Privacy Policy

This notice describes the data-protection practices of the Marine Conservation Credits programme during its pre-issuance phase. It is an interim notice, not an adopted instrument. MCC-800 art. 90 requires personal data to be processed in accordance with an MCC Privacy Policy; no such policy has been adopted. One has been drafted as MCC-PRIV v1.0 and will be put to the Governing Board. This notice was corrected on 4 September 2026 to remove statements that could not be verified against the system as built; each correction is described in that draft. No legal entity has yet been incorporated to act as data controller.

1. Introduction

Marine Conservation Credits (“MCC”, “we”, “us”, or “our”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store, and share information when you visit our website at marineconservationcredits.com or use our platform services.

2. Information We Collect

We may collect the following categories of information:

Account Information: When you register for an account, we collect your name, email address, organization name, and role.

Project Data: If you submit a project for assessment, we collect project descriptions, geographic coordinates, methodology details, and supporting documentation.

Activity Data: The registry keeps an immutable audit trail of actions taken on it — who did what, when, and to which record — because a registry that cannot be audited is not a registry. Each entry records the actor and the action, and can record the IP address and the browser user-agent string. We do not run behavioural analytics: the platform loads no analytics library and does not track pages visited or time spent.

Technical Data: IP address and browser user-agent, recorded in the audit trail and in error reports. Error reporting is configured not to send personal data with the report. Cookies are used only to keep you signed in.

3. How We Use Your Information

We use your information for the following purposes: to provide and maintain our platform services, including project assessment, credit verification, and registry operations; to communicate with you about your account, projects, and platform updates; to comply with legal and regulatory obligations; and to prevent fraud and ensure platform security. Submitted project documentation is analysed by an AI system that produces findings for human reviewers; the AI does not take decisions, and every decision is recorded against the person who took it.

4. Legal Basis for Processing

We process your personal data on the following legal bases under the GDPR: performance of a contract when providing platform services; your consent, where applicable; our legitimate interests in improving and securing our platform; and compliance with legal obligations.

5. Data Sharing

We do not sell your personal data. The service providers that can receive it are named rather than described in general terms: our database and file storage provider, our application hosting provider, our transactional email provider, our error-reporting provider, the provider of the AI model used to analyse submitted documentation, and, where a sanctions check is run, a public sanctions search service. Project data is shared with independent validation and verification bodies as part of the assessment process, and information is disclosed to regulatory authorities where the law requires it. Data-processing agreements with these providers have not yet been concluded, and no register of processors exists; both are outstanding and are recorded as such. There are no affiliated entities: no company has been incorporated to operate the programme.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy, or as required by law. Project data associated with issued credits is retained in the registry as a permanent record to ensure transparency and auditability. You may request deletion of your account data at any time, subject to our legal and regulatory retention obligations.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data: the right to access and obtain a copy of your data; the right to rectification of inaccurate data; the right to erasure (“right to be forgotten”); the right to restrict processing; the right to data portability; and the right to object to processing.

To exercise any of these rights, please contact us at info@marineconservationcredits.com.

8. International Data Transfers

The database, file storage and application are hosted in Stockholm, Sweden, within the European Economic Area. Two flows leave that boundary: text from submitted documentation sent to an AI model provider for analysis, and error reports. The transfer mechanisms for those flows — standard contractual clauses or another lawful basis — have not been put in place, and this notice does not claim otherwise. Closing that gap is one of the matters before the Governing Board.

9. Cookies

We use essential cookies only — the ones that keep you signed in. We set no analytics cookies and load no analytics library, which is why this site asks you for no cookie consent: there is nothing to consent to beyond what is strictly necessary.

10. Security

Access to data is controlled at the row level in the database, transport is encrypted, and the audit trail is immutable. No independent security assessment or penetration test has been carried out. One is required before credit issuance is enabled, and until it has been done we do not describe our security as tested. What the programme has and has not evidenced is published at the evidence register.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the revised policy on our website and updating the “Last updated” date above.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at info@marineconservationcredits.com.