Privacy policy

This website is operated by Recarbono Next, Lda (trading as Recarbono), registered in Portugal under NIPC 519019571, with registered office at Estrada Malveira da Serra, n.º 920, Aldeia de Juzo, 2750-834 Cascais, Portugal. Recarbono Next, Lda is the data controller for personal data processed through this site. For anything not answered here, write to us at info@recarbono.com.

This website is designed to collect as little as possible. Fonts and images are self-hosted; no requests are made to third-party font services. Two analytics scripts do load, and we describe both precisely below: Cloudflare Web Analytics (cookieless, for every visitor) and Google Analytics (cookie-based, only if you accept).

Contact form. When you submit the contact form, the details you enter (name, email address, organisation, inquiry type and message) are sent to our server, stored in our own database so your enquiry is never lost, and delivered to us as email via Resend, Inc. (our email-delivery processor, US-based; transfers safeguarded under its data-processing agreement incorporating the EU Standard Contractual Clauses). We use your data solely to respond to your enquiry and retain it for up to 24 months unless a business relationship follows.

Supplier registration. The registration form on our suppliers page additionally asks for your telephone number (optional), your municipality or district, and a description of your residue (type and rough annual volume). We use these details for one purpose: to assess whether your material and location fit our collection operations and, if they do, to contact you about a collection agreement. They travel and are stored exactly like a contact-form enquiry (our database, plus email via Resend) and carry the same retention period.

Engineering enquiries. If you ask us to assess a pyrolysis unit for your operation, the details you volunteer about your company and residue streams are used to prepare that assessment and for nothing else.

Newsletter. If you subscribe to our updates in the footer, we store your email address in our database and send you a confirmation email via Resend. You are only subscribed once you click the link in it (double opt-in). Confirmed addresses are also held in a distribution list at Resend so we can send you the updates you asked for; we use the address for nothing else. Every email carries an unsubscribe link; unsubscribing stops all sends, and we keep the unsubscribed address only to honour that choice. Legal basis: your consent (Art. 6(1)(a) GDPR), withdrawable at any time. Signups are rate-limited per IP address like the forms above.

Job applications. When you apply through our careers page, for a listed role or the talent pool, we collect your name, email address, optional phone number and LinkedIn URL, your motivation text, and your CV if you attach one. We use these details for one purpose: assessing your application and contacting you about roles at Recarbono. Applications are stored in our own database and CVs in our own private file storage (Cloudflare R2, EU jurisdiction safeguards as described under Hosting); notification emails travel via Resend like the forms above. We retain applications for up to 12 months after the relevant process closes, so we can reach you when a matching role opens, and delete them earlier on request at any time (privacy@recarbono.com). Legal basis: pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) and, for keeping talent-pool applications on file, your consent implied by applying to the pool, withdrawable at any time.

Abuse prevention. Both forms are protected by Cloudflare Turnstile, which checks that a submission comes from a real browser without setting tracking cookies; the verification shares your IP address with Cloudflare for that check. Our server also rate-limits submissions per IP address, holding a counter for at most 10 minutes before it is automatically deleted. Legal basis: our legitimate interest in keeping the forms usable (Art. 6(1)(f) GDPR).

We share personal data only with the service providers needed to run this site, each bound by a data-processing agreement:

• Resend, Inc.: contact-form and newsletter email delivery, and our newsletter subscriber list (US; SCCs/DPA).
• Cloudflare, Inc.: hosting, content delivery, database, bot protection and privacy-preserving analytics (EU/US; Data Privacy Framework).
• Google Ireland Ltd: Google Analytics 4, loaded only after you accept cookies (EU; transfers to Google LLC in the US under the applicable adequacy decision).

We use no advertising networks and sell no data.

We use two measurement tools, and they are treated differently because they are different.

Cloudflare Web Analytics runs for every visitor. It is cookieless: it sets no cookies, stores no identifier on your device and builds no profile of you. It reports aggregate page views, referrers and page performance. Because it collects no personal data, it requires no consent and cannot be used to track you across sites.

Google Analytics 4 sets cookies and is therefore loaded only if you click Accept on the cookie notice. If you decline, or simply ignore the notice, it never loads, and no Google cookie is placed on your device. We enable IP anonymisation and disable advertising and personalisation signals. You can change your mind at any time by clearing this site's data in your browser, which will make the notice appear again.

Your choice is stored in your browser's local storage (a single value recording whether you accepted or declined). That value never leaves your device. You can change or withdraw it at any time using the Cookie settings link in the footer; withdrawing is as easy as giving consent.

Enquiry measurement. When a form is submitted successfully, we record two things in our own database: which kind of enquiry it was (buyer, supplier, industry, and so on) and the page it came from. No cookie, no identifier, no IP address, and nothing that could be linked back to you: we are counting enquiries, not following people. It runs for everyone because it collects no personal data; if you accepted cookies, the same event is also counted in Google Analytics. Legal basis: our legitimate interest in knowing which parts of the site work (Art. 6(1)(f) GDPR).

Team sign-in. The staff area uses a strictly necessary session cookie for authenticated Recarbono team members only. It is not set for ordinary visitors and is not used for tracking.

Legal basis and retention. Analytics on consent (Art. 6(1)(a) GDPR); contact enquiries on our legitimate interest in replying to you and on pre-contractual steps you request (Art. 6(1)(b) and (f)); supplier registrations and engineering enquiries on pre-contractual steps at your request (Art. 6(1)(b)). Enquiries are retained for up to 24 months unless a business relationship follows; analytics data is retained in aggregate only; rate-limit counters are deleted within 10 minutes.

Our own server keeps a register of page visits, used for understanding traffic, detecting abuse and, where a visitor later contacts us, seeing which pages preceded the enquiry. Corrected in September 2026: an earlier version of this policy described this register as storing only a truncated address and a pseudonym that changed daily. That stopped being accurate in July 2026, and the description below is what the system actually does.

We record your IP address in full, alongside a truncated form of it. We also derive a pseudonym by hashing your address together with your browser's user-agent string and a secret value. That secret does not rotate, so the pseudonym is stable: it lets us recognise a returning visitor across days. The hash cannot be reversed, but it is not anonymous: it is a pseudonym, and the full address is held next to it.

Alongside those we record the page visited, the referring page, your location as our hosting network reports it (country, region and city; no geo-lookup service is involved), the name of the network operator your connection uses (your internet provider, or your employer's network if you browse from an office), your browser's language setting, coarse device classes (mobile or desktop, browser family, operating system family), the full user-agent string, and security signals our host provides such as a bot score.

Register rows are deleted automatically after 90 days; only anonymous aggregates (counts by country, page, device) are kept longer. The legal basis is our legitimate interest in understanding and protecting this website (Art. 6(1)(f) GDPR). We use none of it for advertising, we sell nothing, we share nothing, and we do not track you across other websites. You may object at any time via privacy@recarbono.com, and we will stop unless we have compelling grounds we can demonstrate.

On the articles published under Insights, and only there, we measure reading in more detail than elsewhere on this site. We think you should know exactly what that means, because it is more than most sites do.

When you open one of those articles we record: your IP address in full, the stable pseudonym described above, your browser's user-agent string, your location as our hosting network reports it including approximate coordinates, the network operator your connection uses, how you arrived (referring page and any campaign parameters in the link), how long the page was actually on screen, how far down it you scrolled, whether you reached the end, how many separate occasions you came back, and how long you spent on each section of the article.

Why. We publish detailed technical writing and we want to know which parts are read and which are skipped, and whether the people reading are the organisations we are trying to reach. The network operator name is the part we act on most: it tells us a company read a piece, never who at that company did.

What we do not do. We do not sell or share this data, we do not use it for advertising, we do not track you onto other websites, and we do not attempt to identify you by name from it. If you later contact us, we may see which articles preceded your enquiry.

Legal basis and retention. Our legitimate interest in understanding whether our published work reaches and holds its intended audience (Art. 6(1)(f) GDPR). We recognise that this is a more intrusive measurement than an ordinary page count and that you have not asked us for anything, which is why it is described here in full rather than summarised. Rows are deleted automatically after 90 days. You may object at any time, or ask us to erase your rows, via privacy@recarbono.com. We will act on it, and you do not have to give a reason.

Measurement only runs when the page is genuinely displayed in your browser; it does not run for link previews or for pages loaded in the background. Nothing described in this section places a cookie or stores anything on your device.

This website is served through Cloudflare's global network. Cloudflare may process technical connection data (such as IP addresses) as a processor for security and delivery purposes.

Under the GDPR you have the right to access, rectify, erase, restrict and object to the processing of your personal data, and the right to data portability. To exercise any of these rights, contact info@recarbono.com. You also have the right to lodge a complaint with your supervisory authority: in Portugal, the CNPD (Comissão Nacional de Proteção de Dados).

We will update this policy as the website gains functionality and note the revision date above.