Privacy Policy

Prime Origins Limited ("Prime Origins", "we") operates Prime Origins Atlas at https://primeoriginsatlas.org. We are the data controller for personal data collected through the marketplace. Contact for privacy queries: oliver@primeorigins.org.

We collect the following categories of personal data:

• Contact details — name, email, phone, organisation — when you submit an inquiry, seller application, or purchase credits.
• Transaction data — billing information, order details, retirement preferences — processed by Stripe on our behalf.
• Project documentation (sellers only) — files you upload for verification of carbon credit projects.
• Technical data — IP address, browser type, device, pages visited — via Vercel Analytics and standard server logs.

We process personal data on the following bases under UK GDPR / EU GDPR:

• Contract — to provide the marketplace services you request (browsing, purchase, retirement, seller listing).
• Legitimate interest — to operate, secure and improve the marketplace, including analytics and fraud prevention.
• Legal obligation — to meet our regulatory and tax obligations.
• Consent — for optional marketing communications, withdrawable at any time.

We share personal data only with the following categories of recipient, each bound by data-processing agreements:

• Stripe — payment processing
• Vercel — hosting, analytics, file storage (Vercel Blob)
• Carbon registries (Verra, Gold Standard, ACR, Puro.earth, Climate Action Reserve) — to retire credits on your behalf where you request retirement
• Professional advisers — legal, accounting, regulatory
• Authorities — where legally required

We do not sell personal data.

Some of our processors (notably Stripe and Vercel) are based outside the UK/EEA. Where data is transferred internationally we rely on adequacy decisions or Standard Contractual Clauses to ensure equivalent protection.

We retain personal data only for as long as necessary for the purposes set out above, or as required by law. Order and tax records are retained for 7 years. Marketing contacts are retained until you unsubscribe. Inquiry records are deleted within 24 months of last contact unless ongoing business interest requires longer retention.

Under UK GDPR / EU GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Request erasure (subject to legal retention obligations)
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent for marketing at any time

Exercise any of these rights by emailing oliver@primeorigins.org. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

We use a small number of strictly necessary cookies for site functionality and, with your consent, analytics cookies via Vercel Analytics. See our Cookie Policy for details.

We use industry-standard technical and organisational measures including HTTPS encryption, access controls, and audit logging. No system is perfectly secure — if you believe an incident has occurred please contact oliver@primeorigins.org immediately.

The marketplace is not directed at children under 18 and we do not knowingly collect personal data from them.

We may update this Privacy Policy from time to time. The current version is always available at https://primeoriginsatlas.org/privacy with the "last updated" date shown above.