Privacy notice: Carbon Plan Desk

Version 1.0 · 6 October 2026

Who we are

The data controller is Oz Kilbride, sole trader, trading as Carbon Plan Desk, Northleigh Manor, Morchard Bishop, Crediton, Devon, EX17 6RH. Contact: hello@carbonplandesk.co.uk.

Whose data we handle, and why

Who	What data	Where it comes from	Why we use it	Lawful basis (UK GDPR Art. 6)
Businesses we may contact	Company name, company number and status, the generic role email address published on the company's website (for example info@ or enquiries@), details of the company's published Carbon Reduction Plan, and public contract award notices	The company's own website, Companies House, Contracts Finder and Find a Tender	To send a small number of relevant business-to-business emails about the company's Carbon Reduction Plan	Legitimate interests (offering a relevant service to organisations; see our legitimate interests assessment). We email only company and LLP addresses, never personal or named-individual addresses or sole traders, and every email has an opt-out.
Customers	Contact name, role, work email and phone, the signatory's name and title, and business activity data (energy, travel, waste, staff numbers)	You	To prepare and deliver your plan, and to invoice	Contract (Art. 6(1)(b))
Customers (records)	Invoices and order records	Us	Tax and accounting records	Legal obligation (Art. 6(1)(c))
People who opt out	Email address, domain and date of opt-out	You	To make sure we never contact you again (suppression list)	Legitimate interests / legal obligation (honouring objections under PECR and UK GDPR Art. 21)
Website visitors	Information you type into our forms. Our web host keeps basic server logs (IP address, time, page) for security	You / our host	To respond, and to keep the site secure	Legitimate interests

We do not use advertising or tracking cookies. We do not buy or sell personal data. We do not make automated decisions with legal or similarly significant effects.

Who we share data with

We share personal data only with service providers acting for us:

Cloudflare: website hosting, and storage of order-form entries for up to 90 days until we import them.
Zoho Corporation, through the Zoho Mail EU data centre: email.
Stripe Payments UK / Stripe, Inc.: payments, once used.
An AI service provider used to assist drafting, under its business terms.

Some providers may process data outside the UK under appropriate safeguards, such as a UK adequacy regulation or the UK International Data Transfer Addendum. We share data with authorities only if the law requires it.

How long we keep it

Prospect data: deleted 12 months after our last email if you have not become a customer. It is deleted immediately if you object, apart from the suppression entry.
Suppression list: kept for as long as we send business emails, so that we can honour your opt-out. It holds only the email address, domain and date.
Customer orders, invoices and plans: 6 years after the end of the tax year (HMRC record-keeping).

Your rights

You can ask to access, correct or erase your data, restrict or object to its use, or have it transferred (portability). You can object to direct marketing at any time, and we will stop. Reply "unsubscribe" to any email or write to hello@carbonplandesk.co.uk. We respond within one month.

If you are unhappy, you can complain to the Information Commissioner's Office: https://ico.org.uk/make-a-complaint/ (0303 123 1113).

Changes

We will post any changes here with a new version date.