Carbon Fix Privacy Policy

Policy Statement and Objective

Carbon Fix has adopted this Policy to ensure that it collects, holds, uses and discloses personal information, credit information, credit eligibility information, and credit reporting information in accordance with the APPs and the Act.

This Policy applies to all dealings between you and Carbon Fix.

Carbon Fix will maintain and regularly review this Policy and intends to comply with the APPs and the Act. Carbon Fix may notify you about changes to this Policy by posting an updated version on its website. Carbon Fix encourages you to check its website from time to time to ensure you are familiar with its latest Policy.

This Policy will be made available on the Carbon Fix website (but may be requested in other forms). You may also request a printed copy, which will be provided free of charge and within a reasonable timeframe.

Definitions

Act means the Privacy Act 1988 (Cth).

APPs means the Australian Privacy Principles set out in Schedule 1 of the Act.

Carbon Fix means Carbon Fix Pty Ltd (ABN 69 645 209 258) and its related bodies corporate as defined by the Corporations Act 2001 (Cth). This Policy does not extend to any related bodies corporate that have a separate policy dealing with privacy.

Government related identifier has the same meaning as in the Act.

Joint Ventures and Service Partners means entities to whom Carbon Fix distributes products or services on an exclusive or preferential basis as part of its general service offering, and to whom Carbon Fix is required to provide personal information so they can manage those products or services for you.

Personal information has the same meaning as in the Act.

Sensitive information has the same meaning as in the Act.

Service Provider means any third party that Carbon Fix engages (or enters negotiations with a view to engaging) to provide services to support the Carbon Fix business.

PART 1 – CONSIDERATION OF PERSONAL INFORMATION PRIVACY

Personal Information is defined in the Act to mean any information or opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not.

Carbon Fix collects personal information which is reasonably necessary to:

consider applications for carbon projects;
maintain your account and contact details;
process transactions to which you are a party;
advertise, promote and provide you with products or services distributed by Carbon Fix; and
improve our website and web services.

Note: When you visit the Carbon Fix website, our internet Service Provider records the following information: your IP address; the date, time and duration of your visit; the number of pages you have downloaded; and the type of browser you use. Google Analytics demographic and interest reporting may be used to develop specific offers or advertising from time to time.

Carbon Fix may ask for personal, business and contact details along with financial information (including details of assets and liabilities). Carbon Fix may also ask you for your bank account details and, where relevant, your ANREU account details and ACCU holdings. Carbon Fix will generally do this by asking you to complete an application form. Carbon Fix may also ask you for this or similar information personally.

Such information will only be collected by lawful and fair means. Information collected will be held either in hard copy or electronically.

Anonymity and pseudonymity

Carbon Fix will allow its customers to transact with it anonymously or by using a pseudonym, wherever that is reasonable and practicable.

However, this will not be possible if Carbon Fix is required or authorised by Australian law or other instrument (such as an order of a court or tribunal) to deal with customers who have been appropriately identified or where it is impracticable for Carbon Fix to deal with individuals who have not identified themselves or who would prefer to use a pseudonym. Examples include:

when you transact using your Carbon Fix account;
when KYC and AML/CTF identification is required by law; and
where you are contracting with a third party (for example, when you enter into a contract to sell ACCUs to a counterparty).

PART 2 – COLLECTION OF PERSONAL INFORMATION

Collection of solicited information

Carbon Fix will only collect personal information from you if it is reasonably necessary to provide goods or services to you (including on credit) or undertake ancillary functions for you. Carbon Fix will only collect information for the purposes for which Carbon Fix advised you it was collecting it, or a related purpose which would reasonably be expected, or otherwise with your permission.

For example, Carbon Fix may from time to time use your personal information to provide information about products, services, promotions and campaigns which it expects may be of interest to you. Generally, Carbon Fix collects personal information through account opening / application forms, contracts to which you are a party, and other forms completed by you when dealing with Carbon Fix.

Carbon Fix may also collect your information to do one or more of the following:

enter into a carbon project;
facilitate the trading of Australian Carbon Credit Units (ACCUs);
process transactions on your behalf;
conduct KYC and AML/CTF checks as required by law;
notify you of any products or services distributed by Carbon Fix that may be of interest to you (including products or services offered by Joint Ventures and Service Partners);
enable Carbon Fix to meet its obligations under certain laws or pursuant to court documents (subpoenas or orders) that are served on Carbon Fix;
comply with its obligations under the Corporate Authorised Representative arrangement with True Oak Investments Pty Ltd;
any purpose for which the information was requested and any directly related purpose; or
develop, improve and market products and services.

Any disclosure (if any) will only occur by lawful means.

Carbon Fix will generally not be required to collect sensitive information about you. Carbon Fix will only do so if it is reasonably necessary for Carbon Fix to collect such information to perform its functions or activities and you consent, or another circumstance is provided for that enables that to occur (such as collection being required or authorised under an Australian law or by order of a court or tribunal).

Cookies and website tracking

Our website uses cookies to analyse website traffic and help provide a better visitor experience. A cookie is a text file containing small amounts of information which is downloaded to your device when you access a website. This information may include your internet protocol (IP) address, information and actions taken on the site, and details about when you accessed the site. The text file is sent back to Carbon Fix’s server each time your browser requests a page from the server. Information generated by cookies about the use of the website may be transferred to, and stored by, a web analytics service from a Service Provider to help improve online services. A Service Provider may be based overseas. You can configure your browser to reject cookies, but this may affect the functionality of the website.

Dealing with unsolicited personal information

If Carbon Fix receives personal information about you from a source other than you, or it is information provided by you which Carbon Fix did not request, Carbon Fix will determine, within a reasonable period, if it could have collected such personal information under APP 3. If Carbon Fix determines that it could have collected the information under APP 3, Carbon Fix may then use, and treat, that information as if it had collected the information in that manner. If Carbon Fix determines that it could not have collected the information under APP 3 and so long as it is lawful and reasonable to do so, it will destroy or de-identify that information as soon as practicable.

Notification of the collection of information

When Carbon Fix is collecting personal information and credit information about you, Carbon Fix will take reasonable steps to notify you, either at or before the time of collection, or as soon as reasonably practicable after collection, why Carbon Fix is collecting such information (which may have already been outlined in a contract with you). This is particularly relevant if Carbon Fix collects information about you from someone other than yourself. For example, Carbon Fix may receive personal information about you from a credit reporting agency.

Carbon Fix will also take steps that are reasonable in the circumstances to, among other things, make it clear to you if it is required to collect such information by reason of an Australian law or some other legal instrument (such as a court or tribunal order), why it is collecting such information, and the potential consequences for you if such information is not collected.

PART 3 – DEALING WITH PERSONAL INFORMATION

Use or disclosure of information

Carbon Fix collects personal information from you for a specific reason as described in APP 3. This is referred to as the primary purpose. Carbon Fix will not use or disclose the collected information for a secondary purpose unless you consent to Carbon Fix doing so, or under the circumstances involved, Carbon Fix believes you would reasonably expect Carbon Fix to use or disclose the information for a secondary purpose related to the primary purpose.

In the event that Carbon Fix holds sensitive information about you, Carbon Fix will only use or disclose that information with your consent or if the use or disclosure is otherwise permitted under the APPs or the Act, such as where the use or disclosure is directly related to the primary purpose and within your reasonable expectations.

Carbon Fix may also disclose your personal information or sensitive information if it is required to do so by an Australian law, by order of a court or tribunal, or if Carbon Fix reasonably believes that the use or disclosure of the information is reasonably necessary for an enforcement related activity by or on behalf of an enforcement body, in which case Carbon Fix will make a written note of the use or disclosure. A disclosure may also be made where a permitted general situation or permitted health situation exists as provided for in the APPs.

Carbon Fix may disclose personal information to:

counterparties to a trade (to the extent necessary to facilitate the transaction);
the Clean Energy Regulator (CER) and the Australian National Registry of Emissions Units (ANREU);
AUSTRAC, where required by AML/CTF reporting obligations;
ASIC, where required by AFS Licence obligations;
True Oak Investments Pty Ltd, in its capacity as Licensee, for compliance and regulatory purposes as required under the Corporate Authorised Representative Agreement;
professional advisers (lawyers, accountants, auditors) on a need-to-know basis; and
Service Providers, including IT and cloud storage (Microsoft 365), customer relationship management (HubSpot), AI-assisted analysis and drafting (Anthropic / Claude), and website analytics providers.

Data sharing with True Oak Investments Pty Ltd

As a Corporate Authorised Representative of True Oak Investments Pty Ltd (CAR No. 001320719), Carbon Fix may share personal information with True Oak for the purposes of:

compliance monitoring and reporting;
regulatory oversight and supervision;
risk management; and
responding to regulatory inquiries.

True Oak Investments Pty Ltd is bound by equivalent privacy and confidentiality obligations.

Service Providers

Carbon Fix uses Service Providers to support its business. These Service Providers may perform services or assist to provide services to you by handling your personal information on Carbon Fix’s behalf, or by using their own affiliates to provide these services. Carbon Fix’s Service Providers may need to access your personal information in connection with providing these services. Service Providers may be based in Australia or in countries overseas, including the United States, Canada, and Ireland.

Carbon Fix only discloses your personal information to Service Providers in accordance with this Policy and the Act. Carbon Fix does not authorise the use or disclosure of your personal information for any other purposes other than in connection with the provision of the services provided to Carbon Fix.

Carbon Fix’s principal Service Providers are:

Microsoft (Microsoft 365 / SharePoint) — email, document storage, and file collaboration. Data hosted primarily in Australia.

HubSpot (HubSpot, Inc.) — customer relationship management (CRM) platform used to manage business development contacts and ACCU market participant records. HubSpot stores Carbon Fix’s data in its Australian data region (Sydney). HubSpot is a US-incorporated company and global support arrangements may involve limited cross-border access for system administration purposes. Carbon Fix uses HubSpot for record-keeping and pipeline management only — Carbon Fix does not send bulk marketing or automated outbound communications via HubSpot. All client and prospect outreach is conducted on a one-to-one basis via Microsoft Outlook.

Anthropic (Claude) — AI-assisted analysis, research, and drafting. Claude is operated by Anthropic, PBC (a US corporation) with data processed in the United States. Claude is also accessible via the HubSpot integration, which means HubSpot record data may be passed to Anthropic for AI-assisted analysis. AI never communicates directly with external parties; all external communications are reviewed by a human before being sent.

Xero / MYOB — accounting and invoicing. Data hosted in Australia / New Zealand.

Clean Energy Regulator (ANREU) — Australian National Registry of Emissions Units, used for ACCU holding and transfer transactions. Operated by the Commonwealth of Australia.

Direct marketing

Carbon Fix will only use personal information collected for the purpose of direct marketing where Carbon Fix:

collected the information;
believes you would reasonably expect Carbon Fix to use or disclose the information for direct marketing; and
provides an option for you to request that Carbon Fix does not use the information for direct marketing — and you have not taken up this option.

If Carbon Fix collected the information involved from you and you would not reasonably expect Carbon Fix to use or disclose the information for the purpose of direct marketing, or collects the information from someone other than you, Carbon Fix will only use or disclose the information with your consent or where it is impracticable to obtain your consent. Either way, a simple means will be provided to you by which you may request not to receive direct marketing communications from Carbon Fix.

When Carbon Fix uses or discloses any personal information collected for direct marketing purposes, those materials will provide you with an option to declare you do not wish to receive such material in the future. If requested, Carbon Fix will provide you with the source of any information used or disclosed for direct marketing purposes, whether that direct marketing be by Carbon Fix or another organisation. Carbon Fix will also provide you with the opportunity to request that it, or the other organisation, does not send direct marketing information to you. Carbon Fix will not charge for that request and will action it in a reasonable timeframe. You may also request that Carbon Fix not use or disclose information to facilitate direct marketing by other organisations.

As at the date of this Policy, Carbon Fix does not send bulk direct marketing communications via its CRM (HubSpot) or any other automated outbound channel. All client and prospect communications are conducted on a one-to-one basis via Microsoft Outlook and reviewed by a human before being sent. Any future change to this practice will be reflected in an updated version of this Policy.

Cross-border disclosure of information

The Service Providers used to support the Carbon Fix business (including those who handle personal information on Carbon Fix’s behalf where required, or for complementary software to support business functions) may be based in Australia or in countries overseas, including the United States, Canada, and Ireland. While Carbon Fix’s primary CRM (HubSpot) stores data in Australia, certain integrations and AI-assisted processing (for example, Anthropic’s Claude) may involve transfer of personal information to the United States. Where possible, Carbon Fix will take reasonable steps in the circumstances to ensure overseas recipients comply with the Act, or any corresponding law in the relevant jurisdiction, when handling information, and have precautionary measures in place to protect your information from misuse, interference, loss, and unauthorised access, modification, or disclosure. This includes credit eligibility information received.

Carbon Fix will only transfer personal information about an individual to someone (other than a member of Carbon Fix or the individual) who is in a foreign country if Carbon Fix reasonably believes that the recipient of the information is subject to a law or binding scheme substantially similar to the way in which the APPs protect the information and there are mechanisms that can be used to take action or enforce those laws or binding scheme. Carbon Fix may also transfer personal information cross-border if you specifically consent to Carbon Fix doing so, or Carbon Fix is required to do so under Australian law or an order of a court or tribunal, a permitted general situation exists, or Carbon Fix is required or authorised by or under an international agreement relating to information sharing to do so. Otherwise, Carbon Fix will take reasonable steps under the circumstances to ensure that the overseas recipient does not breach the APPs in relation to the information.

Adoption, use or disclosure of government-related identifiers

Generally, Carbon Fix does not use government-related identifiers. Carbon Fix will not use or disclose a government-related identifier unless the use or disclosure of the identifier is:

reasonably necessary for Carbon Fix to be able to verify your identity for the purposes of Carbon Fix’s activities or functions; or
reasonably necessary for Carbon Fix to fulfil any obligations it may have to a government agency or a State or Territory authority; or
required or authorised by or under an Australian law or order of a court or tribunal; or
where a permitted general situation exists in relation to the use or disclosure of the identifier.

Carbon Fix may use or disclose such an identifier if it is reasonably necessary for an enforcement related activity by, or on behalf of, an enforcement body. Carbon Fix may also use or disclose a government related identifier related to you if that is prescribed for by regulation.

PART 4 – INTEGRITY OF PERSONAL INFORMATION

Quality of information

Carbon Fix will take steps as are reasonable in the circumstances to ensure that the information it collects from you is accurate, up-to-date and complete. Where information is collected from you directly, Carbon Fix relies on you to supply accurate information and may not consider that further steps are required. Carbon Fix will also take steps that are reasonable in the circumstances to ensure that the information it collects, uses or discloses is, when considered in relation to the purpose for which Carbon Fix is using or disclosing the information, accurate, up-to-date, complete, and relevant.

Security of information

Carbon Fix will take all steps reasonable under the circumstances to protect your information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Carbon Fix protects personal information through access controls, encryption, secure cloud-based storage, password protection, multi-factor authentication and regular security reviews.

If Carbon Fix no longer requires the holding of information, it will take all reasonable steps under the circumstances to destroy or de-identify the information. However, Carbon Fix may retain documents that contain information in accordance with document retention practices and requirements under Australian law or any order of a court or tribunal. For example, Carbon Fix may retain copies of contracts to which you are a party, even though the contracts may contain personal information about you. Similarly, personal information provided for the purposes of establishing or varying the terms of a trading account will be retained on file for document retention purposes.

Carbon Fix operates through Service Providers and suppliers, some of whom may be offshore (such as those providing cloud storage or IT services). Carbon Fix will take reasonable steps with respect to information to ensure that any information collected, held, used, and disclosed will comply with the Act and any corresponding law where information is collected, held, used, or disclosed offshore.

Retention period

Carbon Fix retains personal information for as long as it is needed for the purposes for which it was collected, and for the minimum retention periods required by law (generally seven (7) years). After the retention period, personal information is securely destroyed or de-identified.

PART 5 – ACCESS TO, AND CORRECTION OF, INFORMATION

Access to information

You can request access to the personal information that Carbon Fix holds about you by contacting the Carbon Fix Privacy Officer whose details are set out below. Carbon Fix may need to verify your identity to provide you with access and consider whether any exceptions to access apply.

In relation to requests to access information, Carbon Fix will generally provide you with access to your information on request, unless:

giving access would be unlawful;
denying access is required or authorised by or under an Australian law or a court or tribunal order; or
giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body.

Where Carbon Fix provides you with access to your personal information it will do so within a reasonable time after receiving your request and in the manner requested by you (if it is reasonable and practicable for Carbon Fix to do so). Carbon Fix may charge a reasonable fee for giving access to the information.

If Carbon Fix determines not to release information to you, it will provide you with written notice setting out the reasons for refusal and your review options.

Correction of information

If Carbon Fix determines that information held is inaccurate, out-of-date, incomplete, irrelevant, or misleading, or you request Carbon Fix to correct the information (or any CRB-derived information), it will take all such steps as are reasonable in the circumstances to correct the information held, after considering the reason why Carbon Fix holds the information, to ensure that it is accurate, up-to-date, complete, relevant, and not misleading. If Carbon Fix had disclosed the original information to a third party or you request Carbon Fix to advise another party, Carbon Fix will take all reasonable steps to update that other party unless it is impracticable or unlawful to do so. Unless required not to by law or it is impracticable to do so, Carbon Fix will provide you with written notice within a reasonable period as to any correction made to information.

If Carbon Fix refuses to correct the information held, Carbon Fix will provide you with written notice as to the reasons for refusal, how you can complain about Carbon Fix’s refusal, and any other matter Carbon Fix may be required to advise you about in the circumstances. If Carbon Fix has refused to correct information held, you may request Carbon Fix associate a statement from you, with the information held, that you believe that the information held is inaccurate, out-of-date, incomplete, irrelevant, or misleading. If such circumstance arises, Carbon Fix will take all reasonable steps under the circumstances to associate any such statement.

If Carbon Fix receives a request from you to correct information held by us, Carbon Fix will respond to that request within a reasonable period after receiving the request. Carbon Fix will not charge for your request, the correction of information, or associating a statement.

PART 6 – NOTIFIABLE DATA BREACHES

If Carbon Fix becomes aware of an eligible data breach under the Notifiable Data Breaches scheme established by Part IIIC of the Privacy Act 1988 (Cth), it will notify affected individuals and the Office of the Australian Information Commissioner as required by law.

Carbon Fix maintains internal procedures to identify, contain, assess, notify and remediate data breaches.

Review and Update

This Policy is reviewed at least annually, and sooner if there is a material privacy incident, a material change to Carbon Fix’s data collection or handling practices, a material change to the regulatory environment, or a finding from an audit.

Privacy – Enquiries, Requests, Complaints, Breaches

Enquiries regarding this Policy or the information Carbon Fix may hold about you should be addressed to the Privacy Officer, whose contact details are below.

If you have any enquiries, requests, complaints, or breaches to report about the collection, holding, or management of your information, please contact the Privacy Officer via the contact details set out below so that Carbon Fix may attempt to resolve the issue with you quickly and directly.

Carbon Fix CEO / Privacy Officer Contact Details

Email: nigel@carbonfix.au
Phone: 0402 271 412
Mail: 63 Goulburn Street, Crookwell NSW 2583

If Carbon Fix is unable to resolve the matter to your satisfaction, you may wish to contact the Office of the Australian Information Commissioner via:

Phone: 1300 363 992
Mail: GPO Box 5218, Sydney NSW 2001
Website: www.oaic.gov.au

Our Privacy Policy was last updated on 1 June 2026.

Carbon Fix Pty Ltd
ABN 69 645 209 258

Corporate Authorised Representative (CAR No. 001320719) of True Oak Investments Pty Ltd (ABN 81 002 558 956, AFSL 238184)