cookies, you can select the function 'Block third-party cookies' in your browser settings. Then the browser will not send cookies to the server for embedded content from other providers. With this setting, other functions of our website may also no longer work.
How do we protect your data?
We use appropriate technical and organisational measures to protect your personal data from loss and unauthorised access. We regularly review our security policies and procedures to ensure that our systems are secure.
The website is hosted on a dedicated server of Hetzner Online GmbH (Germany) in a data centre in Nuremberg, Germany. The server is administered on our behalf by our web agency Red Axis j.d.o.o. (Croatia), which processes data only on our instructions and under a data processing agreement with us. Daily backups are stored encrypted on a storage system of Hetzner Online GmbH in Falkenstein, Germany, for 30 days. When you visit the website, we use TLS encryption (HTTPS) in conjunction with the highest encryption level supported by your browser.
Server log files
When you visit our website, our server and our content delivery network (see Cloudflare) automatically record technical information sent by your browser: IP address, date and time of the request, the page or file requested, the amount of data transferred, the referring page (referrer), browser and operating system. We use this information only to operate the website securely, to detect and defend against attacks and to analyse errors; it is not combined with other data. The server log files are deleted automatically after 14 days, unless an incident has to be investigated. (Legal basis under the GDPR: our legitimate interest in a secure and working website, Art. 6(1)(f) GDPR.)
Cloudflare (content delivery, security and spam protection)
Our website is delivered through the network of Cloudflare, Inc. (USA). Cloudflare forwards all requests to our server, protects the website against attacks (web application firewall) and speeds up delivery. To do this, Cloudflare processes your IP address and the technical data of your requests (see server log files). With the current settings Cloudflare sets no cookies on our website; if its bot protection is switched on, Cloudflare may set a technically necessary cookie to distinguish people from automated bots (see cookie table).
On pages with one of our forms (contact, interest, consultation, newsletter) we use Cloudflare Turnstile to protect the form against spam. Turnstile checks in the background, without a puzzle in most cases, whether the form is used by a person; for this it processes your IP address and technical information about your browser and device. Turnstile sets no cookies.
Cloudflare may process data in the USA. Cloudflare is certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework; in addition, Cloudflare's data processing terms with standard contractual clauses apply. More information: https://www.cloudflare.com/privacypolicy/ and https://www.cloudflare.com/turnstile-privacy-policy/. (Legal basis: our legitimate interest in a secure website and in protection against spam, Art. 6(1)(f) GDPR.)
How long do we keep your data?
We retain your personal data for as long as is necessary for the purposes for which it was collected, for as long as we are required to do so by law or for as long as we have a legitimate interest in retaining it (e.g. for evidence or IT security purposes). For the website in particular: server log files 14 days; backups 30 days; entries of the contact, interest and consultation forms in the website database 90 days; newsletter sign-ups in the website database 30 days after they have been handed to Brevo, in Brevo until you unsubscribe; comments as described in the section on comments; Google Analytics data 2 months.
What rights do you have with regard to your personal data?
You have the right to obtain information about your stored personal data at any time, to request the surrender or transfer of your stored personal data, to correct or supplement your personal data, to object to the processing of your personal data or to request the deletion of your personal data.
Disclaimer and copyrights
This website is subject to the following binding terms of use, which the user agrees to by accessing this website. This website contains data and information of all kinds that are a protected trademark of and/or copyrighted by us or, in individual cases, third parties. It is therefore not permitted to download, copy and distribute this website or any parts of it. This does not apply to copying for technical reasons to be able to browse, provided that such actions do not serve any commercial purposes, as well as to make permanent copies for your own use.
We cannot guarantee that the information contained on this website is correct and complete. References and links to third-party websites do not mean that we endorse the contents that such references or links lead to. The contents do not give rise to any responsibility on our part for the data and information provided there. We have no influence on the contents to which the link leads. Therefore, we cannot be held liable for any illegal, inaccurate or incomplete contents and for damages resulting from the use of any content to which any of the links lead.
We expressly reserve the right to alter, supplement or delete any part or all of the pages on this website, or to cease publication of the web pages temporarily or definitively without notice.
The user uses the Internet at their own risk. In particular, we cannot be held liable for any failure of the Internet or Internet access for technical reasons.
Please note that we accept no liability for the disclosure of information due to errors in data transmission not caused by us and/or unauthorised access by third parties (e.g. hacker attack on email account or telephone, interception of faxes).
The exclusive place of jurisdiction for legal entities is Frick, Switzerland.
We reserve the right to modify these terms of use and to adapt them to technical and legal developments.
Should individual provisions of these terms of use become invalid, the remaining provisions shall remain unaffected.
Carbon Standards International AG - 16 October 2026