Effective date: 30 May 2026. Last revised: 3 November 2026. These are the current published terms for Carbon Trader® website and platform use.
Part 5 - Privacy Policy
1. Who this Privacy Policy applies to
This Privacy Policy applies to personal information collected by Trend Enterprises Limited (NZBN: 9429048521130) t/a Carbon Trader®, including through the Carbon Trader website, platform, marketplace, account dashboard, admin dashboard, contact forms, KYC/KYB processes, identity verification, Carbon Trader-managed escrow, direct sales, digital wallets, email, SMS, phone, meetings and support channels.
2. Privacy Officer
Carbon Trader’s privacy contact is:
Email: info@carbontrader.nz
Subject line: Privacy request
Entity: Trend Enterprises Limited (NZBN: 9429048521130) t/a Carbon Trader®
Privacy requests are handled by Carbon Trader operations and escalated to the responsible privacy officer or authorised representative for Trend Enterprises Limited.
3. Personal information we collect
We may collect:
- name, email, phone, address and contact details;
- job title, organisation, NZBN and authority details;
- director, beneficial owner, senior manager and authorised representative details;
- identity documents and verification information;
- certified copies of identity documents and the details of the trusted referee who certified them;
- source-of-funds, source-of-wealth and source-of-credit information;
- bank account verification information;
- NZETR account name, account number and transfer evidence;
- registry, project, credit and transaction information;
- public listing information;
- marketplace bids, offers, mandates and communications;
- documents, screenshots and evidence uploaded by users;
- login, IP address, device, browser and security logs;
- cookie, analytics and marketing preferences;
- sign-in session, authenticator and text message code records and technical metadata;
- support, complaint and dispute records;
- sanctions, PEP, adverse media and AML/CFT screening results;
- payment, invoice and fee information;
- communications by email, SMS, phone and platform messaging, including conversations with our automated receptionist on the website chat or by phone, and the recording, transcript and summary of any such phone call.
Creating an account requires only your name, your email address and a password, or a sign-in with your Carbon Tracker® account. Identity information (date of birth, residential address, mobile number, identity documents, certified copies of them and politically exposed person status) is not collected at registration. It is collected when a transaction of yours first goes into Carbon Trader-managed escrow or you ask to withdraw units from a custody wallet, or earlier if you choose to complete identity verification in advance. It is not collected for a direct sale. A mobile number is also collected if you choose to turn on text message codes for signing in.
4. How we collect information
We may collect information directly from you, from your organisation, from authorised advisers, from forest managers, from buyers, from sellers, from registries, from banks, from trusted referees who certify identity documents, from Carbon Tracker® where you sign in with a Carbon Tracker account, from payment providers, from sanctions and screening databases, from public registers, from credit registries, from government sources, from APIs and from service providers.
Where we collect personal information from someone other than the individual concerned, we will provide notice where required by New Zealand privacy law, unless an exception applies.
5. Why we collect and use information
We collect and use information to:
- provide the website and platform;
- create and manage accounts;
- authenticate users;
- verify identity, authority and organisation details;
- conduct KYC, KYB, AML/CFT, sanctions and fraud checks;
- administer listings, trades and price discovery;
- manage Carbon Trader escrow and settlement;
- introduce the buyer and the seller to each other in a direct sale;
- record digital wallet and custody activity;
- coordinate NZETR transfers;
- generate invoices, completion statements and evidence packs;
- deliver market data and the free public tools;
- assess environmental claim suitability;
- communicate with users;
- send service, legal, security and operational notices;
- send marketing where permitted;
- comply with tax, AML/CFT, privacy, financial services, registry, dispute, audit and legal obligations;
- prevent fraud, security incidents and platform misuse;
- improve our services.
Identity information is used for the verification described in section 6, which takes place when a transaction first goes into escrow and not when an account is created.
6. KYC, AML/CFT and identity verification
Carbon Trader verifies identity itself, in New Zealand, under the Identity Verification Code of Practice 2026. Identity is not verified when an account is created; at that point we confirm your email address with a one-time code. Identity is verified once, when a transaction of yours first goes into Carbon Trader-managed escrow: for a buyer before an invoice is issued, for a seller before sale proceeds are released, and for any user before a withdrawal from a custody wallet is processed. At that point we collect your full name, date of birth, residential address and mobile number, ask whether you are a politically exposed person, and ask for a certified copy of an identity document (or sight the original). A designated person reviews the copy, checks the trusted referee's details, screens your name against sanctions and politically exposed person lists, and records the outcome and a customer risk rating. We do not collect biometric data, selfies or video. Identity documents are stored encrypted in Cloudflare R2 file storage and can be opened only by an authorised reviewer signed in to Carbon Trader's admin console, which requires an authenticator app. Identity is not verified for a direct sale, in which Carbon Trader holds neither the money nor the units. Verification records are kept for at least five years after the relationship ends, as the AML/CFT Act requires. Users must not submit false documents or impersonate another person.
7. Disclosures
We may disclose information to:
- buyers, sellers and transaction counterparties where needed;
- forest managers, accountants, advisers and authorised representatives;
- KYC/KYB and electronic identity verification providers, if we engage one;
- banks, payment providers and settlement providers;
- NZETR users and registry operators;
- credit registries, standards bodies and verification bodies;
- Cloudflare, Inc., which hosts the website, the application, its database and its file storage;
- Mailgun (Sinch Mailgun), which sends platform email, and Zoho Mail, which hosts the info@carbontrader.nz mailbox;
- Xero, in which invoices are raised;
- Kudosity, which sends sign-in codes by text message to people who turn them on;
- Anthropic, whose AI models write the automated receptionist's replies, where you use the website chat or ring its phone line;
- Retell AI, ElevenLabs and Twilio, which carry, voice, record and transcribe the automated receptionist's phone calls;
- Google, for analytics and Google Tag Manager on the public pages;
- support and marketing providers;
- lawyers, accountants, auditors, insurers and professional advisers;
- regulators, supervisors, dispute resolution schemes, courts, law enforcement and government bodies;
- Carbon Tracker®, where you sign in with a Carbon Tracker account;
- any person required to complete a transaction, resolve a dispute or comply with law.
In a direct sale, once the buyer has bought, Carbon Trader gives the seller the buyer's name, company, email address, phone number if we hold one and NZETR account number, and gives the buyer the seller's name, company, email address, phone number if we hold one and, where the seller has one on file, bank account. That is how the two parties complete the sale with each other. A seller who chooses to sell directly, and a buyer who buys from a direct listing, authorise that disclosure. Neither party's details are shown to the other before the buyer buys.
8. Overseas disclosure
Some service providers may process information outside New Zealand. The platform's database is held by Cloudflare, with its primary copy in Cloudflare's Oceania region, and Cloudflare, Mailgun, Xero, Zoho, Google, Kudosity, Anthropic, Retell AI, ElevenLabs and Twilio may process information in Australia, the United States or other countries. Carbon Trader will take reasonable steps required by the Privacy Act 2020 before disclosing personal information overseas, including by relying on service terms, contractual protections, comparable safeguards, user authorisation or other lawful bases.
9. Cookies and analytics
We use cookies, local storage, pixels, analytics scripts and similar technologies as described in the Cookie Policy.
10. Marketing
We may send marketing communications where permitted by law, including where you consent, where consent can reasonably be inferred from an existing business relationship, or where another lawful basis applies. You can unsubscribe from marketing messages. Service, legal, security and transaction messages may still be sent.
11. Security
We use reasonable technical and organisational safeguards, including access controls, encryption where appropriate, audit logs, administrative permissions, secure hosting, vendor controls, identity verification and internal procedures. Passwords are stored only as salted, keyed hashes, so nobody can read them. A sign-in session is held in a secure, HttpOnly cookie and we store it only as a hash. Changing bank or NZETR account details, or turning off an authenticator app, asks for the password again (or, for an account that signs in with Carbon Tracker, a recent sign-in), and we email the account holder when it happens. We also email the account holder when their password changes, when sign-in is paused after repeated wrong passwords, and when an authenticator app is turned on or off. Our admin console requires an authenticator app. No system is completely secure.
12. Retention
We retain information for as long as needed for the purpose collected and to comply with AML/CFT, financial services, tax, registry, legal, audit, dispute and recordkeeping obligations. AML/CFT and transaction records may be retained for at least the legally required period and longer where necessary.
13. Access and correction
Individuals may request access to or correction of their personal information by contacting info@carbontrader.nz. We may need to verify identity before responding. We may refuse or limit requests where permitted by law.
14. Privacy breaches
If a privacy breach occurs, Carbon Trader will assess the incident and take steps required by law. If a breach has caused or is likely to cause serious harm, Carbon Trader will notify the Privacy Commissioner and affected people as soon as practicable, unless an exception applies.
15. Children
The Services are intended for business users and adults. Carbon Trader does not knowingly provide accounts to children.
16. Complaints
Privacy complaints should be sent to info@carbontrader.nz. Individuals may also contact the Office of the Privacy Commissioner.