Privacy Statement

Last updated: June 2026

As an Alternative Investment Fund Manager, Carbon Equity B.V. (“Carbon Equity”, “we”, “our”, “us”) processes large amounts of data from our customers. Our customers are invaluable to Carbon Equity. Therefore it is very important to ensure careful and secure processing of our customers’ data, in particular their personal data.

Through this Privacy Statement, we inform you about the way in which we process personal data of (potential) customers, business partners and website users. At Carbon Equity, we value your privacy. If you have any questions regarding our use of your personal data, you can reach out to us via the contact details provided at the bottom of this Privacy Statement.

Definitions

Account means a unique account created for you to access our service or parts of our service.
AIFM / AIFMD: Alternative Investment Fund Manager / Alternative Investment Fund Managers Directive (2011/61/EU).
Carbon Equity (the Company) (referred to as either “the Company”, “We”, “Us” or “Our” in this Agreement) refers to Carbon Equity B.V., Geldersekade 101-G, 1011 EM Amsterdam, North Holland. For the purpose of the GDPR (General Data Protection Regulation), the Company is the Data Controller.
Cookies: small files that are placed on your computer, mobile device or any other device by a website, containing the details of your browsing history on that website among its many uses.
Country refers to: the Netherlands
Data controller, for the purposes of the GDPR, refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
Data processor: any natural or legal person who processes personal data on behalf of Carbon Equity, in accordance with our instructions. See Section 9 for details on our processors.
Device means any device that can access the Service such as a computer, a cell phone or a digital tablet.
GDPR: the General Data Protection Regulation (EU) 2016/679.
Investor portal: the online platform operated by Carbon Equity through which investors can manage their account, view their investments, and complete onboarding.
Personal Data is any information that relates to an identified or identifiable individual. For the purposes of GDPR, Personal Data means any information relating to You such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity.
Service Provider means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used. For the purpose of the GDPR, Service Providers are considered Data Processors.
Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
Website refers to Carbon Equity, accessible from www.carbonequity.com, my.carbonequity.com and jobs.carbonequity.com
Wft: the Dutch Financial Supervision Act (Wet op het financieel toezicht).
Wwft: the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wet ter voorkoming van witwassen en financieren van terrorisme).

Carbon Equity

Carbon Equity acts as the Alternative Investment Fund Manager (AIFM) of its funds and it is fully licensed pursuant to article 2:65 of the Dutch Financial Supervision Act (Wet op het financieel toezicht). Carbon Equity and the funds it manages are subject to supervision by the Authority for the Financial Markets (Autoriteit Financiële Markten) in the Netherlands. Carbon Equity is registered with the Authority for the Financial Markets with registration number 15005329. The licence allows Carbon Equity to manage investment funds which invest in one or more funds. In 2025, Carbon Equity amended its licence to also allow it to manage funds that primarily make direct investments and launched Co-Invest Fund I upon approval of the amended licence. Carbon Equity also launched its first retail-focused fund with an ELTIF label. Neither Carbon Equity nor the funds it manages are subject to regulatory supervision by any other regulatory authority than the Dutch Authority for the Financial Markets. More information about Carbon Equity can be found on the About Us page.

Our responsibilities

For all activities and purposes mentioned in this Privacy Statement, Carbon Equity acts as the controller as referred to in the EU General Data Protection Regulation 2016/679 (GDPR). Carbon Equity acts in this position because as a licensed AIFM we:

Determine which personal data must be processed for the correct processing of an investment commitment or business transaction
Determine for which other purposes the personal data may be processed as long as these purposes are in accordance with the purpose for which the personal data were obtained
Have to comply with legal obligations and requirements, for example under financial legislation and Anti-Money Laundering frameworks, and;
Have our own general terms and conditions that are directly applicable to our customers

Personal data collection and use by Carbon Equity

Personal Data

While using our service and visiting our website, we may collect or ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Depending on your relationship with us, the categories of personal data we collect and use include:

Identity data – full name, date of birth, residence address, nationality, copy of ID document, and (if applicable) company details – to identify and verify you and to enter into an agreement;
Contact data – name, email address, phone number, postal address and country of residence – to contact you, manage your account and maintain client and prospect relationships;
KYC/AML screening data – PEP status, sanctions screening results, source of wealth and funds, and UBO information – to comply with anti-money laundering and customer due diligence obligations;
Biometric data – a facial image (selfie) used for identity verification during onboarding, processed by our identity verification provider – to verify your identity as part of legally required remote customer due diligence;
Financial and suitability data – income, net worth, investment knowledge and experience, risk appetite and objectives – to assess the suitability and appropriateness of investment products;
Investment data – commitment amounts, fund selections, portfolio holdings, distribution and redemption history – to administer your investments and provide investor reporting;
Tax reporting data – BSN/TIN, tax residency and FATCA/CRS classification – to comply with tax reporting obligations;
Bank account data – IBAN and account holder name – to process distributions and payments and for transaction monitoring;
Communication data – records of correspondence by email, phone (including recordings where applicable), video call and support channels – to provide support, maintain records of instructions and for internal training;
Usage data and cookies – IP address, browser and device information, pages visited and similar diagnostic data – to ensure website functionality and security and to analyse and improve our website;
Data received from third parties – such as data from business intelligence platforms and from intermediaries, financial advisors, trust offices or family offices acting on your behalf;
Employee and job applicant data – where you are an employee or applicant, the data necessary to manage the employment relationship or recruitment process.

Special categories of sensitive personal data

Special categories of personal data and citizen service numbers (BSNs) require additional protection. Special categories include, for example, data concerning your health, biometric data, or data concerning race or ethnic origin (Article 9 GDPR).

As part of our legally required remote customer due diligence, we process biometric data in the form of a facial image used for identity verification, through our third-party identity verification provider (Stripe Identity). We process this special category of personal data on the basis of our legal obligation under the Dutch Anti-Money Laundering and Anti-Terrorist Financing Act (Wwft). Biometric identifiers are retained for one year after verification; other verification data is retained for three years, or longer where required under the Wwft.

We do not process other special categories of personal data (such as health, ethnic or racial data) unless you have made such information public yourself or where strictly necessary and permitted by law. You can withdraw any consent for such recording at any time by contacting support@carbonequity.com.

Phone call recordings. We may record telephone calls for internal training and quality assurance purposes. Where calls are recorded, participants will be informed at the start of the call, and access to recordings is limited to authorised personnel.

Personal data received from third parties. In some cases we receive personal data about clients and prospects from third parties. This may include data obtained from business intelligence platforms (such as Palturai) based on publicly available sources, as well as data received from intermediaries, financial advisors, trust offices or family offices acting on your behalf.

We only process data from minors under the age of 16 if they purchase a product from us or if the data is provided to us in the context of a product. We will seek the legal representative’s permission to further process children’s data. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from anyone under the age of 16 without verification of parental consent, we take steps to remove that information from our servers.

We will only use your BSN if this is permitted by law, for example, in order to pass on information to the Dutch tax authority as part of FATCA/CRS reporting.

Usage Data

Usage data is collected automatically when visiting our website. Usage data may include information such as your Internet Protocol address (IP address), browser type, browser version, the pages of our service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When you visit our website by or through a mobile device, we may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile internet browser, unique device identifiers and other diagnostic data. Carbon Equity may use personal data for the purposes of providing and maintaining our website, managing your account, performing our contract with you, contacting you, providing news and information, handling your requests, business transfers, and other purposes such as analytics and service improvement.

Tracking Technologies and Cookies

Carbon Equity uses cookies and similar tracking technologies to track the activity on and improve your experience of our service and store certain information. For more information about the cookies we use and your choices regarding cookies, please visit our Cookie Statement.

Subscription types

Carbon Equity will use your personal data (preferences) to track how they can communicate with you. Here are the different subscription types you can sign up for:

Impact in your Inbox: our monthly newsletter on everything climate tech investing, including one-to-one updates by email or phone. This subscription is optional.

Investment opportunities: new investment opportunities and other company updates, including one-to-one updates by email or phone. You are automatically enrolled after creating an account with us.

Investor updates: updates on your investment(s) and upcoming events hosted by Carbon Equity. You are automatically enrolled after confirming your investment for any product.

Events updates: we send upcoming event details to contacts who have signed up for events in the past but do not receive investment opportunity communications.

Personal data processing by Carbon Equity

Carbon Equity processes personal data for the purposes listed above based on your consent, for the performance of a contract, based on legal obligations, performance of tasks in the public interest and to pursue legitimate business interests. You can withdraw your consent at any time without giving reasons, or object to the processing of your personal data when we do so based on legitimate interest. You can withdraw your consent via the unsubscribe link in our e-mails, if applicable, or by sending your request to support@carbonequity.com. If, as our customer, you withdraw your consent for marketing related purposes, we may still contact you regarding product functionality or updates, security updates, responses to customer support requests or other transactional, non-marketing/administrative related purposes.

Legal Basis for Processing Personal Data under GDPR

We may process your personal data under the following conditions:

Consent: you have given consent for processing personal data for one or more specific purposes.
Performance of a contract: provision of personal data is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof.
Legal obligations: processing personal data is necessary for compliance with a legal obligation to which Carbon Equity is subject.
Vital interests: processing personal data is necessary in order to protect the vital interests of you or of another natural person.
Public interests: processing personal data is related to a task carried out in the public interest or in the exercise of official authority vested in Carbon Equity.
Legitimate interests: processing personal data is necessary for the purposes of the legitimate interests pursued by us.

We rely on the following legal bases for our main processing purposes:

Onboarding, identity verification, KYC/AML screening, and tax reporting (including biometric verification and BSN/tax data): compliance with a legal obligation (Wwft, Wft, Dutch tax law and FATCA/CRS);
Entering into and performing your investment agreement, processing commitments and distributions, and providing investor reporting: performance of a contract;
Assessing the suitability and appropriateness of investment products: legal obligation (Wft) and performance of a contract;
Marketing communications and newsletters: your consent;
Relationship management, service improvement, dispute resolution, IT and physical security, internal training, and recruitment: our legitimate interests (and your consent for non-essential cookies).

Providing certain personal data is a statutory or contractual requirement. Where we are required by law (Wwft, Wft, Dutch tax law, FATCA/CRS) to collect identity, KYC/AML or tax data, or where data is necessary to enter into and perform our agreement with you, we cannot onboard you as a client, maintain the investment relationship, or process distributions if you do not provide it. Providing data for marketing purposes is voluntary and has no consequences for your investment relationship with us. We may share personal data in the following situations:

With Service Providers: we may share personal data with Service Providers to monitor and analyse the use of its website and to contact data subjects.
For business transfers: We may share or transfer personal data in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of its business to another company.
With Affiliates: We may share personal data with its affiliates, in which case those affiliates will be required to honour this Privacy Policy. Affiliates include Carbon Equity's parent company and any other subsidiaries, joint venture partners, or other companies that Carbon Equity controls or that are under common control with us.
With business partners: we may share personal data with its business partners to offer certain products, services, or promotions.
With your consent: We may disclose personal data for any other purpose with the data subject's consent.

Automated decision-making

We do not take decisions that produce legal effects concerning you, or that similarly significantly affect you, based solely on automated processing. Although we use automated tools to support our services, the outcomes of these tools are always subject to human review before any decision is taken.

We may share your personal information with Service Providers, in the context of business transfers, with affiliates, with business partners, and with your consent, as further described below.

Detailed Information on the processing of your personal data

The Service Providers Carbon Equity uses may have access to your Personal Data. These third-party vendors collect, store, use, process and transfer information in accordance with their Privacy Policies. We engage the following categories of processors. Where a processor is located outside the European Economic Area (EEA), we rely on appropriate safeguards as described under “Transfer of your personal data” below.

Processors we engage

Onboarding, identity verification and AML screening

Stripe Identity (identity verification – facial image, ID document, name and date of birth). Based in the USA.
ComplyAdvantage (ongoing sanctions, PEP and adverse media screening – name, date of birth, country of residence). Based in the UK, which benefits from an EU adequacy decision.

Payments and fund administration

Stripe Payments (processing of distributions and payments – IBAN, account holder name, transaction amounts). Based in the USA.
Assetcare Fund Services B.V. (fund accounting and administration – IBAN and a pseudonymised investor identifier only). Based in the Netherlands (EEA).

Cloud hosting

Google Cloud Platform (cloud hosting, data storage and data warehousing). Data is hosted in Ireland (EU).

CRM, marketing, website analytics and performance

HubSpot (CRM and marketing communications – name, email, phone, communication history and subscription preferences).
Amplitude (product and website analytics – browsing behaviour, page views, device and event data). Data is hosted in the EU.
Microsoft Clarity (behavioural analytics, heatmaps and session replay to improve our website).
Sentry (error tracking and application performance monitoring – technical diagnostic data, IP address, browser/device information). Based in the USA.

HR, payroll, recruitment and internal communications

Recruitee (recruitment). Data is hosted in the EU.
Slack / Salesforce (internal team communications). Based in the USA.

AI-assisted data processing

Anthropic (Claude). We use Claude, an AI assistant developed by Anthropic, via API integrations with other tools we use (including Google, HubSpot and Slack). Through these integrations, Anthropic may process personal data present in those connected systems. Anthropic acts as a processor and is based in the USA.

We ensure that all data sharing with processors is governed by data processing agreements in accordance with Article 28 GDPR. We may also share personal data with regulatory authorities and other recipients where required by law.

Links to Other Websites

Our website may contain links to other websites that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Data retention

Carbon Equity will retain personal data only for as long as is necessary for the purposes set out in this Policy and the Privacy Statement. We will retain and use personal data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies. Carbon Equity will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our website, or we are legally obligated to retain this data for longer time periods. Carbon Equity retains personal data only as long as necessary for the purposes outlined in this policy or to comply with legal obligations. Examples:

Customer data is held during the investment period and the applicable retention period thereafter.
Usage data may be stored temporarily unless used for legal or security reasons.

Retention timelines are defined in our internal processing register and procedures.

Transfer of your personal data

Your information, including personal data, is processed at our operating office(s) and in any other places where the parties involved in the processing are located. This means that this information may be transferred to, and maintained on, computers located outside your state, province, country, or other governmental jurisdiction, where the data protection laws may differ from those in your jurisdiction. We share your personal data with third parties where this is necessary to provide products and services or where required by law. When third parties process personal data on our behalf and under its strict instructions, those third parties act as processors.

We transfer personal data to third parties where required to do so. Examples of such third parties include national and European supervisory authorities, such as the Dutch Authority for the Financial Markets (AFM), the Dutch Data Protection Authority, the Dutch Authority for Consumers and Markets (ACM), or the Dutch tax authority. We sometimes engage other business partners, identified in this policy, as processors. As a result, they process personal data on our instructions. We will only do so if it considers these parties to be sufficiently reliable. We may only engage other parties if this is in keeping with the purpose for which the personal data was processed. Moreover, these other parties can only be engaged by us if they make specific agreements with us, have implemented demonstrably appropriate security measures, and guarantee that the personal data will remain confidential.

Some of our processors are located outside the European Economic Area (EEA), including in the United States. Where a recipient is certified under the EU-U.S. Data Privacy Framework (DPF) — for example Stripe, Slack (Salesforce) and Sentry — we transfer personal data on the basis of the European Commission’s adequacy decision for the DPF. For recipients that are not DPF-certified, such as Anthropic, we rely on the European Commission’s Standard Contractual Clauses, supplemented by additional measures where necessary. Transfers to the United Kingdom rely on the EU adequacy decision for the UK. Where possible, personal data is hosted within the EU/EEA (for example our cloud hosting in Ireland).

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Statement, and no transfer of your personal data will take place to an organisation or a country unless there are adequate controls in place including the security of your data and other personal information.

Security of your personal data

The security of your personal data is important to us. We have taken various technical and organisational security measures to protect personal data and to comply with laws and regulations. We have implemented appropriate technical and organisational measures to secure the processing of personal data. These safeguards will vary depending on the sensitivity, format, location, amount, distribution and storage of the personal data, and include measures designed to keep personal data protected from unauthorised access. If appropriate, these safeguards include the encryption of communications via SSL, encryption of information during storage, firewalls, access controls, separation of duties, and similar security protocols. We restrict access to personal data to personnel and third parties that require access to such information for legitimate, relevant business purposes. Our employees, contractors and third parties who have access to personal data are bound to confidentiality. We use control mechanisms to limit access to individuals that require such data for the performance of their responsibilities and tasks. We have an Information Security Policy in place.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect personal data, it cannot guarantee its absolute security.

Your rights under the GDPR

Carbon Equity undertakes to respect the confidentiality of your personal data and to guarantee you can exercise your rights. You have the right under this Privacy Statement, and by law if you are within the EU, to:

Request access to your personal data. The right to access, update or delete (if not required while having an active product with us) the information we have on you. Whenever made possible, you can access, update or request deletion of your personal data directly within your account settings section. If you are unable to perform these actions yourself, please contact us. This also enables you to receive a copy of the personal data we hold about you.
Request correction of the personal data that we hold about you. You have the right to have any incomplete or inaccurate information we hold about you corrected.
Object to processing of your personal data. This right exists where we are relying on a legitimate interest as the legal basis for our processing and there is something about your particular situation, which makes you want to object to our processing of your personal data on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
Request erasure of your personal data. You have the right to ask ss to delete or remove Personal Data when there is no good reason for Us to continue processing it.
Request the transfer of your personal data. We will provide to you, or to a third-party you have chosen, your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which You initially provided consent for us to use or where we used the information to perform a contract with you.
Withdraw your consent. You have the right to withdraw your consent on using your personal data. If you withdraw your consent, we may not be able to provide you with access to certain specific functionalities of our website. We are required to hold personal data elements as long as there is a customer relationship (and during the retention period).

Exercising of your GDPR data protection rights

You may exercise your rights by contacting us at support@carbonequity.com. Please note that we may ask you to verify your identity before responding to such requests. You also have the right to complain to a Data Protection Authority about our collection and use of your personal data.

Changes to this Privacy Statement

We may update our Privacy Policy and Statement from time to time. Any changes are updated by posting the new or updated Privacy Statement on this page. The “Last updated” date on top of this page indicates the latest date of change. Changes to this Privacy Statement are effective when they are posted on this page.

Contact Us

The controller of your personal data is Carbon Equity B.V., Geldersekade 101-F, 1011 EM Amsterdam, the Netherlands.

Our Chief Legal and Risk Officer is responsible for monitoring the implementation of and compliance with the General Data Protection Regulation (GDPR). If you have any questions regarding our use of your personal data or about this Privacy Statement, you can contact us via support@carbonequity.com. If you believe that Carbon Equity has used your personal data unlawfully or if you are not satisfied with our response, you have the right to file a complaint with the relevant Data Protection Authority (in the Netherlands, this is the Autoriteit Persoonsgegevens). More information about your complaint possibilities can be found here. For contact details of all EU Data Protection Authorities, click here.