Privacy policy

1. Controller

vesta sustainability consulting UG (haftungsbeschränkt)
c/o ImpactHub, Gotzinger Str. 8
81371 München, Germany

Managing directors: Michael Vollmer, Hannes Michel Harter · Email: hello@carbontoll.com

carbontoll is a business unit of vesta sustainability consulting UG. We have not appointed a data protection officer because the legal requirements for doing so are not met.

2. In short

This website sets analytics cookies only with your consent (Google Analytics, see section 7) and otherwise embeds no third-party content. Fonts and images are served from our own server. We process personal data only where this is needed to deliver the site, when you contact us, or when you have consented to analytics.

3. Hosting and visiting the website

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in its Nuremberg data centre. When you visit, your browser necessarily transmits data to the server: IP address, date and time, the address requested, the referring page, browser and operating system. We process this data only to deliver the site and secure the connection via HTTPS. We do not store access logs.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a secure, working website. We have a data processing agreement with Hetzner under Art. 28 GDPR.

4. Contact by email

When you write to us, we process your email address, your name, your company where given, and the content of your message in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns a contract, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). The mailboxes at carbontoll.com are operated by Hetzner Online GmbH in Germany. We read and handle email with Microsoft 365 (Outlook) from Microsoft Ireland Operations Ltd., Dublin. Data may also be transferred to the USA; Microsoft is certified under the EU-US Data Privacy Framework, and standard contractual clauses apply in addition.

Our team works in the EU and in the People’s Republic of China. If your enquiry concerns work in China, or you write to a team member based there, your details are also processed in China. There is no EU adequacy decision for China. The transfer is based on Art. 49(1)(b) GDPR, as it is necessary to handle your enquiry and to take pre-contractual steps at your request.

We delete your data once the enquiry is closed, unless commercial or tax retention obligations apply (usually six to ten years for business correspondence).

5. WeChat

We show a QR code you can use to add us on WeChat. The code is an image on our own server. No data flows to WeChat when the page loads.

Only when you scan the code with the WeChat app and contact us does Tencent process your data under its own responsibility and terms, including in the People’s Republic of China, where the level of data protection does not match that of the EU. Using WeChat is voluntary; email is always available as an alternative. Messages we receive via WeChat are handled as described in section 4. WeChat privacy policy: wechat.com/en/privacy_policy.html

6. Cost estimator

The cost estimator on the home page runs entirely in your browser. Your inputs are neither sent to us nor stored.

7. Cookies, consent and analytics

Consent management: on your first visit we ask whether you allow analytics cookies. We store your choice in a technically necessary entry in your browser (§ 25(2) no. 2 TDDDG). You can change or withdraw it at any time via “Cookie settings” in the footer.

Google Analytics 4: with your consent we use Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to understand how the website is used. The script is loaded only after you consent. Cookies are set and usage data is processed (truncated IP address, device and browser details, pages visited, time on page, approximate location). Data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition. The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). The analytics cookies expire 2 months after your consent and are not extended. Event data linked to a user is deleted by Google after 2 months; aggregated statistics without personal reference are retained. We have a data processing agreement with Google.

8. Use of artificial intelligence

Some texts and images on this website are created with the help of AI tools and are reviewed by us before publication. We do not feed visitor data into AI systems. No chatbot or other AI system you could interact with runs on this site. Details are given in the imprint.

9. Recipients

Hetzner Online GmbH (hosting, email), Microsoft (Microsoft 365) and Google Ireland Limited (Google Analytics, only with consent) process data on our behalf. Beyond that we share your data only where required by law. There is no automated decision-making, including profiling.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal email to hello@carbontoll.com is enough. You may also lodge a complaint with a supervisory authority. Ours is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

11. Language versions

This policy is available in German, English and Chinese. The German version is authoritative.