Privacy policy and cookies, carrot.tech

It is important to us at Carrot to safeguard the privacy of visitors to our site, so that you are sure that the information we collect about you is used correctly.

Privacy policy

Effective date: 1 August 2026 (replaces the version dated 1 December 2022)

This privacy policy describes how Carrot AS and its UK subsidiary Carrot Circular Tech Limited (together “Carrot”) collects, uses and discloses information, and what choices you have with respect to the information.

1. Scope of this Privacy Policy

This Privacy Policy applies to Carrot’s products and services, including applicable mobile and web applications (collectively the “Services”), carrot.tech and other Carrot websites (collectively the “Websites”) and other interactions (e.g., customer service inquiries, user conferences etc.) you may have with Carrot. If you do not agree with the terms, do not access or use the Services, Websites or any other aspect of Carrot’s business. For customers, users and website visitors in the United Kingdom, references to the GDPR in this policy include the UK GDPR, and Carrot Circular Tech Limited is the relevant Carrot entity.

This Privacy Policy does not apply to any third-party applications or software that integrate with the Services through the Carrot platform (“Third-Party Services”), or any other third-party products, services or businesses. In addition, a separate agreement governs delivery, access, and use of the Services (the “Carrot Standard Agreement”), including the processing of any data submitted through the Services (“Service Data”). The organization (e.g., your employer or another entity or person) that agreed to the Carrot Standard Agreement (“Customer”) controls its instance of the Services and any associated Service Data (the “Customer Instance”).

Where Carrot processes Service Data on behalf of a Customer, Carrot acts as a data processor under GDPR Article 28, and the processing is governed by the Data Processing Agreement entered into with that Customer — not by this Privacy Policy. This Privacy Policy covers the processing for which Carrot is the data controller (Websites, marketing, account administration and recruitment).

2. Information Carrot collects and receives

Personal information is information that can be linked to you as a person. Name, e-mail addresses and company names are examples of personal information.

Responsible for processing personal information

Company name: Carrot AS (org. no. 920 018 734, Norway). For customers and contacts of our UK business: Carrot Circular Tech Limited (registered in England and Wales).

Questions about how we process your information: privacy@carrot.tech

Data Protection Officer: Tine Charlotte Holm

When you visit Carrot Services and websites, contact us directly or through forms on our website, or apply for a job with us, we process personal information about you.

Carrot may collect, generate, and receive Service Data and other information and data (“Other Information”; Service Data and Other Information collectively “Information”) in a variety of ways:

• Service data: Customers and individuals granted access to a Customer Instance by a Customer (“Authorized Users”) may submit Service Data to Carrot when using the Services.
• Account information: contact name, contact phone number, contact e-mail.
• Usage information: Services metadata generated when an Authorized User interacts with the Services, e.g. which Third Party Services are connected.
• Device information: type of device, operating system, device settings, application IDs, unique device identifiers and crash data.
• Location information: approximate location derived from, e.g., a business address submitted by your employer or an IP address.
• Log data: IP address, referring web page, browser type and settings, date and time of use, browser configuration and plugins, language preferences and cookie data.
• Cookie information: please see the Carrot Cookie Policy further down.
• Contact information: information you provide when registering via forms or contacting us directly — name, email address, phone number, what type of business you work in, and the name of the company you work for.

Legitimate interest as an alternative to consent: where you have an existing customer relationship with us, we may send you information about our products and services based on our legitimate interest (GDPR Article 6(1)(f)) and in accordance with Section 15(3) of the Norwegian Marketing Control Act (markedsføringsloven). You may object to such communication at any time, and we will then stop contacting you for marketing purposes and delete the information we hold about you for that purpose.

3. Purpose of processing personal data

We process personal information about you in order to carry out our obligations by agreement with you.

• Sales and marketing activities in the form of direct email, automated email or telephone contact.
• To answer inquiries and give you information about our products.
• We use cookies on our website to collect statistics and information about user behavior on the website to improve the user experience. You can find information about which cookies and how to turn them off further down.
• To give you a more personal experience and deliver content that interests you.
• When we recruit, we process CVs, applications and references, in addition to other dialogue you have with us.

The basis for the processing of personal data

Information about name, phone, email address, business type and business name is used to fulfill the agreement you have with us. The legal basis for this processing is GDPR Article 6(1)(b) (performance of a contract). Marketing based on your consent relies on GDPR Article 6(1)(a); marketing to existing customers relies on Article 6(1)(f) as described above; and processing of recruitment data relies on Article 6(1)(b) and, where applicable, your consent. If you have consented, the information will also be used to provide you with information, offers and service in connection with your purchase by telephone or e-mail. You can at any time refuse to receive information from us.

Collection of personal information

We store personal information that you have provided on our website or that you have provided in dialogue with our employees in connection with your customer relationship. Personal information is primarily stored and processed within the EU/EEA. Where our suppliers process personal data outside the EU/EEA (for example in the United States), the transfer is protected by a valid transfer mechanism under GDPR Chapter V, such as the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. An overview of our data processors and transfer safeguards is available on request from privacy@carrot.tech. We use cookies on our website to give you as a user of the website the best possible experience. The Electronic Communications Act requires that we inform visitors about the use of cookies. Read more about which cookies this website uses in our Carrot Cookie Policy.

Sharing of personal information

We do not sell personal information. We share personal information with data processors that deliver services to us — such as cloud hosting, authentication (Auth0), analytics (Google Analytics, PostHog), and CRM/marketing (HubSpot, LinkedIn, Meta) — under data processing agreements pursuant to GDPR Article 28. We may also disclose personal information where we are required to do so by law or by order of a competent authority.

Deletion of personal information

We never store personal information longer than necessary. Retention periods follow our Data Retention Policy. Information related to job applications is deleted when the recruitment process is completed, unless you have consented to us keeping your application on file for future openings. You have the right to demand that personal information about you be corrected or deleted.

Rights of the registered

We process your personal data in accordance with the GDPR, the UK GDPR and the Norwegian Personal Data Act (personopplysningsloven). You have the following rights: access to your personal data; rectification of inaccurate data; erasure (“right to be forgotten”); restriction of processing; data portability; objection to processing based on legitimate interest, including direct marketing; and the right to withdraw consent at any time where processing is based on consent. To exercise your rights, contact privacy@carrot.tech — we respond within one month. You can complain to Datatilsynet (the Norwegian Data Protection Authority) or, for UK matters, the Information Commissioner’s Office (ICO) about processing in violation of the regulations.

Carrot Cookie Policy

Scope

This Cookie Policy applies to Carrot’s products and services, including applicable mobile and web applications (collectively the “Services”), carrot.tech and other Carrot websites (collectively the “Websites”).

About cookies

Today, most websites use cookies to improve the user experience. A cookie is a small text file that is downloaded when a user opens a website, and which is stored in the browser or device you use. The cookie helps the website to “remember” things about you, such as login details, language, or to store information about how a user navigates around the website.

Use of cookies on Carrot Services and Websites

Carrot never uses cookies with the intention of tracking a person’s individual usage pattern. Cookies are used to enhance the user experience or to be used in statistics. Non-essential cookies (analytics and marketing) are only set after you have given active consent through the cookie banner on our Websites, in line with the Norwegian Electronic Communications Act (ekomloven, in force from 2025) and the GDPR. You can change or withdraw your consent at any time via the cookie settings on the Website. Carrot uses Google Analytics, PostHog, HubSpot and LinkedIn Insights Tag as tools to understand how our visitors use the website. Google Analytics and PostHog use cookies to collect anonymous information about the website’s traffic and how visitors use the website, such as the number of times a page has been viewed, the number of visits and how the user entered the page. The purpose is to make the Services and websites as user-friendly as possible.

These cookies are in use:

• Google Analytics (policies.google.com/privacy) — the tool we use to keep track of how our Websites are used. Google Analytics uses cookies beginning with _ga, _gid and _gat.
• PostHog (posthog.com/privacy) — the tool we use to keep track of how our Services are used. We use PostHog Cloud with EU hosting, meaning that the personal information collected will be stored and processed on servers in Germany, thus being governed by European GDPR.
• HubSpot (legal.hubspot.com/privacy-policy) — both our customer relations management tool (CRM) and a tool we use in our marketing. We use the tool to follow up people who are in contact with us, whether they are existing customers, new customers who contact us through forms on our website or applicants for positions with us. HubSpot uses cookies that begin with _hubspot, in addition to __hssc, __hssrc and __hstc.
• Facebook, Instagram and LinkedIn — cookies used for marketing. These do not say anything about who you are, but that you came to our site through one of these platforms. We use these to show you ads on the platforms, based on your consent, because we think you have an interest in this since you have visited our website. These start with _fb and _li.
• Authentication cookies — used in our Services to authenticate your registered user in our system. This cookie contains an access token from Auth0. These contain information about your registered user (see Privacy Policy), and tell us that you are allowed to log in, and which data sets you are allowed to see.

How to delete cookies?

Google Chrome — to reset cookies:

• Go to Chrome, click the menu at the top right and select Settings.
• Under Privacy and Security, go to Cookies and other site data / Site Settings to allow or block cookies, or to view and delete stored cookies.

Microsoft Edge — to reset cookies: go to Settings › Cookies and site permissions › Manage and delete cookies and site data.

Mozilla Firefox — to reset cookies: open the Firefox menu › Settings › Privacy & Security › Cookies and Site Data › Manage Data / Clear Data.

Safari — to reset cookies: Safari › Settings › Privacy › Manage Website Data › Remove All.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when our processing, suppliers or legal requirements change. The current version is always available at carrot.tech, with the effective date stated at the top. Material changes will be communicated to customers and, where required, to registered users.

Newsletter

Stay in the loop for news about our product, sustainability and the company. By subscribing to our newsletter, you accept our Privacy Policy.