userTerms and Conditions - Users

Users

Version

2.0

Date of Version

1 February 2026

1. Introduction

These terms and conditions (“Terms”) govern your use of the International Carbon Registry (“ICR”) registry platform, including all software, services, messaging functionality, blockchain-based credit issuance, APIs, and related tools (collectively, the “ICR registry”).

By creating an account or using the ICR registry, you agree to these Terms and acknowledge that ICR will process personal data in accordance with these Terms and its Privacy Policy, in compliance with the EU General Data Protection Regulation (GDPR) and applicable Icelandic data-protection laws.

2. Eligibility and Account Creation

2.1 Eligibility

You must be at least 18 years old and legally capable of entering into contracts.

2.2 Personal User Account

User accounts are personal and non-transferable.

2.3 Identity Verification (KYC)

KYC verification is required for certain functions. ICR processes personal data for identity verification under as a legal obligation and legitimate interest in securing the platform.

3. Lawful Use of the Registry

You may only use the ICR registry in accordance with these Terms, applicable laws, and ICR program rules.

Prohibited behavior includes impersonation, fraud, harassment, unauthorized scraping, hacking, posting harmful content, or interfering with platform integrity. ICR may monitor and act on violations.

4. User Content and Licensing

4.1 Ownership

You retain ownership of all content you submit, unless specifically stipulated in the ICR program requirements.

4.2 License to ICR

You grant ICR a non-exclusive, worldwide, royalty-free license to use your submitted content for the operation of the registry, including processing, storage, publication, transmission, and analytics.

4.3 Accuracy Obligation

If you discover that information you submitted is false, incomplete, or misleading, you must notify ICR within ten (10) business days and correct it. Failure to do so may lead to suspension of your user account.

5. GDPR Compliance, Data Protection, and Privacy

5.1 ICR as a Data Controller

ICR acts as a data controller under GDPR for personal data processed within the registry.

ICR commits to:

  • processing personal data lawfully, fairly, and transparently,

  • collecting only data necessary for legitimate registry functions,

  • keeping data accurate and up to date,

  • retaining data only as long as necessary for operational or legal purposes,

  • implementing appropriate technical and organizational security measures.

5.2 User (Data Subject) Rights

Under GDPR, you have the right to:

  • access your personal data,

  • request rectification,

  • request erasure where legally permissible,

  • request restriction of processing,

  • data portability,

  • object to processing based on legitimate interests,

  • withdraw consent (where applicable).

Requests may be sent to: [email protected]envelope.

5.3 Limitations Due to Blockchain Immutability

Some data relating to:

  • ICC serial numbers,

  • issuance/retirement/cancellation events,

  • project identifiers,

  • public attributes related to carbon credits

may be recorded permanently on a public blockchain. Such data cannot be altered or deleted, even if you exercise GDPR erasure rights.

In such cases, ICR will apply GDPR-compliant alternatives, such as:

  • removing off-chain references,

  • delinking data from identifiable individuals (pseudonymization),

  • storing personal data separately from immutable records.

If data falls under the scope of GDPR.

5.4 Data Sharing With Third Parties

You consent (where applicable) to ICR sharing necessary personal data with:

  • Validation and Verification Bodies (VVBs),

  • project developers and proponents,

  • rating agencies,

  • external risk advisors,

  • insurance providers,

  • blockchain infrastructure providers,

  • regulatory and supervisory authorities where required.

All third parties must handle personal data under GDPR-compliant confidentiality and security obligations.

5.5 International Transfers

ICR may transfer data outside the EEA only where compliant with GDPR Chapter V, using:

  • adequacy decisions,

  • Standard Contractual Clauses (SCCs),

  • or other lawful mechanisms.

5.6 Data Security

ICR implements industry-standard technical and organizational measures to protect personal data, including encryption, access controls, audit trails, and secure cloud architecture.

6. Acting on Behalf of Organizations

If you act for an organization, your actions may legally bind it. You confirm that you have proper authority.

7. Cooperation Obligations

Users must (where applicable) cooperate with:

  • ICR review teams,

  • VVBs,

  • rating agencies,

  • external risk advisors,

  • fraud investigations.

Failure to cooperate may lead to suspension.

8. Enforcement and Account Suspension

ICR may suspend or terminate user accounts for:

  • violations of these Terms,

  • fraud or suspected fraud,

  • failure to complete KYC,

  • harmful conduct or harassment,

  • non-cooperation with reviews or investigations,

  • security concerns.

ICR may remove or restrict content as needed.

9. Intellectual Property

All ICR platform content and technology remain the exclusive property of ICR or its licensors (ICR registry provider. You may not reverse-engineer, modify, or replicate the platform.

10. Disclaimers

The ICR registry is provided “as is” and “as available.” ICR does not guarantee:

  • uninterrupted access,

  • error-free operation,

  • accuracy of user-generated or project-generated content,

  • any financial or environmental value of ICCs.

11. Indemnification

You agree to indemnify and hold ICR harmless from losses arising from:

  • your use of the registry,

  • your content,

  • your actions on behalf of an organization,

  • violation of these Terms,

  • breach of GDPR obligations related to your actions.

12. Amendments

ICR may update these Terms at any time. Continued use of the registry constitutes acceptance.

13. Governing Law

These Terms are governed by Icelandic law, including GDPR as incorporated into Icelandic legislation.

14. Entire Agreement

These Terms constitute the complete agreement governing your use of the ICR registry at the user level. When operating your user account under an account by an account holder or climate project other terms may apply.

Last updated