Carbon Data Solutions (Pty) Ltd ("we", "us", "our") operates carbon.talent.
Last updated: 24 August 2026
Effective date: 17 August 2026
This Privacy Policy explains how we collect, use, store, and protect your personal information when you use carbon.talent. It applies to all users, companies (Clients) and data professionals (Consultants).
We comply with the following data protection laws, as applicable to your location:
Data Controller / Responsible Party:
Carbon Data Solutions (Pty) Ltd
144 Fagan Street, Strand, Western Cape, South Africa
talent@carbondatasolutions.com
Information Officer (POPIA):
Danie Zeeman, talent@carbondatasolutions.com
EU Representative (GDPR Article 27):
If you are located in the European Union or European Economic Area and have questions about how we handle your data, contact us at talent@carbondatasolutions.com. We will appoint a formal EU representative as our EU user base grows.
UK Representative (UK GDPR Article 27):
If you are located in the United Kingdom and have questions about how we handle your data, contact us at talent@carbondatasolutions.com. We will appoint a formal UK representative as our UK user base grows.
| Category | Examples |
|---|---|
| Identity data | Full name, SA ID number, nationality, date of birth |
| Contact data | Email address, phone number |
| Professional data | CV, job title, skills, years of experience, LinkedIn URL, GitHub URL, portfolio URL, work preferences, availability, hourly rate |
| Verification data | Identity verification status, biometric data processed by Didit (didit.me), identity document type |
| Assessment data | Skills test results and interview feedback |
| Profile data | Professional summary, video introduction, profile photo |
| Usage data | Login activity, pages visited, feature interactions |
| Communications | Messages sent via platform chat or support |
| Category | Examples |
|---|---|
| Identity data | Contact person name, job title |
| Company data | Company name, registration number, website, industry |
| Contact data | Email address, phone number, billing address |
| Payment data | Bank account details (EFT), card details (processed by PayFast, we do not store card numbers) |
| Job data | Job descriptions, requirements, screening questions |
| Pipeline data | Application notes, stage progression, hiring decisions |
| Usage data | Login activity, pages visited, feature interactions |
We collect standard web analytics data including IP address, browser type, device type, referring URL, and pages visited. This is used to operate and improve the platform.
We process your personal information on the following lawful bases:
| Purpose | Lawful basis (GDPR) | POPIA justification |
|---|---|---|
| Providing the platform (account creation, matching, pipeline) | Performance of contract | Contract |
| Identity verification | Legal obligation / legitimate interest | Legitimate purpose |
| Sending transactional emails (match notifications, stage updates, contract alerts) | Performance of contract | Contract |
| Processing payments | Performance of contract / legal obligation | Contract |
| Fraud prevention and platform security | Legitimate interests | Legitimate purpose |
| Improving the platform (analytics, error monitoring) | Legitimate interests | Legitimate purpose |
| Complying with legal obligations | Legal obligation | Legal obligation |
| Marketing communications (newsletter, platform updates) | Consent | Consent |
You may withdraw consent for marketing communications at any time by unsubscribing or contacting us.
To maintain the integrity of our consultant catalog, we verify the identity of Consultants before they are shortlisted with Clients. This involves:
SA ID numbers and biometric data are special personal information under POPIA and special category data under GDPR. We process this data only for identity verification purposes. We do not use this data for any other purpose. Results are stored as a verification status (verified/not verified), not the raw biometric data.
You have the right to object to this processing, but we may be unable to admit you to the consultant catalog if verification cannot be completed.
We use the following trusted third parties to operate the platform. Each has contractual data protection obligations with us:
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) | GDPR-compliant; DPA in place |
| Vercel | Frontend hosting | Global CDN (EU nodes available) | GDPR-compliant; DPA in place |
| Railway | Backend server hosting | US (can be configured to EU) | SOC 2 Type II |
| Resend | Transactional email delivery | US | DPA in place |
| Didit | Identity verification | didit.me | Used only to complete an identity check |
| Sentry | Error monitoring | US | GDPR-compliant; DPA in place |
| PayFast | Payment processing | South Africa | PCI DSS compliant |
| Paddle | Payment processing & Merchant of Record (USD, EUR, and international cards) | UK / EU | GDPR-compliant; UK GDPR-compliant; PCI DSS; DPA in place |
| Anthropic | AI features (job spec generation, interview guides) | US | Data processing agreement |
We do not sell your personal information to any third party.
Our servers and some third-party providers are located outside South Africa. When we transfer personal information across borders, we ensure appropriate safeguards are in place:
If you are an EU/EEA data subject, your personal information may be transferred to South Africa, which does not currently have an EU adequacy decision. We rely on SCCs for these transfers.
| Data type | Retention period |
|---|---|
| Active consultant profiles | For the duration of your account + 3 years after last login |
| Active company accounts | For the duration of your account + 3 years after last activity |
| Job applications | 2 years from application date |
| Identity verification records | 5 years (legal/audit requirement) |
| Signed contracts | 7 years, for legal and tax record-keeping requirements |
| Payment records | 5 years, for legal and tax record-keeping requirements |
| Support chat logs | 2 years |
| Server logs and analytics | 90 days |
You may request deletion of your account and personal information at any time (see Section 9). We keep invoices, payment records, and signed contracts for the periods the law requires. Payment records are kept for 5 years. Signed contracts are kept for 7 years. These periods follow legal and tax record-keeping requirements. Bank details, phone numbers, CVs, and notes are removed from those records when an account is deleted.
We use cookies and similar technologies to operate the platform. These include:
| Type | Purpose | Examples |
|---|---|---|
| Essential | Session management, authentication | Hub_token, __session_ct |
| Functional | Preferences | Saved display preferences |
| Analytics | Platform usage analytics | Anonymous usage data |
You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in.
We do not use advertising or tracking cookies. We do not share cookie data with advertisers.
Depending on your location, you have the following rights regarding your personal information:
In addition to the POPIA rights above:
UK residents have equivalent rights to those under EU GDPR above, enforceable under the UK GDPR and Data Protection Act 2018:
If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act:
To submit a CCPA request, email talent@carbondatasolutions.com with subject "CCPA Privacy Request". We will respond within 45 days (extendable by a further 45 days with notice). You may designate an authorised agent to make requests on your behalf.
We do not sell personal information and have not done so in the preceding 12 months.
Canadian residents have rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, Law 25 (Bill 64):
We collect, use, and disclose personal information only for purposes a reasonable person would consider appropriate in the circumstances. We obtain meaningful consent before or at the time of collection.
Australian residents have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs):
We will respond to access and correction requests within 30 days. Where we are unable to provide access, we will provide written reasons.
To exercise any right: Email talent@carbondatasolutions.com with the subject line "Privacy Request, [your jurisdiction]". We will respond within the timeframe required by your applicable law. We may need to verify your identity before fulfilling the request.
We implement appropriate technical and organisational measures to protect your personal information:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. Under POPIA, we will notify the Information Regulator and affected data subjects as required.
carbon.talent is not directed at children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us immediately and we will delete it.
We may update this policy from time to time. Material changes will be notified to registered users by email at least 14 days before they take effect. The "Last updated" date at the top of this policy reflects the most recent revision.
A company user can connect an external assistant to carbon.talent. The user approves the connection in the portal and can revoke it at any time. The assistant can read that company's roles and applicants, search the talent catalog, save a role draft, post a role, and move an applicant between Applied, Screened, Interview, and Offer. Most roles go live right away. A role is held for a quick review only if something needs a check. It does not receive email addresses, phone numbers, CV files, profile links, rates, or scores. Hiring stays in the portal. We keep a connection log for 12 months.
For any privacy-related questions, access requests, or complaints:
Carbon Data Solutions (Pty) Ltd
Information Officer: Danie Zeeman
talent@carbondatasolutions.com
144 Fagan Street, Strand, Western Cape, South Africa
Information Regulator of South Africa (POPIA):
inforegulator.org.za | complaints.IR@justice.gov.za
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
EU residents, supervisory authority (GDPR):
Contact the data protection authority in your EU member state.
UK residents, Information Commissioner's Office (UK GDPR):
ico.org.uk | 0303 123 1113
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
California residents, California Privacy Protection Agency (CCPA/CPRA):
cppa.ca.gov
Canadian residents, Office of the Privacy Commissioner (PIPEDA):
priv.gc.ca | 1-800-282-1376
Quebec residents, Commission d'accès à l'information (Law 25):
cai.gouv.qc.ca
Australian residents, Office of the Australian Information Commissioner (Privacy Act 1988):
oaic.gov.au | 1300 363 992