Privacy Policy

Last updated: Feb 13th, 2025

This privacy notice for H2C.org, operated by First Carbon Investments Group Ltd, ('we', 'us', or 'our'), describes how and why we might collect, store, use, and/or share ('process') your information when you use our services ('Services'), such as when you:

  • Visit our website at https://h2c.org, or any website of ours that links to this privacy notice

  • Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at:

info@h2c.org

1. Introduction

At H2C.org, an initiative of First Carbon Investments Group Ltd, we are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you interact with our services, in compliance with the EU GDPR and UK GDPR.

2. Who We Are

Controller:
First Carbon Investments Group Ltd ("we", "us", or "our") is the controller of your personal data. We are a private limited company registered in Scotland.
Registered address: The Capital Building, 12-13 St Andrew Square, Edinburgh EH2 2AF, United Kingdom
Email: info@h2c.org
Website: www.h2c.org

Representative in the EU (where applicable):
To be appointed in compliance with Article 27 GDPR if required.

Data Protection Officer (DPO):
DPO: Data Protection Lead, First Carbon Investments Group Ltd
Email: dpo@h2c.org
Mail: The Capital Building, 12-13 St Andrew Square, Edinburgh EH2 2AF, United Kingdom

3. What Data We Collect

We may collect and process the following categories of personal data:

  • Identity data (e.g., name, title, organisation)

  • Contact data (e.g., email address, phone number, business address)

  • Technical data (e.g., IP address, browser type, device ID)

  • Usage data (e.g., website interactions, logs, analytics)

  • Marketing preferences and communication history

We may also collect your data:

  • When you correspond with us via email, web forms, or events

  • Through referrals or introductions via third parties

  • Via cookies and analytics tools when you browse our site

We do not knowingly collect data relating to children.

4. Legal Basis for Processing

We process personal data under the following lawful bases:

  • Consent – when you opt in to receive communications or register with us.

  • Contractual necessity – where data is needed to fulfil a contractual relationship.

  • Legitimate interest – to improve our services, protect against fraud, and manage our operations.

  • Legal obligation – where processing is required by applicable law.

Consequences of Not Providing Data:
Where data is necessary for legal or contractual reasons, failure to provide such data may prevent us from delivering our services or entering into a contract with you.

5. How We Use Your Data

We use your personal data to:

  • Provide access to our services and manage user accounts

  • Communicate with you regarding our initiatives and developments

  • Improve and secure our digital platforms

  • Comply with legal or regulatory obligations

  • Send marketing materials, where permitted

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying legal, regulatory, tax, or accounting requirements. Full details are set out in our Data Retention Policy.

7. Sharing Your Data

We do not sell or rent your data. We may share it with:

  • Our data processors (e.g., IT service providers, CRM systems)

  • Regulatory authorities where required

  • Legal advisers or auditors

  • Other H2C initiative partners under strict confidentiality agreements

Any data shared is subject to appropriate contractual safeguards.

8. International Data Transfers

If your data is transferred outside the UK or EEA, we ensure appropriate safeguards such as:

  • Adequacy decisions by the European Commission

  • Standard Contractual Clauses (SCCs)

  • Binding Corporate Rules (BCRs)

9. Your Rights

You have the following rights under the GDPR:

  • Right of access

  • Right to rectification

  • Right to erasure (‘right to be forgotten’)

  • Right to restriction of processing

  • Right to data portability

  • Right to object to processing

  • Right to withdraw consent at any time

  • Right to lodge a complaint with the Information Commissioner’s Office (ICO) (UK) or your local supervisory authority (EU)

To exercise your rights, contact: dpo@h2c.org

10. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance your browsing experience, analyze site usage, and assist with marketing efforts. Cookies are small text files placed on your device by websites that you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the site owners.

Types of Cookies We Use:

  • Strictly Necessary Cookies – required for the operation of our website.

  • Performance Cookies – collect anonymous information on how users interact with the website.

  • Functionality Cookies – remember user choices to improve experience.

  • Targeting/Advertising Cookies – record your visit and may share this information with third parties for advertising purposes.

Cookie Consent:
You will be presented with a cookie banner when visiting our website, allowing you to accept or reject non-essential cookies. You may also modify your preferences or withdraw consent at any time via our cookie settings interface.

Managing Cookies:
You can control and delete cookies through your browser settings. Please be aware that restricting cookies may impact website functionality.

11. Automated Decision-Making

We do not use personal data for automated decision-making or profiling that has legal or similarly significant effects.

12. How We Protect Your Data

We implement appropriate technical and organisational measures to protect personal data including encryption, access control, secure backups, and regular security testing.

13. Changes to This Policy

We may update this policy from time to time. The latest version will always be available at www.h2c.org/privacy-policy and significant changes will be communicated directly.

14. Contact Us

If you have any questions or requests concerning this Privacy Policy or your data, please contact:

Email: info@h2c.org
DPO: dpo@h2c.org
Mail: The Capital Building, 12-13 St Andrew Square, Edinburgh EH2 2AF, United Kingdom

Document Version: 2.1 | Effective Date: September 2025