PRIVACY POLICY

Carbon2O2, Inc., a Florida corporation (“Carbon2O2,” the “Company,” “we,” “our,” or “us”), is committed to protecting the privacy, confidentiality, and security of Personal Information entrusted to the Company in connection with the operation of its technology-enabled marketplace and related services. This Privacy Policy (this “Privacy Policy”) describes the manner in which Carbon2O2 collects, receives, uses, stores, maintains, discloses, transfers, retains, and otherwise processes Personal Information obtained through the Company’s website, marketplace platform, software applications, registry integrations, customer onboarding processes, digital services, communications, and other products and services offered by the Company (collectively, the “Services”).

Carbon2O2 operates a technology-enabled marketplace designed to facilitate the procurement, custody, transfer, inventory management, and retirement of environmental assets. The Company recognizes that the trust of its Marketplace Participants, business partners, project developers, registry operators, service providers, and other users depends in part upon the responsible handling of Personal Information. Accordingly, the Company has adopted this Privacy Policy to provide a clear description of its information management practices and its commitment to maintaining appropriate administrative, technical, and physical safeguards designed to protect Personal Information.

This Privacy Policy forms a part of the contractual relationship between Carbon2O2 and each person or entity accessing or using the Services and should be read together with the Marketplace Participation Agreement, the Marketplace Rules, the Company’s Terms of Use, and any other agreements governing access to or use of the Services. In the event of any inconsistency concerning the Company’s privacy practices, this Privacy Policy shall govern the collection and processing of Personal Information unless otherwise expressly provided by applicable law.

By accessing or using the Services, establishing an Account, submitting information to Carbon2O2, or otherwise interacting with the Company, each Participant acknowledges that it has reviewed and understands this Privacy Policy.

For purposes of this Privacy Policy, the following terms shall have the meanings set forth below. Capitalized terms used but not otherwise defined herein shall have the meanings assigned to them in the Marketplace Participation Agreement.

“Account” means an account established by or on behalf of a Participant through which the Participant may access certain Services offered by Carbon2O2.

“Applicable Privacy Laws” means all federal, state, local, and foreign laws, regulations, governmental guidance, and legally binding requirements governing the collection, use, disclosure, protection, retention, transfer, or other processing of Personal Information applicable to the Company’s operations.

“Cookies” means cookies, pixels, web beacons, software development kits, local storage technologies, session identifiers, and other similar technologies used to recognize devices, authenticate users, analyze Platform performance, or otherwise facilitate operation of the Services.

“Participant” means any individual or entity that accesses, visits, registers for, uses, purchases, sells through, or otherwise interacts with the Services.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual, as such definition may be expanded or modified under Applicable Privacy Laws. Personal Information does not include information that has been aggregated, anonymized, or deidentified in accordance with Applicable Privacy Laws.

“Platform” means the Carbon2O2 website, marketplace, software applications, account management systems, registry interfaces, digital certificate infrastructure, databases, application programming interfaces, and related technology through which the Services are provided.

“Services” means all products, services, functionality, software, applications, technology, and related offerings made available by Carbon2O2 through the Platform or otherwise.

“Third-Party Service Provider” means any independent contractor, vendor, consultant, cloud service provider, payment processor, compliance provider, registry operator, professional adviser, or other third party engaged by Carbon2O2 to assist in providing or supporting the Services.

Carbon2O2 collects only such Personal Information as the Company reasonably determines to be necessary or appropriate for the establishment and administration of Participant Accounts, the operation of the Marketplace, the provision of the Services, compliance with applicable legal and contractual obligations, the protection of Marketplace integrity, the prevention of fraud and unauthorized activity, the improvement of the Platform, and the conduct of the Company’s legitimate business operations.

The Personal Information collected by Carbon2O2 may be obtained directly from Participants, automatically through use of the Platform, from Approved Registries and other Marketplace participants, from Third-Party Service Providers performing services on behalf of the Company, from publicly available sources, and from other lawful sources.

Depending upon the nature of a Participant’s relationship with Carbon2O2 and the Services utilized, the Company may collect information concerning the Participant’s identity, contact information, organizational structure, beneficial ownership, business operations, payment information, transaction history, registry information, account activity, communications with the Company, device information, technical information concerning access to the Platform, and such additional information as Carbon2O2 reasonably determines is necessary to establish eligibility, administer Marketplace participation, facilitate transactions, satisfy regulatory or contractual requirements, maintain accurate Marketplace records, protect the security of the Platform, investigate suspected misconduct, or otherwise provide the Services.

In connection with the onboarding of Marketplace Participants, Carbon2O2 may also collect information necessary to conduct identity verification, Know Your Customer, Know Your Business, anti-money laundering, sanctions screening, beneficial ownership verification, tax reporting, fraud prevention, cybersecurity, and other compliance reviews. The Company may supplement information provided by Participants with information obtained from governmental agencies, commercial verification providers, compliance service providers, Approved Registries, financial institutions, or other reliable sources where the Company reasonably determines such information is necessary to comply with applicable law or protect the integrity of the Marketplace.

The Company may also collect technical and usage information generated through a Participant’s interaction with the Platform, including information relating to browser configuration, operating system, device identifiers, Internet Protocol addresses, session activity, authentication events, security logs, and similar information generated through normal operation of the Platform. Such information may be used independently or together with other information collected by the Company to administer the Platform, improve system performance, enhance cybersecurity, investigate technical issues, detect unauthorized activity, and otherwise support the reliable operation of the Services.

Carbon2O2 collects and processes Personal Information for legitimate business purposes relating to the establishment, administration, operation, security, and improvement of the Platform and the Services. The Company processes Personal Information only to the extent reasonably necessary to provide the Services requested by Participants, administer Marketplace activities, satisfy legal and regulatory obligations, protect the integrity and security of the Platform, enforce the Company’s contractual rights, and conduct its ordinary business operations.

Without limiting the generality of the foregoing, Carbon2O2 may use Personal Information to establish and administer Participant Accounts, verify the identity, authority, eligibility, and legal status of Participants, conduct Know Your Customer, Know Your Business, anti-money laundering, sanctions, beneficial ownership, fraud prevention, and other compliance reviews, facilitate the purchase, custody, transfer, inventory management, and retirement of Environmental Assets, administer Digital Certificates and Digital Impact Certificates, coordinate with Approved Registries and other authorized service providers, process payments, provide customer support, investigate disputes, respond to inquiries, maintain accurate Marketplace records, improve the functionality, security, and reliability of the Platform, detect, investigate, and prevent fraud, cybersecurity incidents, unauthorized access, or other improper activity, comply with applicable law, establish, exercise, or defend legal claims, and otherwise conduct the Company’s legitimate business operations in a manner consistent with the Marketplace Governance Framework.

Carbon2O2 may also use Personal Information to communicate with Participants concerning their Accounts, Marketplace transactions, changes to the Services, updates to Marketplace Rules, security matters, compliance requirements, customer support matters, and other operational or administrative issues relating to the Platform. The Company may additionally use Personal Information to provide educational materials, product announcements, newsletters, marketing communications, or information concerning new services offered by the Company where permitted by applicable law. Participants may opt out of receiving promotional communications at any time by following the instructions contained in such communications or by contacting the Company directly. A Participant’s election to discontinue promotional communications shall not affect the Company’s ability to deliver transactional, legal, security, compliance, or other communications necessary for the administration of the Participant’s Account or the operation of the Marketplace.

The Company may aggregate, anonymize, or otherwise deidentify information collected through the Platform so that such information no longer identifies, and cannot reasonably be associated with, any individual or identifiable person. Subject to applicable law, Carbon2O2 may use such aggregated or deidentified information for research, statistical analysis, product development, operational improvement, cybersecurity, sustainability reporting, business planning, benchmarking, and other lawful business purposes.

Carbon2O2 does not sell Personal Information to data brokers or otherwise disclose Personal Information except as described in this Privacy Policy, as authorized by the applicable Participant, or as otherwise permitted or required by applicable law.

In the ordinary course of operating the Platform and providing the Services, Carbon2O2 may disclose Personal Information to its officers, directors, employees, affiliates, professional advisers, insurers, auditors, accountants, legal counsel, and Third-Party Service Providers that assist the Company in operating the Platform or conducting its business. Such Third-Party Service Providers may include providers of cloud hosting, cybersecurity services, payment processing, identity verification, anti-money laundering and sanctions screening, registry integration, blockchain infrastructure, information technology support, document management, communications, customer relationship management, accounting, auditing, and similar business services. Carbon2O2 expects such Third-Party Service Providers to use Personal Information solely for the purposes for which it is disclosed and to maintain commercially reasonable safeguards designed to protect such information.

Where reasonably necessary to facilitate Marketplace transactions, Carbon2O2 may disclose information to Approved Registries, project developers, strategic partners, payment providers, escrow agents, financial institutions, or other authorized counterparties participating in a particular transaction. Such disclosures shall be limited to information reasonably necessary to facilitate the applicable transaction, verify ownership or chain of title, administer custody or retirement of Environmental Assets, satisfy contractual obligations, or otherwise support the operation of the Marketplace.

Carbon2O2 may disclose Personal Information where the Company reasonably determines that such disclosure is necessary or appropriate to comply with applicable law, legal process, governmental requests, court orders, subpoenas, regulatory examinations, or other legal obligations, to investigate suspected fraud, cybersecurity incidents, sanctions violations, money laundering, or other unlawful conduct, to protect the rights, property, or safety of the Company, its Participants, or third parties, or to establish, exercise, or defend legal claims.

The Company may also disclose Personal Information in connection with a merger, acquisition, financing, recapitalization, sale of assets, corporate reorganization, bankruptcy proceeding, or similar business transaction, provided that the recipient of such information assumes appropriate obligations with respect to the continued protection of such information.

Except as otherwise described in this Privacy Policy or required by applicable law, Carbon2O2 will not disclose Personal Information to third parties without the consent or direction of the applicable Participant.

Carbon2O2 uses cookies and similar technologies to facilitate operation of the Platform, authenticate users, maintain Account sessions, improve Platform functionality, enhance cybersecurity, analyze system performance, understand how the Platform is used, and improve the overall user experience.

These technologies may collect information concerning a Participant’s device, browser, operating system, IP address, language preferences, pages viewed, referring websites, session duration, interactions with the Platform, and similar technical information. Carbon2O2 may utilize first-party cookies as well as cookies or similar technologies provided by trusted Third-Party Service Providers that assist the Company in operating, securing, maintaining, or improving the Platform.

Participants may configure their browsers to reject or limit the use of cookies, however, doing so may impair the functionality of certain portions of the Platform, including authentication features, Account administration, Marketplace transactions, and other security-related functions. Unless otherwise required by applicable law, Carbon2O2 does not respond to browser-based “Do Not Track” signals.

Carbon2O2 maintains administrative, technical, and physical safeguards that are designed to protect Personal Information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, misuse, or other unauthorized processing. The Company’s information security program is intended to be commercially reasonable in light of the nature of the Personal Information processed, the Company’s business operations, the sensitivity of the information maintained, applicable legal requirements, industry practices, and the reasonably foreseeable risks associated with the operation of the Platform.

The Company’s security measures may include, as appropriate, access controls, authentication procedures, encryption technologies, network monitoring, cybersecurity monitoring tools, vulnerability management procedures, backup and recovery systems, logging and audit capabilities, incident response procedures, vendor management practices, employee training, and other administrative, technical, and organizational safeguards designed to promote the confidentiality, integrity, and availability of information maintained by the Company.

Access to Personal Information is restricted to those officers, directors, employees, contractors, consultants, and Third-Party Service Providers who require such access in order to perform their respective duties or provide services on behalf of the Company. Persons granted access to Personal Information are expected to maintain the confidentiality of such information and to process such information only in accordance with applicable contractual obligations, Company policies, and applicable law.

Notwithstanding the foregoing, no method of transmitting information over the Internet, no electronic storage system, and no information security program can eliminate every security risk or guarantee absolute security. Accordingly, Carbon2O2 does not represent or warrant that Personal Information will be immune from unauthorized access, cybersecurity incidents, system failures, malicious attacks, human error, or other circumstances beyond the Company’s reasonable control. Participants acknowledge and accept the inherent security risks associated with electronic communications, Internet-based services, cloud computing, and digital information systems.

Participants are responsible for maintaining the confidentiality of their Account credentials, authentication methods, passwords, private keys, wallet credentials, and other security information associated with their Accounts. Participants shall promptly notify Carbon2O2 upon becoming aware of any actual or suspected unauthorized access to their Account, compromise of authentication credentials, cybersecurity incident, or other event that may reasonably affect the security of the Platform or the Participant’s Personal Information.

Carbon2O2 retains Personal Information only for so long as the Company reasonably determines such information is necessary or appropriate to provide the Services, administer the Marketplace, maintain accurate business records, satisfy contractual obligations, comply with applicable law, resolve disputes, establish or defend legal claims, enforce contractual rights, or otherwise conduct the Company’s legitimate business operations.

The period for which Personal Information is retained may vary depending upon the nature of the information, the Participant’s relationship with the Company, the Services utilized, applicable legal requirements, regulatory obligations, contractual commitments, litigation holds, tax reporting requirements, cybersecurity considerations, and other relevant business or legal considerations.

Upon expiration of the applicable retention period, Carbon2O2 may delete, destroy, anonymize, aggregate, archive, or otherwise dispose of Personal Information in accordance with the Company’s record retention policies, applicable law, and commercially reasonable business practices. Notwithstanding the foregoing, the Company may retain information for longer periods where reasonably necessary to comply with applicable law, respond to governmental inquiries, preserve evidence relating to actual or anticipated litigation, investigate fraud or cybersecurity incidents, protect the integrity of the Marketplace, or establish, exercise, or defend legal claims.

Where Personal Information has been anonymized or deidentified in a manner that no longer permits the identification of an individual, the Company may retain and use such information for research, statistical analysis, product development, cybersecurity, benchmarking, operational improvement, sustainability reporting, and other lawful business purposes.

The deletion of Personal Information from active systems does not necessarily require the immediate deletion of residual copies maintained in routine backup systems, disaster recovery systems, archival media, or other records maintained in accordance with the Company’s ordinary business continuity and record retention practices, provided that such information remains subject to appropriate safeguards until deleted or overwritten in the ordinary course.

Carbon2O2 recognizes that individuals may possess certain rights concerning their Personal Information under Applicable Privacy Laws. To the extent required by applicable law, and subject to any applicable exceptions, limitations, or exemptions, the Company will honor requests to exercise such rights in accordance with the procedures established by the applicable law.

Depending upon the jurisdiction in which an individual resides and the circumstances under which Personal Information is processed, such rights may include the right to request access to Personal Information maintained by the Company, request correction of inaccurate Personal Information, request deletion of Personal Information, request a copy of certain Personal Information in a portable format, request restrictions on certain processing activities, object to particular categories of processing, withdraw consent where processing is based upon consent, or appeal the Company’s determination regarding a privacy request where such appeal rights are provided by applicable law.

Carbon2O2 may request information reasonably necessary to verify the identity and authority of any person submitting a privacy request before responding to such request. The Company may decline to honor any request where permitted or required by applicable law, including where compliance would adversely affect the rights of another person, compromise the security or integrity of the Platform, interfere with legal obligations, impair the Company’s ability to establish, exercise, or defend legal claims, or otherwise fall within an exception recognized under Applicable Privacy Laws.

The exercise of privacy rights shall not adversely affect a Participant’s ownership of Environmental Assets, contractual rights under the Marketplace Participation Agreement, or other legal rights except to the extent that continued provision of the Services necessarily requires the continued processing of certain Personal Information. Where the deletion or restriction of Personal Information would prevent Carbon2O2 from complying with applicable law, administering the Marketplace, completing pending transactions, maintaining required business records, or otherwise performing its contractual obligations, the Company may retain and continue to process such information to the extent permitted by Applicable Privacy Laws.

Participants wishing to exercise applicable privacy rights may submit a written request using the contact information provided in this Privacy Policy. Carbon2O2 will respond to verified requests within the time periods required by Applicable Privacy Laws.

Carbon2O2 is organized under the laws of the State of Florida and conducts its operations primarily within the United States. Personal Information collected through the Services may be processed, stored, maintained, or otherwise transferred within the United States or in other jurisdictions in which Carbon2O2, its affiliates, Approved Registries, or Third-Party Service Providers maintain facilities or conduct business.

By accessing or using the Services, each Participant acknowledges that Personal Information may be transferred to, processed in, or accessed from jurisdictions whose data protection laws may differ from those applicable in the Participant’s jurisdiction of residence. Where Applicable Privacy Laws require the implementation of specific safeguards governing international transfers of Personal Information, Carbon2O2 will implement such safeguards as the Company reasonably determines to be appropriate under the circumstances.

Nothing contained in this Privacy Policy shall be construed as representing that Carbon2O2 processes Personal Information in every jurisdiction or offers the Services in every country. The availability of the Services remains subject to applicable law, sanctions restrictions, export control requirements, and the Company’s Marketplace eligibility requirements.

The Services are intended solely for use by businesses, governmental entities, nonprofit organizations, institutional participants, project developers, and other persons possessing the legal capacity to enter into binding contracts. The Services are not directed to children, and Carbon2O2 does not knowingly collect Personal Information from any individual under thirteen (13) years of age or such higher minimum age as may be established under Applicable Privacy Laws.

If Carbon2O2 becomes aware that Personal Information has been collected from a child in violation of Applicable Privacy Laws, the Company will take commercially reasonable steps to delete such information or otherwise comply with applicable legal requirements. A parent or legal guardian who believes that a child has provided Personal Information to Carbon2O2 may contact the Company using the contact information set forth below.

Carbon2O2 reserves the right to amend, revise, supplement, or otherwise modify this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, business operations, technology, cybersecurity practices, Marketplace functionality, or the Services offered by the Company.

Any revised Privacy Policy shall become effective upon its publication on the Platform or upon such later effective date as may be specified therein. Where required by Applicable Privacy Laws or where the Company determines that additional notice is appropriate, Carbon2O2 may provide notice of material revisions by electronic mail, through the Platform, or by such other means as the Company reasonably determines to be appropriate.

A Participant’s continued access to or use of the Services following the effective date of a revised Privacy Policy constitutes acknowledgment of the revised Privacy Policy and, where permitted by Applicable Privacy Laws, acceptance of the modifications contained therein.

Questions concerning this Privacy Policy, requests relating to Personal Information, or other privacy-related inquiries may be directed to Carbon2O2 using the contact information published on the Company’s website or by contacting the Company at its principal executive offices.

Carbon2O2 may require sufficient information to verify the identity and authority of the person submitting an inquiry before disclosing information concerning any Account or responding to requests involving Personal Information.

The Company will endeavor to respond to legitimate privacy-related inquiries within a commercially reasonable period or within such time as may be required by Applicable Privacy Laws.