Privacy Policy

Last Updated: January 2026

Carbon Crystal Limited (“we”, “us”, or “our”) is committed to protecting your personal data. This policy outlines how we collect, use, and protect your information in compliance with the UK GDPR and the Data (Use and Access) Act 2025.

1. Information We Collect

  • Information You Provide: When you contact us via email or web forms, we collect your name, email address, and any information provided in your inquiry.

  • Technical Data: We automatically collect IP addresses, browser types, and access times via server logs.

  • Hosting Data: Our website is hosted on Microsoft Azure. Azure processes technical metadata to ensure service stability and security.

2. How We Use Your Data

We process your data under the following legal bases:

  • Contractual Necessity: To provide IT consultancy and software services.

  • Legitimate Interests: For network security, fraud prevention, and direct marketing (as recognised under the 2025 Act).

  • Consent: For the use of non-essential tracking technologies.

3. Data Residency and Transfers

As a UK company using Microsoft Azure, we aim to store and process data within the UK South (London) region. If data is transferred outside the UK, we ensure it is protected by “not materially lower” standards of protection, as per current UK adequacy regulations.

4. Your Rights

Under the UK GDPR, you have the right to access, rectify, or erase your data. We fulfill Subject Access Requests (SARs) using “reasonable and proportionate” search efforts. We may pause the statutory one-month response timer if we require further clarification of your identity or request.

5. Mandatory Complaints Procedure

If you have a concern regarding our data processing, you have the right to lodge a complaint directly with us:

  • Contact: info@carboncrystal.co.uk

  • Our Commitment: We will acknowledge your complaint within 30 days. We will investigate and provide a substantive response without undue delay.

  • Escalation: If you remain unsatisfied, you may complain to the Information Commission (formerly the ICO).