The Carbon Literacy Trust Privacy Notice

This Privacy Notice sets out how your personal data is collected, what it is used for and why. Please read this Privacy Notice so you are aware of how we are using your data. We will notify you if this Privacy Notice changes in respect of your data.

The Carbon Literacy Trust is the ‘Data Controller’ and is responsible for your personal data.

The Carbon Literacy Trust is a charitable incorporated organisation, registered charity number 1156722. We aim to provide the public with an awareness of the carbon costs and impacts of everyday activities and the ability and motivation to reduce emissions on an individual, community and organisational basis.

If you have any questions about this Privacy Notice or our data protection practices, please email [email protected] or write to us at The Carbon Literacy Trust, Sustainable Ventures Workspace, Renold Building, 32a Altrincham Street, Manchester, M1 7JR.

We collect information from the following people for the following purposes:

• People applying to be certified as Carbon Literate: To administer your certification, conduct research into the impact of the project, and communicate with you about Carbon Literacy.
• People and organisations applying for Carbon Literacy accreditations: To administer your accreditation, invoice you, and communicate with you about Carbon Literacy.
• Email subscribers and event attendees: To send you email updates with information or events relating to The Carbon Literacy Project.
• Customers and suppliers: To manage our relationship with you and record invoices and
  payments.
• Prospects: To develop our relationship with you and advise on how you can get on board.
• Donors: To develop our relationship with you and keep you updated about The Carbon Literacy Project.
• Trustees: To comply with the legal requirement to maintain a register of members and trustees.
• Volunteers: To manage our relationship with you, support your volunteering and pay expenses and other any amounts due.
• Freelance contractors: To manage our relationship with you, support your work, and pay you for work undertaken and expenses.
• Employees: To manage our relationship with you, support your work, and pay you for work undertaken and expenses.
• Job applicants: To engage with you regarding your application and interview, and to notify
  you of other job opportunities.

We may collect, use, store and transfer different kinds of personal data about you as follows:

• Identity Data includes first name, last name, job title, gender, age and work status.
• Special Category Data includes ethnicity and disability status for learners (which we use to monitor equality of opportunity), and ethnicity, sexual orientation and medical information for volunteers, freelance contractors and employees.
• Contact Data includes home address and postcode, billing address and postcode, email
  address and phone numbers.
• Financial Data includes details about payments to and from you (including bank details)
  and other details of products and services you have purchased from us.
• Marketing and Communications Data includes your preferences in receiving marketing from
  us and our third parties and your communication preferences.
• Certification Evidence Data includes any personal data you include in the actions on your Evidence Form.
• Work-Related Data includes CVs, references and right to work data for job applicants, and salary history, performance records, leave records, disciplinary records and training records for project team members.

The lawful basis we use for processing your data is as follows:

• People applying to be certified as Carbon Literate: Legitimate interest, as you’ve asked us
  to process your application.
• People certified as Carbon Literate: Legitimate interest, to evidence your Carbon Literacy accreditation, conduct research into the impact of the project, and offer you further opportunities in relation to your Carbon Literacy.
• Trainers and organisations applying for Carbon Literacy accreditations: Legitimate interest, as you’ve asked us to process your application.
• Trainers and organisations certified with Carbon Literacy accreditations: Legitimate interest, to evidence your Carbon Literacy accreditation, conduct research into the impact of the project, and offer you further opportunities in relation to your Carbon Literacy.
• Email subscribers: Legitimate interest, as you’ve asked us to keep you updated.
• Event attendees: Legitimate interest, as you’ve registered for or attended one of our events.
• Customers and suppliers: Performance of a contract.
• Prospects: Legitimate interest, as you may have an interest in Carbon Literacy.
• Donors: Legitimate interest, as you’ve donated money to us.
• Trustees: Legal obligation.
• Volunteers: Legitimate interest, as you’ve agreed to volunteer with us.
• Freelance contractors: Performance of a contract.
• Employees: Performance of a contract.
• Job applicants: Legitimate interest, as you’ve applied for a role in the project team.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in
compliance with the above rules, where this is required or permitted by law.

The retention period for your data is as follows:

• People applying to be certified as Carbon Literate: Two years.
• People certified as Carbon Literate: Until you ask us to delete your data.
• Trainers and organisations applying for Carbon Literacy accreditations: Four years.
• Trainers and organisations certified with Carbon Literacy accreditations: One year after such time as the accreditation expires.
• Email subscribers: Indefinitely (in order to ensure you aren’t resubscribed if you choose to unsubscribe).
• Event attendees: Two years after you last attended an event.
• Customers and suppliers: Seven years after our contract with you ends.
• Prospects: Ten years after we identify you as a prospect.
• Donors: Seven years after your most recent donation.
• Trustees: Ten years after you cease being a trustee.
• Volunteers: Seven years after you cease being a volunteer.
• Freelance contractors: Seven years after you cease being a freelance contractor.
• Employees: Seven years after you cease being an employee.
• Job applicants: Six months after your job application if you opt to be considered for one role only, or 3 years if you opt to have your application considered for other roles.

In most cases, your data will be collected and processed by The Carbon Literacy Trust.

We use the following online tools to process your data:

• People applying to be certified as Carbon Literate: Microsoft, Slack, Salesforce
• People certified as Carbon Literate: Microsoft, Slack, Salesforce, Mailchimp, Brevo, Six Circles
• Trainers and organisations applying for Carbon Literacy accreditations: Microsoft, Slack, Salesforce, Sage, Zoom
• Trainers and organisations certified with Carbon Literacy accreditations: Microsoft, Slack, Salesforce, Sage, Mailchimp, Brevo, Zoom
• Email subscribers: Mailchimp, Brevo
• Event attendees: Microsoft, Slack, Salesforce, Sage, Mailchimp, Brevo, Zoom, Eventbrite, Ticket Tailor
• Customers and suppliers: Microsoft, Slack, Salesforce, Sage, Mailchimp, Brevo, Zoom, Airtable, Jotform
• Prospects: Microsoft, Slack, Salesforce, Mailchimp, Brevo
• Donors: Microsoft, Slack, Salesforce, Sage, Mailchimp, Brevo, JustGiving
• Trustees: Microsoft, Slack, Zoom
• Volunteers: Microsoft, Slack, Salesforce, Sage, Zoom, Airspeed
• Freelance contractors: Microsoft, Slack, Salesforce, Sage, Zoom, Airspeed
• Employees: Microsoft, Slack, Salesforce, Sage, Zoom, Airspeed
• Job applicants: Microsoft, Jotform

We share personal data about our employees with the following organisations for the purposes of payroll administration and pension auto-enrolment:

• Third Sector Accountancy Ltd
• Nest (National Employment Savings Trust) Corporation

We share personal data about our employees, freelance contractors and volunteers with the following organisation for the purposes of making payments for work or expense claims:

• The Co-operative Bank

We will share your personal information with third parties where we are required to do so by law.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those volunteers, agents, contractors and other third parties who have a business need to know. These parties will only process your personal data on instructions from us and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes

Under data protection law, you have the following rights:

• • To request access to the information we hold about you
  • To request correction of your personal data
  • In certain circumstances, to request the deletion of your personal data
  • To object to the processing of your personal data
  • To request restrictions on processing your personal data
  • To request transfer of your personal data
  • Where processing is based on consent, to withdraw your consent.

If you wish to exercise any of these rights, or to review the information we hold about you, please contact us.

You also have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). If you have a concern about the way we are collecting or using your personal data, please contact us in the first instance.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to anyone who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made numerous requests. In this case, we will notify you and keep you updated.

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

We reserve the right to update this Privacy Notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

This Privacy Notice was last updated on 22 January 2026.