Privacy notice

Who we are

Biochar Systems UK ("we", "us", "our") operates the dMRV platform at biocharsystems.co.uk. We are the data controller for the personal data described in this notice.

What we collect

• Account data — name, work email, role, organisation you belong to.
• Operational data — the records you create inside the platform (biomass sources, batches, credits, attachments).
• Communications — messages you send via the contact form or to our support inbox.
• Technical data — IP address, user-agent, and session metadata captured for security and audit purposes.

Why we use it

We process personal data to provide the service you've signed up for, to keep an immutable audit trail of changes (a regulatory requirement of carbon MRV), to keep the platform secure, and to respond when you contact us.

Lawful basis

We rely on the lawful bases of contract (to deliver the platform), legitimate interests (security and audit logging), and consent (where you've explicitly opted in to communications).

How long we keep it

Operational records (batches, credits, audit logs) are retained for the lifetime of any credit they support, plus the period required by the applicable methodology or registry — typically 10 years. Account data is retained while your account is active and for up to 24 months after closure.

Sharing

• Sub-processors — Supabase (database, auth, storage), Vercel (hosting), Resend (transactional email). All process data on our instructions.
• Auditors — when you explicitly grant access, scoped read-only auditor accounts can see the batches in scope.
• Authorities — only where legally required.

Your rights

You can request access, correction, deletion, restriction, portability, or object to processing of your personal data. Email privacy@biocharsystems.co.uk. You also have the right to complain to the UK's ICO.

Contact

For any privacy questions, email privacy@biocharsystems.co.uk.