Consent to Personal Data Processing
for the websites and digital services of the 7G CarbonPlatform ecosystem
Version dated September 12, 2026
This Consent sets out the terms for processing the personal data of users of the public websites and user account of the 7G CarbonPlatform ecosystem. It applies together with the Privacy Policy and must be made available to the user before submitting a form or registering.
1 Operator Information
| Operator | HPBS Limited Liability Company |
| Postal address | Tashkent, 64A Labzak Street |
| TIN | 310758277 |
| Personal data contact | privacy@carbonplatform.asia |
This Consent applies to carbonplatform.asia, carbonfin.asia, carbonmodel.asia, carboncbam.asia, carbonmarket.asia, 7G.carbonplatform.asia, as well as official subdomains, forms, and mobile versions of these resources where the interface contains a link to this Consent.
2 Data Subject Statement
I freely, voluntarily, and in my own interest give HPBS LLC my consent to process my personal data to the extent and for the purposes specified below. I confirm that I provide accurate data, have read the Privacy Policy, and understand the consequences of giving this Consent.
3 Personal Data
- surname, first name, and patronymic, where requested by the relevant form;
- telephone number, email address, and preferred method of communication;
- job title, place of employment, organization name, and information on the authority of its representative;
- account identifier, authentication information, selected language, and profile settings;
- the content of inquiries, applications, support requests, correspondence, and information voluntarily provided in attached files;
- technical data: IP address, cookies and similar identifiers, device and browser type, date and time of access, login and activity logs, and referral source;
- information on the use of services, tariff plan, orders, contracts, and payment status, without the Operator storing full bank card details.
The Operator does not request sensitive, biometric, or genetic personal data through ordinary website forms. If a specific function requires such data, the Operator obtains separate consent in the form prescribed by law.
4 Purposes of Processing
- registration, identification, and management of the user account;
- providing access to GHG, PCAF, MRV, CBAM, Market products and related registries;
- processing applications, preparing proposals, entering into and performing contracts, issuing invoices, and providing client support;
- responding to inquiries, providing technical support, and issuing notifications concerning service operation and information security;
- protecting accounts, preventing misuse, investigating failures, and maintaining audit logs;
- analyzing and improving the operation of websites and services using aggregated and, where possible, anonymized data;
- complying with legal requirements and protecting the legitimate rights of the Operator and users.
5 Processing Operations and Methods
The Operator may collect, record, systematize, accumulate, store, clarify, modify, supplement, retrieve, use, provide to authorized processors, transfer, anonymize, block, and destroy personal data. Processing may be carried out by automated and non-automated means, including combined processing.
Automated processing may be used for request routing, access management, detection of suspicious activity, analytics, and interface personalization. Decisions that produce legal consequences for the user or otherwise materially affect their rights are not made solely by automated means without a separate lawful basis and the necessary safeguards.
6 Data Transfers
For the purposes specified above, the Operator may engage providers of hosting and cloud infrastructure, CMS and CRM systems, authentication, email and notification services, analytics, technical support, backup services, payment organizations, auditors, and consultants to process data. Only the data necessary for the relevant purpose is transferred, and access is granted on the basis of a contract requiring confidentiality and compliance with security requirements.
Cross-border transfers are permitted only in compliance with the requirements of the legislation of the Republic of Uzbekistan, including rules concerning adequate protection, applicable contractual safeguards, and other lawful grounds. Where data is transferred to a country without a recognized adequate level of protection and the data subject’s consent is required, this Consent includes consent to such transfer only to the extent necessary for the service selected by the user and subject to prior information about the relevant recipient or category of recipients.
7 Validity Period and Retention
This Consent remains valid from the date it is given until the stated purposes of processing have been achieved or until it is withdrawn, unless longer retention is required by law, contract, or for the protection of lawful claims. Once the lawful grounds for processing cease to apply, the data is destroyed or anonymized in accordance with the established procedure. Information confirming the fact of consent and the user’s actions may be retained for the period necessary to comply with legal requirements and protect the Operator’s rights.
8 Data Subject Rights and Withdrawal of Consent
I have been informed that I have the right to:
- obtain information about the existence, categories, legal grounds, purposes, methods, and retention periods of my personal data;
- request correction, temporary suspension of processing, or destruction of data in the cases provided by law;
- withdraw consent by the same method by which it was provided, or by submitting a written or electronic request to the Operator;
- apply to the competent government authority or a court to protect my rights.
A withdrawal request may be sent to privacy@carbonplatform.asia or to the Operator’s postal address. The request must include information sufficient to identify the applicant and the relevant account or inquiry. Withdrawal does not affect the lawfulness of processing carried out before it was received and does not terminate processing where the Operator continues to have another lawful basis.
9 Form of Consent
Consent is deemed to have been given when the user independently selects a checkbox that is not pre-selected and subsequently clicks the button to submit the form, register, or continue using the service. The electronic record of consent must contain the date and time, version of the text, page address, form or account identifier, and other technical information sufficient to confirm that consent was obtained.
10 Separate Consent to Marketing Communications
Receiving advertising and marketing communications is not a condition of registration or use of the platform’s core functions. Such communications require separate voluntary consent:
☐ I agree to receive from HPBS LLC news, invitations, product offers, and event information by email and telephone. I may unsubscribe at any time using the link in the message or by contacting the Operator.
11 Recommended Text for Website Forms
☐ I consent to HPBS LLC processing my personal data in accordance with the Consent and confirm that I have read the Privacy Policy.
The words “Consent” and “Privacy Policy” must be active links and must be accessible before the form is submitted.
12 Confirmation for Paper Forms
| Full name | ____________________________________________ |
| Document or other identifier | ____________________________________________ |
| Contact details | ____________________________________________ |
| Date | “____” ______________ 20____ |
| Signature | ____________________ / ____________________ |
Legal Framework
Law of the Republic of Uzbekistan “On Personal Data” dated July 2, 2019 No. ZRU-547, as amended, including amendments introduced by Law No. ZRU-1125 dated March 26, 2026.