Privacy Policy | Ecoffset

Last updated: 12 October 2026

Ecoffset (“we”, “us”, “our”) is a trading name of CG Green Solutions Ltd, a company registered in England and Wales with company number 12581125 and registered office at Profile West, Suite E, Ground Floor, 950 Great West Road, Brentford, TW8 9ES. We are committed to protecting your personal data. This Privacy Policy explains what personal data we collect when you visit ecoffset.com, contact us or use our carbon offsetting services, why we collect it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is responsible for your data

CG Green Solutions Ltd is the data controller for the personal data described in this policy.

Postal address: CG Green Solutions Ltd, Profile West, Suite 2, Floor 1, 950 Great West Road, Brentford, TW8 9ES, United Kingdom
Email: [email protected]

2. Personal data we collect

Contact details: your name, email address, phone number, job title and organisation when you email us or request a proposal.
Offsetting and order details: the activities or emissions you ask us to offset (for example travel, events or business activity), the projects you choose, the quantity of carbon credits purchased and the details needed to issue your certificate.
Certificate and retirement details: the name of the person or organisation on whose behalf carbon credits are retired, which may be shown on your certificate and on the public registry of the certification standard (such as Verra or Gold Standard).
Billing details: billing name and address, VAT number and payment records. If you pay by card, your card details are processed by the payment provider and we do not see or store full card numbers.
Business information for reporting: for corporate clients, the information you share with us to prepare impact reports, such as emissions figures and company details.
Technical data: when you visit our website, our hosting provider processes technical data such as your IP address, browser type and the pages requested, to deliver the website and protect it from abuse.

Most of this data comes from you. If your employer or another person orders an offset or a certificate in your name, or gives us your details as their contact, we receive your name and contact details from them.

3. How we use your data and our legal basis

To answer your enquiries and prepare proposals: our legitimate interest in responding to you, or steps taken at your request before entering into a contract.
To provide our services: purchasing and retiring carbon credits on your behalf, issuing certificates and preparing impact reports (performance of our contract with you or, where you act for an organisation or are named on a certificate ordered by someone else, our legitimate interest in delivering the service that was ordered).
To invoice and keep accounting records: legal obligation.
To send updates about our services: your consent or, for existing business clients, our legitimate interest in telling them about similar services. You can opt out at any time.
To keep our website secure and working: our legitimate interest in keeping the website available and protecting it from attacks and misuse.
To comply with the law and respond to lawful requests from authorities: legal obligation.

You do not have to give us any personal data to browse our website. If you want us to answer an enquiry or provide our services, we need your contact details and the information required to retire credits and issue your certificate; without them we cannot provide the service. Billing details are needed to meet our legal accounting obligations.

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

4. Cookies

Our website does not use advertising, analytics or tracking cookies, and it does not load third-party trackers. Our hosting and security provider may process technical data, as described in section 2, to protect the website. If we ever introduce non-essential cookies, we will ask for your consent first and update this policy.

5. Who we share your data with

We do not sell or rent your personal data. We share it only where needed to provide our services or meet legal obligations, with:

carbon credit registries and certification standards (such as Verra and Gold Standard) and project developers, to retire credits on your behalf;
payment providers and banks, to process payments;
IT and service providers who host our website and email (for example Cloudflare and Microsoft), under contracts that protect your data;
our accountants and professional advisers;
regulators, law enforcement or courts, when required by law.

6. International transfers

Some of our providers, and some registries and project developers, are located outside the UK. Where personal data is transferred outside the UK, it is protected by UK adequacy regulations (including the UK–US data bridge) or by the UK International Data Transfer Agreement or Addendum. Where none of these applies, we transfer data only when this is necessary to perform our contract with you, or a contract made in your interest (for example, recording a retirement on a registry outside the UK). You can ask us for details of the safeguards used by emailing [email protected].

7. How long we keep your data

Enquiries that do not lead to a contract: up to 2 years after our last contact.
Client, order and certificate records: for as long as we provide services to you and for 6 years afterwards, to meet accounting and legal obligations.
Retirement records on public registries are kept by the registries under their own policies and are normally permanent, because they prove that each credit has been used only once.
Technical data: we do not keep website logs ourselves; our hosting provider keeps them only for the short period it needs for security and operation, under its own retention policy.
Marketing contacts: until you opt out; we then keep only a minimal record so that we do not contact you again.

8. Your rights

Under UK GDPR you have the right to:

access the personal data we hold about you;
ask us to correct inaccurate data or complete incomplete data;
ask us to erase your data, where there is no legal reason for us to keep it;
object at any time to our use of your data where we rely on legitimate interests, and to direct marketing (we will stop direct marketing as soon as you ask);
ask us to restrict how we use your data;
receive the data you gave us in a portable format, where we process it on the basis of your consent or a contract;
withdraw your consent at any time, where we rely on consent.

To exercise any of these rights, email [email protected]. We will reply within one month or, if your request is complex, tell you within that month that we need up to two more months. If you have a complaint about how we use your data, email us: we will acknowledge it within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk (opens in a new tab), by phone on 0303 123 1113 or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, although we would welcome the chance to address your concerns first.

9. Security

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including encrypted connections (HTTPS) and restricted access to our systems.

10. Children

Our services are not directed at children under 16, and we do not knowingly collect their personal data.

11. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page, with the date it was last updated.

12. Contact us

If you have any questions about this Privacy Policy or how we handle your data, contact us at [email protected] or write to CG Green Solutions Ltd, Profile West, Suite 2, Floor 1, 950 Great West Road, Brentford, TW8 9ES, United Kingdom.