Carbon Data Solutions (Pty) Ltd ("we", "us", "our") operates carbon.talent.
Last updated: 24 August 2026
Effective date: 17 August 2026
This Privacy Policy explains how we collect, use, store, and protect your personal information when you use carbon.talent. It applies to all users — companies (Clients) and data professionals (Consultants).
We comply with the following data protection laws, as applicable to your location:
Data Controller / Responsible Party:
Carbon Data Solutions (Pty) Ltd
144 Fagan Street, Strand, Western Cape, South Africa
platform@carbondatasolutions.com
Information Officer (POPIA):
Danie Zeeman — platform@carbondatasolutions.com
EU Representative (GDPR Article 27):
If you are located in the European Union or European Economic Area and have questions about how we handle your data, contact us at platform@carbondatasolutions.com. We will appoint a formal EU representative as our EU user base grows.
UK Representative (UK GDPR Article 27):
If you are located in the United Kingdom and have questions about how we handle your data, contact us at platform@carbondatasolutions.com. We will appoint a formal UK representative as our UK user base grows.
| Category | Examples |
|---|---|
| Identity data | Full name, SA ID number, nationality, date of birth |
| Contact data | Email address, phone number |
| Professional data | CV, job title, skills, years of experience, LinkedIn URL, GitHub URL, portfolio URL, work preferences, availability, hourly rate |
| Verification data | Identity verification status, biometric data processed by Persona Identities, Inc. (United States), identity document type |
| Assessment data | Evidence score, vetting tier (Bronze/Silver/Gold), assessment results, interview feedback |
| Profile data | Professional summary, video introduction, profile photo |
| Usage data | Login activity, pages visited, feature interactions |
| Communications | Messages sent via platform chat or support |
| Category | Examples |
|---|---|
| Identity data | Contact person name, job title |
| Company data | Company name, registration number, website, industry |
| Contact data | Email address, phone number, billing address |
| Payment data | Bank account details (EFT), card details (processed by PayFast — we do not store card numbers) |
| Job data | Job descriptions, requirements, screening questions |
| Pipeline data | Application notes, stage progression, hiring decisions |
| Usage data | Login activity, pages visited, feature interactions |
We collect standard web analytics data including IP address, browser type, device type, referring URL, and pages visited. This is used to operate and improve the platform.
We process your personal information on the following lawful bases:
| Purpose | Lawful basis (GDPR) | POPIA justification |
|---|---|---|
| Providing the platform (account creation, matching, pipeline) | Performance of contract | Contract |
| Identity verification | Legal obligation / legitimate interest | Legitimate purpose |
| Sending transactional emails (match notifications, stage updates, contract alerts) | Performance of contract | Contract |
| Processing payments | Performance of contract / legal obligation | Contract |
| Fraud prevention and platform security | Legitimate interests | Legitimate purpose |
| Improving the platform (analytics, error monitoring) | Legitimate interests | Legitimate purpose |
| Complying with legal obligations | Legal obligation | Legal obligation |
| Marketing communications (newsletter, platform updates) | Consent | Consent |
You may withdraw consent for marketing communications at any time by unsubscribing or contacting us.
To maintain the integrity of our consultant catalog, we verify the identity of Consultants before they are matched with Clients. This involves:
SA ID numbers and biometric data are special personal information under POPIA and special category data under GDPR. We process this data only for identity verification purposes. We do not use this data for any other purpose. Results are stored as a verification status (verified/not verified) — not the raw biometric data.
You have the right to object to this processing, but we may be unable to admit you to the consultant catalog if verification cannot be completed.
We use the following trusted third parties to operate the platform. Each has contractual data protection obligations with us:
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) | GDPR-compliant; DPA in place |
| Vercel | Frontend hosting | Global CDN (EU nodes available) | GDPR-compliant; DPA in place |
| Railway | Backend server hosting | US (can be configured to EU) | SOC 2 Type II |
| Resend | Transactional email delivery | US | DPA in place |
| Persona Identities, Inc. | Identity verification | United States | Standard Contractual Clauses (SCCs) in place; GDPR-compliant; POPIA-compliant where applicable |
| Sentry | Error monitoring | US | GDPR-compliant; DPA in place |
| Crisp | Customer support chat | EU (France) | GDPR-compliant |
| PayFast | Payment processing (ZAR) | South Africa | PCI DSS compliant |
| Paddle | Payment processing & Merchant of Record (USD, EUR, ZAR international) | UK / EU | GDPR-compliant; UK GDPR-compliant; PCI DSS; DPA in place |
| Anthropic | AI features (job spec generation, interview guides) | US | Data processing agreement |
We do not sell your personal information to any third party.
Our servers and some third-party providers are located outside South Africa. When we transfer personal information across borders, we ensure appropriate safeguards are in place:
If you are an EU/EEA data subject, your personal information may be transferred to South Africa, which does not currently have an EU adequacy decision. We rely on SCCs for these transfers.
| Data type | Retention period |
|---|---|
| Active consultant profiles | For the duration of your account + 3 years after last login |
| Active company accounts | For the duration of your account + 3 years after last activity |
| Job applications | 2 years from application date |
| Identity verification records | 5 years (legal/audit requirement) |
| Signed contracts | 7 years (statutory requirement for commercial records) |
| Payment records | 5 years (SARS requirement) |
| Support chat logs | 2 years |
| Server logs and analytics | 90 days |
You may request deletion of your account and personal information at any time (see Section 9). We may retain data where we have a legal obligation to do so.
We use cookies and similar technologies to operate the platform. These include:
| Type | Purpose | Examples |
|---|---|---|
| Essential | Session management, authentication | Hub_token, __session_ct |
| Functional | Preferences, chat widget | Crisp session cookie |
| Analytics | Platform usage analytics | Anonymous usage data |
You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in.
We do not use advertising or tracking cookies. We do not share cookie data with advertisers.
Depending on your location, you have the following rights regarding your personal information:
In addition to the POPIA rights above:
UK residents have equivalent rights to those under EU GDPR above, enforceable under the UK GDPR and Data Protection Act 2018:
If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:
To submit a CCPA request, email platform@carbondatasolutions.com with subject "CCPA Privacy Request". We will respond within 45 days (extendable by a further 45 days with notice). You may designate an authorised agent to make requests on your behalf.
We do not sell personal information and have not done so in the preceding 12 months.
Canadian residents have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, Law 25 (Bill 64):
We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances. We obtain meaningful consent before or at the time of collection.
Australian residents have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs):
We will respond to access and correction requests within 30 days. Where we are unable to provide access, we will provide written reasons.
To exercise any right: Email platform@carbondatasolutions.com with the subject line "Privacy Request — [your jurisdiction]". We will respond within the timeframe required by your applicable law. We may need to verify your identity before fulfilling the request.
We implement appropriate technical and organisational measures to protect your personal information:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Under POPIA, we will notify the Information Regulator and affected data subjects as required.
carbon.talent is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately and we will delete it.
We may update this policy from time to time. Material changes will be notified to registered users by email at least 14 days before they take effect. The "Last updated" date at the top of this policy reflects the most recent revision.
For any privacy-related questions, access requests, or complaints:
Carbon Data Solutions (Pty) Ltd
Information Officer: Danie Zeeman
platform@carbondatasolutions.com
144 Fagan Street, Strand, Western Cape, South Africa
Information Regulator of South Africa (POPIA):
inforegulator.org.za | complaints.IR@justice.gov.za
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
EU residents — supervisory authority (GDPR):
Contact the data protection authority in your EU member state.
UK residents — Information Commissioner's Office (UK GDPR):
ico.org.uk | 0303 123 1113
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
California residents — California Privacy Protection Agency (CCPA/CPRA):
cppa.ca.gov
Canadian residents — Office of the Privacy Commissioner (PIPEDA):
priv.gc.ca | 1-800-282-1376
Quebec residents — Commission d'accès à l'information (Law 25):
cai.gouv.qc.ca
Australian residents — Office of the Australian Information Commissioner (Privacy Act 1988):
oaic.gov.au | 1300 363 992