How we handle your data

Who we are

Carbonbit Limited runs the Standpoint platform. For the personal data described here, Carbonbit is the data controller. You can reach us through the messages area of your workspace, or via the contact details published on carbonbit.tech.

Our registered office is Jubilee House, East Beach, Lytham St Annes FY8 5FT. [Registered company number to be added.]

What we collect, and why

Your name and email address: to put a real person's name on your roadmap's record (provenance), to send you your roadmap, and so your named consultant can contact you about it. This is processing needed to take the steps you have asked for and to deliver the service (UK GDPR Article 6(1)(b)).

Your LinkedIn profile, only if you choose to give it: so the consultant advising you knows who they are advising before the first conversation. It is optional, and leaving it blank changes nothing about the service.

Answers about your business: sector, size, activities and similar. These drive the applicability rules that build your roadmap. Most of this is business data rather than personal data, but where it identifies a person we treat it with the same care as everything else here.

Evidence you upload (bills, certificates, reports): to build the outputs you ask for. Uploads are reviewed by a named consultant before anything is produced from them.

Your organisation's logo, only if you upload it and only with your recorded agreement: it appears on documents we prepare for you, and nowhere else. You can withdraw that agreement at any time.

Your mobile number, once you are asked for it: to send you a text reminder before your trial ends and any payment is taken, alongside the same reminder by email. We use it for this and for other important account notices only. It is not used for marketing calls or texts.

Payment card details, once you are asked for them: to hold on file during your trial and to take payment automatically when your trial ends, unless you have cancelled. We do not store your card details ourselves: our payment processor, Stripe, holds them under its own security standards and only acts on our instructions.

How you heard about Standpoint, if you choose to tell us, once your account is confirmed: to understand which channels actually bring people to the platform. It is entirely optional, answering it changes nothing about your account or service, and we never ask again once you have answered (or skipped) it.

The legal basis for each of these

UK GDPR requires us to tell you not just what we collect but why we are allowed to. In short: your name, email, business answers and evidence are processed because you have asked us to provide the service and we cannot do that without them (contract, Article 6(1)(b)). Your mobile number and payment details are processed for the same reason, plus to meet our own accounting and tax obligations (legal obligation, Article 6(1)(c)). Your LinkedIn profile and your organisation's logo are processed only with your consent (Article 6(1)(a)), and you can withdraw that consent at any time without affecting anything else. Telling us how you heard about Standpoint is also consent-based, and skipping it changes nothing. Where we look you or your organisation up on the Companies House register, that is our legitimate interest in confirming who we are dealing with (Article 6(1)(f)), balanced against your right to know we have done it, which is why we always tell you.

Nothing is stored until you save

The get-started journey is anonymous end to end. Your answers live in the page's own link, on your device, and we hold nothing until you choose to save your roadmap. Close the page without saving and nothing about you rests with us.

Because the link carries your answers, treat it like the personal information it contains: share it only with people you would share those answers with.

Where your data comes from besides you

If you give us a company name or number, we may look it up on the Companies House public register to save you typing and to confirm identity details. We tell you when we have done this, and register data is always confirmed with you rather than silently applied.

Who sees it

Your named consultant and the Carbonbit advisory team working on your account. The infrastructure providers that host and run the platform process data on our behalf under contract, and only on our instructions. Stripe processes your payment details on our behalf, under contract, and only on our instructions. Stripe has its own privacy notice covering how it handles payment data, available at stripe.com/privacy.

We do not sell personal data, and we do not share it with anyone for their own marketing.

Who is the controller of your data

For almost everything on this page, Carbonbit is the Controller of your personal data: we decide why and how it is processed, and this notice describes that relationship.

There is one specific case where it is different. If you are a contact of one of our clients (for example, a landlord asked to respond to a data request on a client's behalf through Standpoint), our client is the Controller of your personal data, and Carbonbit is the Processor, acting only on that client's documented instructions. Our client is responsible for having a lawful basis to ask you for that information and for telling you why. We handle it securely on their behalf, keep it only for as long as they need us to, and do not use it for any purpose beyond providing the service to them. If you have a question about why you were asked for this information, your first point of contact is the organisation that asked you, though we are happy to help you find the right person if you are not sure who that is.

Carbonbit's ICO registration is in progress. We will publish our registration number here once it is confirmed.

Questions about your personal data go to our Data Protection Officer, through the messages area of your workspace or the contact details published on carbonbit.tech.

Where your data is processed

[We are confirming exactly where this data is processed and under what safeguard, and will complete this section before relying on it: do not remove this bracket or replace it with an assumed answer.]

Automated processing and AI

Standpoint uses automated tools, including AI, to help organise information, draft suggested content, and flag what is outstanding: for example the platform's AI assistant personas, and tools that suggest applicable requirements or draft summaries for a consultant to review. None of this produces a decision about you or your organisation with legal or similarly significant effect based solely on automated processing (UK GDPR Article 22): a named human consultant reviews outputs before they are finalised, and AI-assisted content is never presented to you as if a person wrote it without saying so. Where a page or message is generated with AI involvement, that is disclosed on the page itself.

How long we keep it

While your workspace is active, your records are kept so your roadmap, evidence base and outputs stay usable and auditable. Compliance records are append-only by design: corrections are recorded as new versions rather than silent edits, because the outputs we prepare for you must remain traceable.

If you ask us to close your workspace, we delete your personal data except where a legal obligation, or the audit trail behind an output you have already relied on, requires a record to be retained. Where that applies we tell you what is kept and why.

Keeping your data secure

We use technical and organisational measures appropriate to the risk: access controls limiting who can see your data to your named consultant and the advisory team working on your account, encryption of data in transit, and contracts with our infrastructure providers requiring them to protect data to at least the same standard. No system is perfectly secure; if something goes wrong that is likely to put you at risk, we will tell you and the ICO without undue delay, as the law requires.

Your rights

You can ask to see the personal data we hold about you, correct it, have it deleted, restrict or object to its processing, receive it in a portable form, and withdraw any consent you have given (such as logo use) at any time. Ask through your workspace messages or the contact details on carbonbit.tech, and we will respond within one month.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ico.org.uk).

Cookies and similar technology

[We are confirming exactly what this platform sets and will complete this section before relying on it: do not remove this bracket or replace it with an assumed answer.]