Privacy Policy

1. Who we are

Global Carbon Exchange (Pty) Ltd ("GCX", "we", "us", or "our") operates the GCX Data Analytics Sustainability Hub ("DASH"). GCX is the responsible party (data controller) for personal information processed through DASH, except where we process personal information on behalf of a subscribing organisation, in which case we act as an operator (processor) on that organisation's instructions. Our registered address is Milton's Way, 11 Bell Crescent, Westlake Business Park, Westlake, 7945, Cape Town, South Africa. This policy explains how we handle personal information in connection with the DASH platform and is aligned with the Protection of Personal Information Act (POPIA).

2. Data we collect

Depending on how you use DASH, we may collect:

• account and identity details, such as your name and email address;
• authentication and SSO identifiers used to sign you in securely;
• organisation and role information, such as your employer, job role, and access permissions;
• usage and diagnostic data, such as log records, IP address, device and browser information, and actions taken within the Service;
• support communications you send to us; and
• Customer Data uploaded to the Platform by your organisation, which may include sustainability, operational, and related business information processed on the organisation's behalf.

3. How and why we use personal data

We use personal information to provide, operate, and secure the DASH platform; to authenticate users and manage access; to deliver managed-service data collection, quality, and reporting where agreed; to provide support; to monitor, maintain, and improve the Service; and to comply with legal and regulatory obligations. We rely on lawful bases including the performance of a contract, our legitimate interests in operating and securing the Service, compliance with legal obligations, and your consent where required.

4. Sharing and processors

We may share personal information with trusted service providers that help us operate DASH, such as cloud hosting, identity and authentication, email, and support providers, under appropriate contractual safeguards. We may share information within your organisation as configured by its administrators. We may also disclose information where required to do so by law, regulation, or valid legal process, or to protect the rights, safety, and security of GCX, our users, or others. We do not sell personal information.

5. International transfers

DASH may be hosted and supported using reputable cloud infrastructure providers. Where personal information is processed or stored outside South Africa, we take reasonable steps to ensure it is protected by appropriate safeguards and that any cross-border transfer complies with applicable data protection law, including POPIA.

6. Retention

We retain personal information for as long as necessary to provide the Service, for the duration of the relationship with your organisation, and to meet our legal, regulatory, and contractual obligations. When personal information is no longer required, we take reasonable steps to securely delete or anonymise it.

7. Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, use, alteration, or destruction. These include access controls, least-privilege principles, encryption of data in transit, and monitoring. While we take security seriously, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your rights

Subject to applicable law, you may have the right to:

• access the personal information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• object to, or request restriction of, certain processing; and
• request a copy of certain information in a portable format.

To exercise these rights, please contact us at info@gcxdash.com. For security, we may need to verify your identity before acting on a request. Where GCX processes personal information on behalf of your organisation, we may direct your request to that organisation. You also have the right to lodge a complaint with the Information Regulator (South Africa) (justice.gov.za/inforeg).

9. Cookies and similar technologies

DASH uses cookies and similar technologies that are necessary for the platform to function, including for authentication, session continuity, and remembering your interface preferences (for example, your light or dark theme setting). We may use limited analytics to understand and improve how the Service is used. Where required by law, we will seek your consent for non-essential cookies. You can control cookies through your browser settings, although disabling essential cookies may affect how the Service works.

10. Contact and data protection enquiries

For any questions about this Privacy Policy or how we handle personal information, or to raise a data protection enquiry, please contact us:

Global Carbon Exchange (Pty) Ltd
Milton's Way, 11 Bell Crescent, Westlake Business Park, Westlake, 7945, Cape Town, South Africa
Email: info@gcxdash.com
Telephone: +27 21 7024 058

Please also see our Terms of Service.