Privacy Policy

Last updated: 2026.07.22

CarbonPool Holding AG ("CarbonPool," "we," "us," or "our") respects your privacy and is committed to protecting the personal data of visitors to our website and users of our services. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have in relation to it.

This Privacy Policy is issued in accordance with the Swiss Federal Act on Data Protection (revFADP/nDSG). Where the General Data Protection Regulation (GDPR) applies to you — for example, if you are located in the European Union or European Economic Area — the additional provisions in this policy apply to you as well.

1. Who we are

CarbonPool Holding AG is a Swiss stock corporation (Aktiengesellschaft), registered under company number CHE-306.304.693.

Registered address: Dufourstrasse 185a, 8008 Zürich, Switzerland

Contact: info@carbonpool.earth | +41 44 383 03 03

For data protection matters relating to this website, please contact us at info@carbonpool.earth.

2. What data we collect

We collect personal data in the following ways:

Data you provide to us directly. When you fill out a contact or quote request form (e.g. via "Start now" / "Start today"), sign up for updates, or otherwise contact us, we may collect: your name, email address, phone number, company/organization name, job title, and details about your project or inquiry (for example, information relevant to assessing carbon project risk for insurance purposes).

Data collected automatically. Like most websites, ours uses cookies and similar technologies, including Google Analytics, to understand how visitors use the site. We do not use this data to identify you personally. See Section 8 below for details on the cookies we use.

Data related to job applications. Our Careers page directs applicants to apply via email rather than through a website form. Any personal data you send us this way (e.g. CV, cover letter) is handled under this policy but is not collected through the website itself.

We do not knowingly collect personal data from minors, and our services are directed at businesses and professionals, not consumers.

3. Why we use your data

We use personal data for the following purposes:

To respond to inquiries and provide quotes or information about our insurance products (Reversal Insurance, Shortfall Insurance, Planting Insurance)
To assess and process potential insurance arrangements, including passing relevant information to the insurance carrier(s) who underwrite our products, since CarbonPool operates as an intermediary/MGA-style arrangement: we typically collect prospect and project information first, then share it with the underwriting carrier
To manage our relationship with clients, partners, and prospects via our CRM (Attio)
Business development and outreach. We may contact prospects, project developers, VVBs, and industry counterparties using contact information compiled from publicly available sources such as registry listings (e.g. Verra) and industry websites, in order to introduce our services relevant to their professional role. The legal basis for this is our legitimate interest in developing our business (Art. 6(1)(f)). You can object to this processing, or ask us to stop contacting you, at any time by emailing info@carbonpool.earth - we will action this without delay.
To improve our website and understand visitor behavior (via Google Analytics)
To comply with legal, regulatory, and contractual obligations

Where GDPR applies, our legal bases for these purposes are: performance of a contract or steps taken at your request prior to entering into one (Art. 6(1)(b)); our legitimate interests in operating and improving our business and website (Art. 6(1)(f)); compliance with legal obligations (Art. 6(1)(c)); and, where applicable, your consent (Art. 6(1)(a)), which you may withdraw at any time.

4. Who we share data with

We share personal data with:

Our service providers, including insurers. We share relevant data with the service providers who help us operate our business, including the insurance carrier(s) that underwrite our insurance products.
Attio (our CRM provider), which processes contact and prospect data on our behalf.
Wix.com, our website hosting and forms provider.
Google Analytics, for website analytics.

We do not sell personal data to third parties.

5. International data transfers

Some of the third parties we use process personal data outside Switzerland:

Attio is a UK company. Its primary hosting infrastructure runs on Google Cloud (Ireland/EEA), alongside a number of sub-processors based in the UK and US used for functions such as security, email delivery, and data enrichment. Transfers to these sub-processors are governed by the EU Standard Contractual Clauses and the UK Addendum.
Wix initially processes data through Wix.com Ltd. in Israel — a country the European Commission has recognized as providing an adequate level of data protection — and may transfer data to other Wix group entities under Wix's intra-company data processing agreement and the EU Standard Contractual Clauses.
Google Analytics may process data in the United States and elsewhere, subject to Google's standard contractual safeguards.

Where personal data is transferred outside Switzerland or the EEA, we rely on these providers' contractual safeguards (Standard Contractual Clauses, the UK Addendum, or recognized adequacy decisions) to ensure an equivalent level of protection.

6. Data retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, including to satisfy any legal, accounting, or reporting requirements. Contact and prospect data is generally retained for the duration of our relationship plus a reasonable period afterward, unless a longer retention period is required by law.

7. Your rights

Subject to applicable law, you have the right to:

Request access to the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Object to or request restriction of certain processing
Request a copy of your data in a portable format (where applicable under GDPR)
Withdraw consent at any time, where processing is based on consent

To exercise these rights, contact us at info@carbonpool.earth. If applicable data protection law gives you the right to lodge a complaint with a supervisory authority, you may do so with the authority in your country of residence. In Switzerland, the supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).

8. Cookies

Cookies are small text files placed on your device when you visit our website. We use them, and similar technologies, for the purposes described below.

Necessary cookies. These are essential for the website to function properly (e.g. remembering your cookie consent choices) and cannot be switched off. They do not require your consent.

Storing your cookie consent preferences — provided by CarbonPool (via our cookie consent tool) — typical duration: up to 12 months

Analytics cookies. With your consent, we use Google Analytics to understand how visitors use our site (e.g. pages visited, time on site, general location), so we can improve it. This data is processed in aggregate and is not used to identify you personally.

Distinguishing users for aggregate traffic analysis — provided by Google Analytics — typical duration: up to 24 months
Throttling request rate / session tracking — provided by Google Analytics — typical duration: 24 hours to 12 months

Your choices. When you first visit our site, a cookie banner lets you accept or reject non-essential cookies, and choose between categories. You can change your preference at any time by reopening the cookie settings (found in the fingerprint icon on the bottom left of the page) or by adjusting your browser settings to block or delete cookies. Note that blocking necessary cookies may affect how the site functions.

We do not currently use advertising or cross-site tracking cookies. If this changes, we will update this section and our cookie banner accordingly.

9. Security

We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or misuse.

10. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision.

11. Contact us

If you have questions about this Privacy Policy or how we handle your personal data, contact us at:

CarbonPool Holding AG Dufourstrasse 185a, 8008 Zürich, Switzerland info@carbonpool.earth