Legal and platform information

Privacy Policy

How Carbon Trader collects, uses, stores, shares and protects personal information, including KYC, AML/CFT, verification, platform and settlement records.

Effective date: 30 May 2026. These are the current published terms for Carbon Trader® website and platform use.

Part 5 - Privacy Policy

1. Who this Privacy Policy applies to

This Privacy Policy applies to personal information collected by Trend Enterprises Limited (NZBN: 9429048521130) t/a Carbon Trader®, including through the Carbon Trader website, platform, marketplace, broker desk, account dashboard, admin dashboard, contact forms, KYC/KYB processes, Sumsub verification, Carbon Trader-managed escrow, digital wallets, Enterprise API, email, SMS, phone, meetings and support channels.

2. Privacy Officer

Carbon Trader’s privacy contact is:

Email: info@carbontrader.nz
Subject line: Privacy request
Entity: Trend Enterprises Limited (NZBN: 9429048521130) t/a Carbon Trader®

Privacy requests are handled by Carbon Trader operations and escalated to the responsible privacy officer or authorised representative for Trend Enterprises Limited.

3. Personal information we collect

We may collect:

  • name, email, phone, address and contact details;
  • job title, organisation, NZBN and authority details;
  • director, beneficial owner, senior manager and authorised representative details;
  • identity documents and verification information;
  • biometric/liveness information through Sumsub or equivalent providers;
  • source-of-funds, source-of-wealth and source-of-credit information;
  • bank account verification information;
  • NZETR account name, account number and transfer evidence;
  • registry, project, credit and transaction information;
  • public listing information;
  • marketplace bids, RFQs, mandates and communications;
  • documents, screenshots and evidence uploaded by users;
  • login, IP address, device, browser and security logs;
  • cookie, analytics and marketing preferences;
  • API keys, webhook logs and technical metadata;
  • support, complaint and dispute records;
  • sanctions, PEP, adverse media and AML/CFT screening results;
  • payment, invoice and fee information;
  • communications by email, SMS, phone and platform messaging.

4. How we collect information

We may collect information directly from you, from your organisation, from authorised advisers, from forest managers, from buyers, from sellers, from registries, from banks, from identity providers, from Sumsub, from payment providers, from sanctions and screening databases, from public registers, from credit registries, from government sources, from APIs and from service providers.

Where we collect personal information from someone other than the individual concerned, we will provide notice where required by New Zealand privacy law, unless an exception applies.

5. Why we collect and use information

We collect and use information to:

  • provide the website and platform;
  • create and manage accounts;
  • authenticate users;
  • verify identity, authority and organisation details;
  • conduct KYC, KYB, AML/CFT, sanctions and fraud checks;
  • process seller and buyer mandates;
  • administer listings, RFQs, trades and price discovery;
  • manage Carbon Trader escrow and settlement;
  • record digital wallet and custody activity;
  • coordinate NZETR transfers;
  • generate invoices, completion statements and evidence packs;
  • deliver API, data and webhook services;
  • assess environmental claim suitability;
  • communicate with users;
  • send service, legal, security and operational notices;
  • send marketing where permitted;
  • comply with tax, AML/CFT, privacy, financial services, registry, dispute, audit and legal obligations;
  • prevent fraud, security incidents and platform misuse;
  • improve our services.

6. KYC, AML/CFT and Sumsub

Carbon Trader may use Sumsub or another provider to verify identity, conduct liveness checks, process identity documents, verify beneficial ownership, screen for sanctions and PEPs, and support AML/CFT compliance.

This may involve biometric information, identity documents, address information, company information and risk-screening data being processed by Sumsub and its subprocessors in other countries. Users must not submit false documents or impersonate another person.

7. Disclosures

We may disclose information to:

  • buyers, sellers and transaction counterparties where needed;
  • forest managers, accountants, advisers and authorised representatives;
  • Sumsub and other KYC/KYB providers;
  • banks, payment providers and settlement providers;
  • NZETR users and registry operators;
  • credit registries, standards bodies and verification bodies;
  • AWS, Cognito and hosting providers;
  • email, SMS, analytics, support and marketing providers;
  • lawyers, accountants, auditors, insurers and professional advisers;
  • regulators, supervisors, dispute resolution schemes, courts, law enforcement and government bodies;
  • API and integration providers where authorised;
  • any person required to complete a transaction, resolve a dispute or comply with law.

8. Overseas disclosure

Some service providers may process information outside New Zealand. Carbon Trader will take reasonable steps required by the Privacy Act 2020 before disclosing personal information overseas, including by relying on service terms, contractual protections, comparable safeguards, user authorisation or other lawful bases.

9. Cookies and analytics

We use cookies, local storage, pixels, analytics scripts and similar technologies as described in the Cookie Policy.

10. Marketing

We may send marketing communications where permitted by law, including where you consent, where consent can reasonably be inferred from an existing business relationship, or where another lawful basis applies. You can unsubscribe from marketing messages. Service, legal, security and transaction messages may still be sent.

11. Security

We use reasonable technical and organisational safeguards, including access controls, encryption where appropriate, audit logs, administrative permissions, secure hosting, vendor controls, identity verification and internal procedures. No system is completely secure.

12. Retention

We retain information for as long as needed for the purpose collected and to comply with AML/CFT, financial services, tax, registry, legal, audit, dispute and recordkeeping obligations. AML/CFT and transaction records may be retained for at least the legally required period and longer where necessary.

13. Access and correction

Individuals may request access to or correction of their personal information by contacting info@carbontrader.nz. We may need to verify identity before responding. We may refuse or limit requests where permitted by law.

14. Privacy breaches

If a privacy breach occurs, Carbon Trader will assess the incident and take steps required by law. If a breach has caused or is likely to cause serious harm, Carbon Trader will notify the Privacy Commissioner and affected people as soon as practicable, unless an exception applies.

15. Children

The Services are intended for business users and adults. Carbon Trader does not knowingly provide accounts to children.

16. Complaints

Privacy complaints should be sent to info@carbontrader.nz. Individuals may also contact the Office of the Privacy Commissioner.