← Back to Home

Privacy Policy

Last updated: April 2026

1. Controller

Controller within the meaning of Art. 4 No. 7 GDPR for the websites biocharlink.com, buy-biochar.com and sell-biochar.com(the “Platform”) is:

PyroCCS GmbH
Neue Weyerstr. 2
50676 Cologne, Germany
Email: imprint@biocharlink.com

We have not appointed a Data Protection Officer, as we are not legally required to do so.

2. Data We Process

  • Registration & listing data:contact person’s name, business email, company name, phone number, country/region.
  • Listing content: biochar product details, feedstock, volumes, pricing indications, location, lab test reports, photos.
  • Communication data: messages, calls and correspondence with our team in connection with matching and deal facilitation.
  • Server log data:IP address, date/time of request, URL, referrer, browser and device information — automatically collected when you visit the Platform.
  • Consent records: records of cookie and marketing consents given or withdrawn.

3. Purposes & Legal Bases

  • Operating the Platform, account management, matching buyers and sellers, deal facilitation— Art. 6(1)(b) GDPR (performance of contract / pre-contractual measures).
  • Publishing listings in anonymised or pseudonymised form on the Platform, on our social-media channels (including LinkedIn, X, TikTok, Instagram and Facebook) and via third parties engaged to publish, distribute or further process such anonymised offers, promoting matches, improving our services, security and fraud prevention— Art. 6(1)(f) GDPR (legitimate interests in operating and growing a biochar brokerage platform).
  • Server logs— Art. 6(1)(f) GDPR (legitimate interest in a stable, secure website).
  • Optional analytics and marketing communications— Art. 6(1)(a) GDPR (your consent), which you can withdraw at any time.
  • Compliance with legal obligations(e.g. tax and commercial record-keeping) — Art. 6(1)(c) GDPR.

4. Cookies & Analytics

We use only strictly necessary cookies required for the Platform to function (session management, cookie consent preference). These do not require consent.

Subject to your consent, we use Google Analytics 4 to understand how visitors use the Platform. You can withdraw consent at any time via the cookie settings accessible from the cookie icon in the bottom corner of the page, or on our Cookie Policy page.

Our contact form uses Google reCAPTCHA v3(provided by Google Ireland Limited) to protect against automated spam submissions. When you visit the contact page (and have given “functional” cookie consent), reCAPTCHA collects hardware and software information — such as device and application data, IP address and browser information — and sends it to Google for analysis. This processing is based on Art. 6(1)(f) GDPR (legitimate interest in protecting our Platform from abuse). Data may be transferred to Google servers in the USA; safeguards are provided by the European Commission’s Standard Contractual Clauses. For details see Google’s Privacy Policy and Terms of Service.

Our questionnaire forms use your browser’s local storageto save your progress so that your input is not lost if you navigate away or close the tab. The stored data may include the information you have entered (e.g. name, email, company). It is automatically deleted when you submit the form and is never transmitted to our servers until you explicitly submit. You can clear it at any time via your browser settings. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request).

5. Recipients & Processors

We share personal data only where necessary, in particular with:

  • Hostinger International Ltd.(Kaunas, Lithuania) — website hosting; data processed on EU servers;
  • Supabase Inc.(San Francisco, USA) — EU-region PostgreSQL database hosting;
  • Resend Inc.(San Francisco, USA) — transactional email delivery;
  • Google Ireland Limited— Google Analytics 4 (with consent), Google reCAPTCHA v3 (contact form), and Google OAuth (administrator authentication);
  • CookieYes Limited(London, UK) — cookie consent management;
  • social-media platforms (LinkedIn, X, TikTok, Instagram, Facebook) and third-party publishers or brokers — only in anonymised or pseudonymised form, for the purpose of promoting and distributing buy/sell offers;
  • matched counterparties — only the information necessary to facilitate a specific deal, and only after we have assessed the match;
  • professional advisors (tax, legal) and, where legally required, public authorities.

All processors are bound by a data processing agreement in accordance with Art. 28 GDPR.

6. International Transfers

Personal data is stored on servers within the EU/EEA. Where a processor exceptionally processes data outside the EU/EEA, we ensure an adequate level of protection through the European Commission’s Standard Contractual Clauses and additional safeguards in accordance with Chapter V GDPR.

7. Retention

We keep your personal data only as long as necessary for the purposes set out above. Account and listing data is retained for the duration of your use of the Platform and deleted or anonymised within a reasonable period after account deletion, subject to statutory retention periods (in particular 6 / 10 years under HGB and AO for commercial and tax records). Server logs are deleted or anonymised within 14 days.

8. Your Rights

Under the GDPR, you have the right to:

  • access your personal data (Art. 15 GDPR);
  • rectify inaccurate data (Art. 16 GDPR);
  • erasure of your data (Art. 17 GDPR);
  • restrict processing (Art. 18 GDPR);
  • data portability (Art. 20 GDPR);
  • object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR), including objection to direct marketing;
  • withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise these rights, contact us at imprint@biocharlink.com. We will respond to your request without undue delay and in any event within 30 days of receipt, as required by Art. 12(3) GDPR. If we need to extend this period, we will notify you within the initial 30 days with reasons for the delay.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work, or place of the alleged infringement. Our competent authority is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.

9. Data Security

We implement appropriate technical and organisational measures in accordance with Art. 32 GDPR, including TLS encryption in transit, access controls, and regular reviews.

10. Obligation to Provide Data

Providing personal data for registration, listings and deal facilitation is not required by law, but is necessary to conclude and perform a contract with us. Without this data, we cannot create an account, publish a listing, or facilitate a match.

11. Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Our matching process currently involves human review.

12. Marketing Communications

During registration, you may optionally consent to receiving marketing communications from us. This consent is collected for future use. We do not currently send marketing emails; when we do, each message will contain a clear unsubscribe link allowing you to withdraw your consent at any time with immediate effect (Art. 7(3) GDPR).

13. Changes to this Policy

We may update this Privacy Policy to reflect changes to our services or legal requirements. The current version is always available on this page with the date of the latest update.