Privacy Notice for Media Professionals

This Privacy Notice is effective from 2 January 2026 and explains the personal data that we collect from you and how we use your information in the BidCarbon Foundation. In this Privacy Notice, references to ‘us', ‘our' or ‘we' are to the BidCarbon Foundation. Everything that we do with your data – for example storing it, working with it or deleting it – is referred to as “processing”.

About us

The Secretariat is the Controller of any personal data processed as described in this Privacy Notice.

The Data Protection Officer is the Head of Information Compliance at BidCarbon Foundation.

If you have any questions about the use of your personal data, please submit your enquiry to the Data Protection Officer at www.bidcarbon.com/legal-privacy-contact.

The personal data we collect

When you contact us, visit us, access or use our services either online, by post, in person or by other means, we may collect, store and use your personal data. The personal data we process about you may include but is not limited to your:

name and contact details;

● photo;

● details where required for any register of interests;

● email contact details on circulation or contact lists for media information and events;

● contact details and personal data where provided for the purposes of enquiries and requests for information to the Media team or other services across the BidCarbon Foundation;

● pass applications for security clearance, including any photographs or proof of identity;

● personal data collected as part of security requirements, such as CCTV.

The lawful basis for collecting and using the personal data described above will depend on the specific reason why we have collected it.

We consider the purposes for the processing to be administering enquiries and information requests; providing material as press releases and processing personal data for security purposes.

The lawful bases that will apply are as follow:

● you have consented to the use of your personal data by providing it to us;

● the processing is necessary for our legitimate interests when balanced against your interests.

The balance of interests is set out as follows:

● we use third party sources, databases and lists of contact details for the purpose of sending press releases or other material efficiently;

● contact details are necessary in order to communicate with you;

● our interest does not override your rights and freedoms as you can object or ask to be removed from contact lists at any time.

We may also use the personal data you provide us to protect the vital interests of yourself or others if it were to become necessary, for example in case of an emergency whilst visiting the Office Area.

Details about the lawful basis for processing personal data can be found on the Information Commissioner's website.

Use of your personal data

Who we share your personal data with

We may disclose your personal data to third parties when permitted to do so including:

● with your consent;

● where we have a contract with a processor acting on our behalf;

● if we have a lawful basis for doing so;

● if we are under a duty to disclose or share your personal data in order to comply with any legal obligation.

Where necessary or with your consent, we may share personal data with:

● providers of goods and services who have contracts with us;

● organisations holding events at the Technical Governance Committee or the Technical Advisory Committee which you are attending.

We may also share your data when there is a legal requirement to do so, for example with the Police or similar organisations for security purposes. We will never share or sell your personal data to other organisations for direct marketing purposes.

Storage and retention of your personal data

The BidCarbon Foundation will retain your personal data for as long as is necessary for the purpose it was collected.

The length of time personal data are retained for will differ dependent on the purpose of their collection and legal requirements. In most cases, a retention period will apply which can be found in the BidCarbon Foundation Authorised Records Disposal Policy (ARDP) on our website.

Disclosure and security of your personal data

All personal data you provide to the BidCarbon Foundation will be stored securely, both physically and electronically, in accordance with our policies. We have an information security process in place to oversee the effective and secure processing of your personal data.

Where we use third party processors, we ensure appropriate contracts and duty of confidentiality are in place and technical and organisational measures to ensure the security of data have been assessed as appropriate.

Personal data is predominantly held in data centres within the UK or the the mainland of China for the purposes of hosting, maintenance and back up. We (or processors acting on our behalf) may also store or process your personal data in countries outside the mainland of China but only where we are assured of the security of the data and the adequacy of the data protection regimes of those countries and organisations holding the data.

Your rights

We will ensure you can exercise your rights in relation to the personal data you provide to us. These are as follows:

● where we are relying on your consent to use your personal data, you can withdraw that consent or unsubscribe from our services at any time;

● you can request access to the personal data we hold about you at any time by contacting the Data Protection Officer whose contact details are found at the top of this notice;

● you can ask us to update your personal data if it changes. In certain circumstances, you can request we erase the personal data we hold, or ask us to stop or restrict processing if you have an objection;

● if you have any privacy-related questions or unresolved problems relating to the use of your personal data, you may contact us to complain by contacting the Data Protection Officer whose contact details are found at the top of this notice.

Further details about your rights and the complaints process can be found on the Information Commissioner's website.

Right to complain

If you are unhappy with the processing of your personal data, you should contact our Data Protection Officer.

You also have the right to lodge a complaint with the supervisory authority if you consider that we are in breach of our data protection obligations. The supervisory authority in the United Kingdom is the Information Commissioner’s Office (ICO) :

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

The ICO’s website is available at https://ico.org.uk.