Privacy Policy

Captive Carbon Proprietary Limited is a private company registered in South Africa under company number 2024/381956/07. Our registered address is:

Suite 802, Illovo Central, 70 Melville Road, Sandhurst, Gauteng, 2196, South Africa

We are South Africa’s first Verra-registered platform for commercial solar carbon credits, operating VCS Project 3659.

Our directors are Justin Pengilly and Percy Ying.

For privacy-related enquiries, contact us at info@captivecarbon.co.za.

We collect personal information in three main categories.

Information you provide directly to us.

When you submit a quote request, contact form, purchase enquiry, partner application, or create a client portal account, we collect:

• Identifying information (your name, your role)
• Business information (company name, company role)
• Contact information (email address, telephone number)
• Project information you provide about your solar installation, intended carbon credit purchase, or business circumstances
• Any additional information you choose to share in free-text fields

Information we collect automatically when you visit our website.

This includes standard web technical information:

• IP address and approximate geographic location
• Browser type, operating system, and device characteristics
• Pages visited, links clicked, time spent on pages
• Referring website (the page you came from)

This information is collected through standard web infrastructure (server logs and our hosting provider) for the purpose of operating and securing the website. We do not currently operate any third-party analytics, advertising trackers, or behavioural tracking tools on the public website.

Information we collect from third parties.

For registered clients, we receive technical data about their solar installation from third parties they have authorised, including:

• Engineering, procurement, and construction (EPC) partners
• Solar monitoring platform providers
• Independent technical consultants
• Validation and verification bodies (VVBs) accredited by Verra

This information is provided under contractual arrangements with the relevant third party and is used solely for the purpose of registering and verifying the client’s solar project under Verra’s VCS standard.

We process personal information for the following purposes:

• To respond to enquiries you submit through our website
• To prepare and deliver revenue projections, proposals, and quotations
• To register and manage carbon credit projects with Verra
• To communicate with clients and partners about projects, contracts, and payouts
• To comply with our obligations under Verra’s VCS standard and Verra’s approved methodology for grid-connected solar projects
• To meet our legal, regulatory, tax, accounting, and audit obligations
• To detect, prevent, and respond to fraud, security incidents, or misuse of our website
• To improve our website and services based on aggregated usage patterns

We will not use your personal information for purposes other than those described in this policy without your consent, except where the law requires or permits us to do so.

Under POPIA, we process personal information on the following lawful bases:

• Consent. Where you have given us your explicit consent (for example, by submitting a contact form or signing up for an account).
• Contractual necessity. Where processing is necessary to perform a contract you have entered into with us, or to take steps at your request before entering into a contract.
• Legitimate interest. Where processing is necessary for our legitimate business interests (for example, securing the website, preventing fraud, or analysing aggregated usage patterns) and where those interests are not overridden by your rights.
• Legal obligation. Where processing is required by South African law, regulatory requirements, or international standards we operate under.

We share personal information only as necessary for the purposes described in Section 3. Specifically, we may share your information with:

Verra and accredited Validation and Verification Bodies.

Project documentation and generation data are submitted to Verra and the relevant VVB (such as TÜV NORD CERT GmbH or SustainCert) as part of the VCS registration and verification process.

Methodology consultants.

We work with carbon-methodology specialists who may access project-level data while supporting our submissions.

Service providers and subprocessors.

We use a small set of third-party service providers to operate our website and platform. As of the date of this policy, these include:

• Supabase Inc., database, authentication, and storage services
• Resend, transactional email delivery (for example, sending you confirmation of your enquiry submission)

Our subprocessor list may change over time as the platform evolves. Each subprocessor is bound by contractual obligations to protect personal information to standards equivalent to those required by POPIA.

Authorities and regulators.

Where we are required by law, court order, regulatory request, or to protect our legal rights, we may share personal information with relevant South African authorities.

We do not sell your personal information to any third party.

We do not share your personal information with marketing networks or for cross-context behavioural advertising.

Some of our subprocessors (notably Resend) are located outside South Africa, primarily in the United States and the European Union. When personal information is transferred to a country outside South Africa, we ensure that:

• The recipient is bound by contractual safeguards requiring data protection standards equivalent to POPIA, or
• The recipient is in a jurisdiction recognised as providing adequate data protection, or
• The transfer is necessary for the performance of a contract with you, or
• You have consented to the transfer.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. Specifically:

• Active client information, retained for the duration of the Client Agreement, plus a further period required by Verra registry compliance and audit trails (typically 10 years from contract end).
• Lead and enquiry information, retained for up to 24 months from your last interaction with us, unless you have actively engaged with our services in that period.
• Financial transaction records, retained for at least 5 years from the date of the transaction, in accordance with South African tax and accounting law.
• Website server logs, retained for up to 90 days for security and operational purposes.

After these periods, personal information is deleted or anonymised in accordance with our data retention practices.

Under POPIA, you have the following rights in relation to your personal information:

• The right to be notified that we are collecting your information
• The right to access the personal information we hold about you
• The right to request correction of inaccurate or incomplete information
• The right to request deletion of personal information (subject to legal retention requirements)
• The right to object to processing in certain circumstances
• The right to object to direct marketing
• The right to lodge a complaint with the Information Regulator (South Africa)

To exercise any of these rights, contact us at info@captivecarbon.co.za. We will respond within the timeframes required by POPIA, typically within 30 days.

We may send you communications related to services you have requested or transactions you have entered into. We will not send you unsolicited marketing communications without your prior consent (or in compliance with the limited circumstances permitted under POPIA Section 69).

You can opt out of any direct marketing communication at any time by emailing info@captivecarbon.co.za or using the unsubscribe link in any marketing email we send.

Our website uses minimal cookies and similar technologies to ensure the website functions correctly, to remember your preferences, and to maintain your session if you log into the client portal. We do not currently operate third-party advertising trackers, behavioural advertising tools, or social media tracking pixels on our website.

If we introduce additional analytics or tracking technologies in the future, we will update this policy and (where required) request your consent.

We implement appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, alteration, disclosure, or destruction. These include:

• Encrypted data transmission (HTTPS/TLS)
• Encrypted data storage at our database provider
• Strict access controls limiting personal information to authorised personnel
• Regular security reviews and software updates
• Authentication and password protection on the client portal

No system can be guaranteed to be entirely secure. If you become aware of any incident affecting your personal information, please contact us immediately at info@captivecarbon.co.za.

Our services are intended for commercial and industrial businesses. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected personal information from a person under 18, please contact us so that we can delete it.

We may update this Privacy Policy from time to time. Material changes will be communicated to registered clients by email and through a notice on this page. The “Last updated” date at the top of this policy reflects the most recent revision. Continued use of our website or services after changes are published constitutes your acceptance of the updated policy.

For any privacy-related question, request, or complaint, please contact us:

• Email: info@captivecarbon.co.za
• Postal address: Captive Carbon Proprietary Limited, Suite 802, Illovo Central, 70 Melville Road, Sandhurst, Gauteng, 2196, South Africa

Information Officers (POPIA): Captive Carbon’s Joint Information Officers are Justin Pengilly and Percy Ying. Both can be reached via the email address above.

You may also lodge a complaint with the Information Regulator of South Africa:

• Website: https://inforegulator.org.za
• Email: complaints.IR@justice.gov.za
• Postal address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001