Legal · Privacy Policy

Privacy Policy

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This Policy explains how we collect, use, disclose and protect it.

Contact our Privacy Officer
Terms and conditions

policy at a glance

owner

Australian Carbon Reduction Collective Pty Ltd

ACRC

acn

Australian Company Number

658 614 058

law

Privacy Act 1988 (Cth) and the APPs

APPs

updated

this Policy was last updated

Oct 2026

Questions: [email protected]

on this page

  1. 1. About this Policy
  2. 2. Whose personal information we collect
  3. 3. What personal information we collect
  4. 4. How we collect personal information
  5. 5. Why we collect, use and disclose personal information
  6. 6. Personal information in client data
  7. 7. Who we disclose personal information to
  8. 8. Overseas disclosure
  9. 9. Direct marketing
  10. 10. Cookies and analytics
  11. 11. Use of AI and automated decision-making
  12. 12. Security
  13. 13. Data breaches
  14. 14. How long we keep personal information
  15. 15. Accessing and correcting your personal information
  16. 16. Making a complaint
  17. 17. Changes to this Policy
  18. 18. Contact us

1. About this Policy

Australian Carbon Reduction Collective Pty Ltd ACN 658 614 058 trading as Carbonhalo
Last updated: October 2026

Carbonhalo is a business name of Australian Carbon Reduction Collective Pty Ltd ACN 658 614 058 (Carbonhalo, we, us, our). We provide climate reporting and carbon accounting advisory services to organisations, carbon credit retirement services, and an online carbon accounting platform at carbonhalo.com (Platform).

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs). This Policy explains what personal information we collect, why we collect it, how we use, disclose and protect it, and how you can access or correct it or make a complaint.

This Policy applies to personal information we handle in Australia. It does not apply to information about organisations (such as a company’s emissions data) except to the extent that information identifies an individual.

2. Whose personal information we collect

We collect personal information about:

  • client contacts: directors, officers, employees and advisers of our clients and prospective clients;
  • Platform users: people who register for or use the Platform;
  • individuals whose information is contained in client data, for example, supplier contacts, employee travel or commuting information, or names on utility and expense records provided to us so we can prepare emissions calculations;
  • website visitors and people who contact us, including through our website, events, newsletters and social media;
  • suppliers and contractors; and
  • job applicants and prospective contractors.

3. What personal information we collect

Clients, Platform users and other contacts

  • name, job title, organisation, email address and phone number;
  • Account login details and profile information, including any photo or logo you upload;
  • billing and payment information (card payments are processed by our payment provider and we do not store full card numbers);
  • records of our communications with you, meeting notes and feedback; and
  • marketing preferences.

Information in client data

Our clients give us operational data so we can prepare carbon accounts and climate-related disclosures. This is mainly business information, but it can incidentally include personal information such as names and contact details of client personnel and suppliers, travel and commuting records, or names on invoices. We handle this information only to provide services to our client (see section 6).

Website and Platform usage information

  • IP address, device and browser information, approximate location, pages viewed, referring sources, search queries and Platform activity logs; and
  • information collected through cookies and similar technologies (see section 10).

Job applicants and contractors

  • name, contact details, CV, qualifications, employment history, examples of work and referee comments; and
  • information confirming your right to work in Australia, where relevant to a role.

Sensitive information

We do not generally collect sensitive information (such as health information). If we need it, for example to make reasonable adjustments for a job applicant or event attendee, we will only collect it with your consent or where otherwise permitted by law.

4. How we collect personal information

We collect personal information:

  • directly from you, when you engage us, register for or use the Platform, attend a meeting or event, subscribe to updates, apply for a role or otherwise contact us;
  • from our clients, when they provide data and contact details of their personnel, suppliers or advisers for the purposes of our services;
  • from third parties, such as your colleagues, referees, recruitment platforms, industry associations we partner with, and publicly available sources such as company websites, ASIC records and professional networking sites; and
  • automatically, through our website and Platform (see section 10).

If you do not provide information we ask for, we may not be able to provide our services or respond to you. You may deal with us anonymously or using a pseudonym where that is practicable, for example when making a general enquiry, but not where we need to identify you to provide services.

If we receive personal information we did not ask for, we will destroy or de-identify it as soon as practicable if it is lawful and reasonable to do so, unless we could have collected it for our functions or activities.

5. Why we collect, use and disclose personal information

We collect, use and disclose personal information to:

  • provide our advisory services and the Platform, including preparing carbon accounts, climate-related disclosures and related deliverables;
  • communicate with clients and their auditors and advisers about our services;
  • create and manage Platform Accounts, provide support and maintain security;
  • invoice, collect payments and manage our business relationships;
  • improve our services, methodologies and Platform;
  • carry out carbon credit retirements attributed to our clients and issue retirement confirmations;
  • send updates, newsletters and information about our services (see section 9);
  • assess job applicants and engage contractors;
  • meet our legal, regulatory, insurance and professional obligations, and establish or defend legal claims; and
  • for any other purpose you consent to, or that is required or authorised by law.

6. Personal information in client data

When a client provides us with data that includes personal information, we use it only to deliver services to that client, in accordance with our Terms of Business and our confidentiality obligations. We do not use it for marketing or for any unrelated purpose.

Our clients are responsible for ensuring they are permitted to share that information with us and for giving any notices required to their own personnel and suppliers. Where practicable, we encourage clients to remove or minimise personal information before sharing data with us, as most carbon accounting work does not require it.

If you are an individual whose information has been provided to us by one of our clients and you have a question about it, you may contact us or the relevant client.

7. Who we disclose personal information to

We may disclose personal information to:

  • service providers who help us run our business and deliver our services, including providers of cloud hosting and data storage (such as Amazon Web Services), email delivery (such as SendGrid), accounting and invoicing (such as Xero), payment processing (such as Stripe), office productivity, document management and communication tools, and AI-enabled software tools;
  • our subcontractors and specialist advisers engaged to help deliver client services, who are bound by confidentiality obligations;
  • our clients’ auditors and assurance practitioners, where our client asks us to or it is necessary for the services;
  • our professional advisers, insurers and debt collectors;
  • industry associations or other partners through which you access the Platform, to the extent necessary to administer that arrangement;
  • a purchaser or prospective purchaser of our business, subject to confidentiality obligations;
  • government authorities, regulators and courts, where required or authorised by law;
  • carbon credit registries, when we retire carbon credits attributed to your organisation (registry records generally show the organisation’s name, which is personal information only where the organisation is an individual or sole trader); and
  • anyone else you authorise us to disclose to.

We do not sell personal information.

We do not disclose information about our clients or the carbon credit retirements attributed to them (including client lists) to third parties without the relevant client’s consent, except for registry retirement records described above or as otherwise set out in this Policy or our Terms of Business.

8. Overseas disclosure

Some of our service providers store or process personal information outside Australia, including in the United States and other countries where their data centres or support teams are located. Where we use overseas providers, we take reasonable steps to ensure they handle personal information in a manner consistent with the APPs, including by selecting reputable providers with appropriate contractual and security protections. Where possible, we choose Australian data hosting for client data.

9. Direct marketing

We may use your contact details to send you information about our services, events and insights that may interest you. We comply with the Spam Act 2003 (Cth). You can opt out at any time by using the unsubscribe link in our emails or by contacting us. We will process your request within a reasonable time (and in any event within 5 business days for electronic messages).

10. Cookies and analytics

Our website and Platform use cookies and similar technologies to keep you logged in, remember your preferences, maintain security and understand how our website and Platform are used. We may use third-party analytics services for this purpose. You can control cookies through your browser settings, but some features of the Platform may not work if cookies are disabled.

11. Use of AI and automated decision-making

We may use AI-enabled tools to help our team with tasks such as drafting, summarising and analysing information. Where we do, Carbonhalo personnel review any output before it is relied on.

We do not use computer programs to make decisions, or to substantially and directly support decisions, that could reasonably be expected to significantly affect an individual’s rights or interests. If this changes, we will update this Policy to describe the kinds of personal information used and the kinds of decisions involved, as required by the Privacy Act.

12. Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include access controls and multi-factor authentication, encryption, staff confidentiality obligations and training, and security measures aligned with recognised frameworks.

13. Data breaches

If we become aware of a data breach involving personal information we hold, we will act promptly to contain and assess it. Where a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme. Where a breach involves client data, we will also notify the relevant client promptly.

14. How long we keep personal information

We keep personal information only for as long as we need it for the purposes described in this Policy, or as required by law (including record-keeping obligations that apply to our business and, where relevant, to our clients’ reporting). When we no longer need personal information, we take reasonable steps to securely destroy or de-identify it. Client data is returned or destroyed at the end of an engagement in accordance with our Terms of Business, subject to legal and archival retention requirements.

15. Accessing and correcting your personal information

You may ask to access the personal information we hold about you, or ask us to correct it, by contacting us using the details below. Platform users can update much of their information directly in the Profile section of the Platform.

We will respond within a reasonable time, usually within 30 days. We may need to verify your identity first. If we refuse access or correction, we will tell you why in writing and how you can complain. We do not charge for making a request, but may charge a reasonable fee for providing access where permitted.

16. Making a complaint

If you believe we have breached your privacy, please contact our Privacy Officer using the details below. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If we need more time, we will let you know.

If you are not satisfied with our response, you may complain to the OAIC:

17. Changes to this Policy

We may update this Policy from time to time to reflect changes in the law, our services or our practices. The current version will always be available on our website, with the date it was last updated. We will notify Platform users of material changes.

18. Contact us

Privacy Officer
Australian Carbon Reduction Collective Pty Ltd trading as Carbonhalo
Email: [email protected]

This Policy was last updated in October 2026.

Talk to us

Thirty minutes with someone who has taken first-year disclosures through audit.

We tell you which group captures you, what you already hold, and what it will cost.

Book a free compliance assessment

Referred by your auditor? Mention the firm on the call and we will confirm the independence position in writing before anything starts.