1. Introduction
CarbonEx ("we", "our", or "us") is operated by WhereteamCo., Ltd. and is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our carbon credit trading platform at carboncreditthailand.com.
By using CarbonEx, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of our services.
2. Information We Collect
We collect the following categories of personal data:
- Identity Data: Full name, date of birth, national ID or passport number (for KYC verification)
- Contact Data: Email address, phone number, billing address
- Financial Data: Bank account details, payment card information (processed via Omise / 2C2P), wallet balance and transaction history
- Usage Data: IP address, browser type, pages visited, time spent, trading activity
- Organization Data: Company name, registration number, carbon quota information
- Communications: Records of messages, support requests, and notifications
3. How We Use Your Information
- To create and manage your account and process transactions
- To verify your identity (KYC) as required by applicable regulations
- To execute and record carbon credit trades, retirements, and certifications
- To send transactional emails such as order confirmations, price alerts, and project status updates
- To detect and prevent fraud, money laundering, and unauthorized access
- To comply with legal obligations under Thai law, including the PDPA (Personal Data Protection Act B.E. 2562)
- To improve our platform through analytics and user feedback
4. Legal Basis for Processing
We process your personal data under the following legal bases as defined by the PDPA:
- Contract Performance: Processing necessary to execute trades and provide platform services
- Legal Obligation: KYC/AML compliance, tax reporting, regulatory requirements
- Legitimate Interests: Fraud prevention, platform security, analytics
- Consent: Marketing communications (withdrawable at any time)
5. Data Sharing and Disclosure
We do not sell your personal data. We may share data with:
- Payment processors: Omise and 2C2P for payment handling
- Verification bodies: Third-party verifiers reviewing project submissions
- Regulatory authorities: Thailand SEC, TGO (Thailand Greenhouse Gas Management Organization), and other competent authorities upon lawful request
- Service providers: Cloud hosting (Vercel, AWS), email delivery (Resend), analytics — under strict data processing agreements
6. Data Retention
We retain personal data for as long as necessary to provide our services and comply with legal obligations. KYC documents are retained for a minimum of 5 years after account closure per AML regulations. Transaction records are retained for 7 years per Thai accounting law. You may request deletion of non-mandatory data at any time.
7. Your Rights Under the PDPA
As a data subject under the Personal Data Protection Act B.E. 2562, you have the right to:
- Access a copy of your personal data
- Correct inaccurate data
- Request deletion of your data (where legally permissible)
- Withdraw consent for marketing communications
- Object to or restrict certain processing activities
- Request data portability
- Lodge a complaint with the Personal Data Protection Committee
To exercise these rights, contact us at privacy@carboncreditthailand.com.
8. Security
We implement industry-standard security measures including TLS encryption in transit, bcrypt password hashing, SHA-256 API key hashing, and regular security audits. However, no system is 100% secure. In the event of a data breach affecting your rights, we will notify you within 72 hours as required by the PDPA.
9. Cookies
We use session cookies for authentication (via NextAuth.js) and analytics cookies to understand platform usage. You may disable non-essential cookies in your browser settings, but this may affect platform functionality.
10. Contact Us
For privacy-related inquiries:
Data Controller: Whereteam Co., Ltd.
Email: privacy@carboncreditthailand.com
Website: whereteam.com