Privacy Policy of Underground Forest B.V.

1. Who is the data controller?

Underground Forest B.V. is the data controller for the processing of your personal data. Our company and contact details are:

Name: Underground Forest B.V.

Address: Pompmolenlaan 10H, 3447 GK Woerden, The Netherlands

Chamber of Commerce (KvK): 91561108

Email address: info@undergroundforest.nl

We have not appointed a statutory Data Protection Officer (DPO), as the nature of our core processing activities does not legally require us to do so. However, for any questions regarding your privacy, you can always contact us at the email address provided above.

2. What personal data do we process?

Depending on your relationship with Underground Forest, we process different categories of personal data:

A. Buyers of CO2 Removal Certificates (CORCs) (Business and private)

Contact details (name, email address, phone number).

Company details (company name, business address, job title, Chamber of Commerce number, VAT number).

Financial data (bank account number, credit card details, billing address, transaction IDs).

Transaction history (purchased service volume, transaction date, allocated CORC certificates, and unique registry serial numbers).

B. Project partners and Landowners (Partners with whom we develop projects)

Contact details of the owner or representative (name, job title, email address, phone number).

Company details (company name, Chamber of Commerce number, website, address, project address).

Location and cadastral data (exact GPS coordinates of the storage sites, cadastral data to verify land ownership and formally transferred carbon removal rights).

Financial data (bank details for contractual payments owed under the agreement).

C. Website visitors

IP address, browser type, and unique device IDs.

Information about your browsing behavior on our website via analytical and tracking cookies. (For more detailed information about which specific cookies we place, for how long, and via which third parties, please refer to our Cookie Statement).

Data you voluntarily leave via contact forms (name, email address, content of your message).

3. Purposes and legal bases for processing

We process personal data exclusively on the basis of the lawful bases under the GDPR:

A. Performance of a contract (Article 6(1)(b) GDPR): Processing orders and delivering verified carbon removal services. Registering, allocating, and transferring CORCs in national and international carbon registries. Executing cooperation agreements with landowners, including the administration of rights transfers and financial compensation. Please note: if you do not provide the personal data necessary for an agreement (such as contact or payment details), we cannot conclude or perform the agreement.

B. Legal obligation (Article 6(1)(c) GDPR): Complying with tax obligations and maintaining proper and verifiable accounting records in accordance with the requirements of the Tax Authorities (including correct VAT administration).

C. Legitimate interest (Article 6(1)(f) GDPR): Monitoring and verifying the underground storage locations (via satellite imagery and public groundwater level measurements) to independently demonstrate permanence to accredited carbon registries. An internal balancing test is documented for these purposes. Furthermore: cooperating with compliance processes, audits, and due diligence investigations, and securing our website, networks, and systems against abuse or online fraud.

D. Consent (Article 6(1)(a) GDPR): For placing non-functional cookies (such as analytical or marketing cookies) and for publishing customer-specific case studies, sustainability claims, or marketing materials in which personal or company names are explicitly mentioned. You have the right to withdraw this consent at any time.

4. Data Sharing with Third Parties

Underground Forest only shares your data with third parties when strictly necessary for the provision of our services, ecological verification, or to comply with international compliance standards. We share data with, among others:

Carbon registries: Data is shared with independent, accredited carbon registries to officially certify CORCs, assign unique serial numbers, and prevent double counting in the market.

Verification bodies: Independent auditors who check the validity, additionality, and Life Cycle Assessment (LCA) of our projects for registry accreditation purposes.

Operational partners: External parties essential to the physical chain, such as forestry partners, engineering firms, transport companies, and local contractors.

Service providers (Processors): IT suppliers, hosting parties, international payment service providers, and our accountants.

Government authorities: The Dutch Tax Authorities or competent supervisory authorities if we are legally obliged to do so.

Advertising and analytics platforms: Google and LinkedIn, for website analytics and marketing purposes, based on your cookie consent

International data transfers (Outside the EEA)

Some of our partners, such as international carbon registries or IT suppliers, may be located outside the European Economic Area (EEA). In such cases, we ensure that the transfer of personal data is always subject to appropriate safeguards, in accordance with Chapter V of the GDPR. This means that we only transfer data to countries with an adequacy decision from the European Commission, or we use Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by any necessary security measures.

5. Retention periods and ecological integrity

Underground Forest does not retain your personal data for longer than is necessary for the purpose for which it was collected, or to comply with applicable legal obligations. We apply the following retention periods or criteria to determine them:

Tax and financial administration: Personal and company data linked to the financial administration (invoices, payments) are kept for a statutory minimum of seven (7) years.

Customer contact and contract management: Data of buyers or leads is kept for the duration of the relationship or agreement and up to a maximum of two (2) years after the termination of the active business relationship.

Website and Contact forms: Data sent via contact forms is kept for as long as the nature of the form or email requires for a complete response and handling (usually deleted after a maximum of 1 year).

Project, Project Location, and Credit data: Because our projects are designed to ensure long-term permanence and are subject to continuous monitoring, location data of storage sites, landowner names, and the allocation registries of CORCs are kept for the operational lifetime of the project plus the additional retention period required by the standards of the international carbon registries. This long-term storage is necessary to prove the "unbroken chain of custody" and prevent double counting during the project's lifespan. This period is periodically reviewed against current requirements.

6. Security and processing of your data

We take appropriate technical and organizational measures to protect your personal data against loss, theft, or any form of unlawful processing. Access to your data is strictly limited to authorized employees of Underground Forest and our verified processors. Data exchange via our website takes place via secure, encrypted connections.

Automated decision-making: We do not use automated decision-making and/or profiling (within the meaning of Article 22 GDPR) in our data processing activities.

7. Your privacy rights

Under the GDPR, you have various rights regarding the personal data we process about you:

Right of access: You have the right to request an overview of the personal data we process about you.

Right to rectification: Is something incorrect? You can request us to adjust or supplement your data.

Right to erasure ("right to be forgotten"): You can request us to delete your data. Please note: this right is not absolute. In accordance with Article 17(3) of the GDPR, we may refuse a request if further processing is necessary for compliance with a legal obligation (such as our statutory tax retention obligation) or for the establishment, exercise, or defense of legal claims (for example, demonstrating the chain of custody and environmental integrity of projects).

Right to restriction of processing: You can temporarily pause the processing, for example, if you dispute the accuracy of the data.

Right to object: You have the right to object to the processing of your data based on our legitimate interest. Specifically for direct marketing: If we process your personal data for direct marketing purposes, you have the right to object to this unconditionally at any time. We will then immediately cease processing for that purpose.

Right to data portability: You can request us to transfer your data in a structured and commonly used format to yourself or another party.

Right to withdraw consent: When the processing is based on your consent, you have the right to withdraw this consent at any time. This does not affect the lawfulness of the processing before the withdrawal.

To exercise any of these rights, you can send an email to info@undergroundforest.nl. We will respond within one (1) month of receiving your request. Depending on the complexity and the number of requests, this period may be extended by another two (2) months if necessary. We will inform you of any extension within one month.

8. Changes to this Privacy Policy

Underground Forest reserves the right to modify this Privacy Policy from time to time, for example, when our operational systems, affiliated (international) registries, or applicable laws change. We therefore advise you to consult this page regularly. In the event of major changes, we will inform you directly via email.

9. Contact and Complaints

If you have any questions about this Privacy Policy or the way Underground Forest handles your data, you can contact us via info@undergroundforest.nl.

If you believe that we are not processing your data in accordance with privacy legislation, you also have the right to file a complaint with the national supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens - AP).