Privacy & Data Governance Policy

1. Corporate Entity & Scope of Data Governance

This Privacy and Data Governance Policy governs all data processed by CarboMomentum Global Innovations Private Limited ("CarboMomentum", "we", "us", or "our"), including our digital measurement, reporting, and verification (dMRV) engine, investor relations portals, offtake registries, and public communication channels.

CarboMomentum operates in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India, applicable Reserve Bank of India (RBI) covenants for Special Purpose Vehicles (SPVs), and international carbon registry security standards (Isometric Protocol Standard v2.4).

2. Categories of Information Collected

• Industrial IoT Telemetry: Continuous core temperatures (°C), retort gas pressures, oxygen purge percentages, and weighbridge mass metrics captured from our continuous pyrolysis trains. All industrial telemetry is cryptographically signed via SHA-256 and immutably archived.
• Accredited Institutional KYC/AML Information: Corporate identification, beneficial ownership documents, and authorized signers for Special Purpose Vehicle (SPV) equity subscribers and institutional carbon credit buyers.
• Commercial Communication & Dialogue: Encrypted inquiries, offtake allocations, and technical tickets submitted through our Institutional Client Portal.
• Registry Ledger Verification Data: Public cryptographic transaction hashes (0x...) and certificate serials (e.g., ISO-IN-GUJ-2026-xxxx) published to verifiable ledgers for public auditability.

3. Purpose of Processing & Legal Basis

All data processed by CarboMomentum is utilized exclusively for legitimate institutional objectives:

• Guaranteeing scientific integrity and permanence compliance (molar H:Corg ≤ 0.35) of biochar carbon removal credits (CORCs).
• Quarterly dividend waterfall calculations and equity ledger reconciliation for SPV partners.
• Issuance of permanent Scope 3 retirement audit proofs to designated corporate beneficiaries.
• Fulfilling statutory audit requirements under the Indian Companies Act, 2013, and Bureau of Energy Efficiency (BEE) guidelines.

4. Data Protection, Security & Cryptographic Provenance

We enforce multi-tiered defense protocols across all data stores:

• Transport Layer Security (TLS 1.3) across all public websites, API endpoints, and dashboard interfaces.
• AES-256 cryptographic encryption at rest across all LibSQL / Turso cloud storage engines.
• Strict Role-Based Access Control (RBAC) separating administrative, operational, investor, and credit buyer views.
• Tamper-evident cryptographic hashing: production runs cannot be altered after laboratory dispatch.

5. Contact & Data Protection Officer (DPO)

Inquiries regarding data rights, verification records, or institutional audit procedures should be directed to our compliance secretariat: