Privacy Policy

1Who We Are

iRise Carbon Limited (“iRise Carbon”, “we”, “us”, or “our”) is a company registered in the Republic of Malawi. We develop and manage clean cooking, reforestation, carbon advisory, and regenerative agriculture projects across sub-Saharan Africa.

For the purposes of the Malawi Data Protection Act No. 3 of 2024 (the “Act”), iRise Carbon Limited acts as the Data Controller in respect of personal data collected through this website and our business activities.

2What Data We Collect

We collect only the minimum personal data necessary for specified, legitimate purposes (data minimisation principle). This may include:

We do not knowingly collect special categories of sensitive personal data (e.g. health data, biometric data, political opinions) unless you voluntarily provide them and we have a lawful basis to process them.

3Legal Basis for Processing

Under the Data Protection Act No. 3 of 2024, we must have a lawful basis to process your personal data. We rely on the following:

4How We Use Your Data

We use your personal data strictly for the purposes it was collected. These include:

• Responding to your enquiries, questions, and requests
• Sending newsletters, impact updates, and communications you have subscribed to
• Evaluating and responding to job applications
• Improving our website and user experience through aggregated analytics
• Meeting our legal, regulatory, and contractual obligations
• Protecting the security of our systems and preventing fraud

We will not use your personal data for any purpose that is incompatible with the original purpose for which it was collected, without first obtaining your consent or establishing another lawful basis.

5Data Sharing & Third Parties

We do not sell, rent, or trade your personal data. We may share your data only in the following limited circumstances:

• Service ProvidersTrusted third-party companies that help us operate our website (e.g. hosting, email delivery, analytics). They process data only on our instructions under data processing agreements.
• Project Partners & Co-developersWhere strictly necessary for the delivery of carbon projects and only with appropriate safeguards in place.
• Regulatory & Legal AuthoritiesWhere required by Malawian law, court order, or to protect the rights and safety of individuals.
• Business TransfersIn the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to equivalent privacy protections.

6International Data Transfers

As a company operating across sub-Saharan Africa and engaging with international carbon markets, some of your personal data may be transferred to or processed in countries outside Malawi.

In accordance with Section 35 of the Data Protection Act No. 3 of 2024, we will only transfer personal data internationally where:

• The destination country offers an adequate level of data protection as recognised under Malawian law; or
• We have put in place appropriate safeguards (such as contractual clauses); or
• You have given your explicit consent to the transfer; or
• The transfer is necessary for the performance of a contract with you.

7Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention schedule is:

After the applicable retention period, data is securely deleted or anonymised so that it can no longer be attributed to you.

8Your Rights Under the Data Protection Act No. 3 of 2024

As a data subject, you have the following rights under Malawian law. You may exercise any of these rights free of charge by contacting us at the details in Section 15.

We will respond to all rights requests within 30 days. In complex cases we may extend this by a further two months, in which case we will notify you. If we are unable to fulfil your request, we will explain why.

9Cookies & Tracking Technologies

Our website uses cookies and similar technologies to improve performance and analyse usage. Cookies are small text files placed on your device.

You can manage or withdraw cookie consent at any time through your browser settings. Disabling certain cookies may affect your experience on our website.

10Security of Your Data

iRise Carbon implements appropriate technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

• Encrypted data transmission (HTTPS / TLS)
• Access controls and role-based permissions for staff
• Regular security assessments and updates
• Data processing agreements with all third-party service providers

Despite these measures, no method of transmission over the internet is 100% secure. We encourage you not to share sensitive personal information through unsecured channels.

11Children's Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately so we can delete it without delay.

12Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, iRise Carbon will:

• Notify the Malawi Communications Regulatory Authority (MACRA) within 72 hours of becoming aware of the breach, in accordance with Section 44 of the Data Protection Act No. 3 of 2024.
• Notify affected individuals without undue delay where the breach is likely to result in high risk to their rights and freedoms.
• Maintain a record of all data breaches, their effects, and remedial actions taken.

13Regulatory Authority — MACRA

The national Data Protection Authority (DPA) for Malawi is the Malawi Communications Regulatory Authority (MACRA), designated under the Data Protection Act No. 3 of 2024.

If you believe your personal data rights have been violated and we have been unable to resolve your concern, you have the right to lodge a complaint with MACRA:

14Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the “Last Updated” date at the top of this page. We encourage you to review this page periodically.

Continued use of our website or services after updates have been posted constitutes acceptance of the revised Privacy Policy.

15Contact Us & Data Protection Enquiries

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

We aim to acknowledge all data protection requests within 5 working days and respond fully within 30 days.