We respect your privacy and are committed to protecting it through our compliance with this privacy policy (“Policy”). This Policy covers the mediacarnets.com website, Carnet Pro customer applications and Carnet Pro HQ (collectively, the “Services”). It describes the types of information we may collect from you or that you may provide (“Personal Information”), and our practices for collecting, using, maintaining, protecting, and disclosing that Personal Information. It also describes the choices available to you regarding our use of your Personal Information and how you can access and update it.
This notice explains how Media Carnets Ltd uses personal information and the choices and rights available to you. Reading this notice or using our services does not, by itself, give consent to optional processing. Where we rely on consent, we ask for it separately. Other organisations' websites and services have their own privacy notices.
You can access and use the Website and Services without telling us who you are or revealing any information by which someone could identify you as a specific, identifiable individual. If, however, you wish to use some of the features offered on the Website, you may be asked to provide certain Personal Information (for example, your name and email address).
We receive and store any information you knowingly provide to us when you create an account, publish content, or fill any forms on the Website. When required, this information may include the following:
Free-text equipment descriptions, comments and correspondence can contain Personal Information. They should not be treated as anonymous merely because they describe equipment.
You can choose not to provide us with your Personal Information, but then you may not be able to take advantage of some of the features on the Website. Users who are uncertain about what information is mandatory are welcome to contact us.
Media Carnets acts as controller where it determines the purposes and means for operating its Services. Where Media Carnets processes Personal Information on a business customer's behalf under an applicable data-processing agreement, that agreement defines Media Carnets' processor role.
In order to make the Website and Services available to you, or to meet a legal obligation, we may need to collect and use certain Personal Information. If you do not provide the information that we request, we may not be able to provide you with the requested products or services. Any of the information we collect from you may be used for the following purposes:
Processing your Personal Information depends on how you interact with the Website and Services, where you are located in the world and if one of the following applies: (a) you have given your consent for one or more specific purposes; (b) provision of information is necessary for the performance of our service contract with you and/or for steps taken before entering into that contract; (c) processing is necessary for compliance with a legal obligation to which we are subject; or (d) processing is necessary for the legitimate interests pursued by us or by a third party, except where those interests are overridden by your interests or fundamental rights and freedoms.
Optional kit-list AI assistance depends on the separate permissions described below. A company's authorisation is not automatically consent from every person named in a list. Content containing other people's Personal Information must only be provided with appropriate authority and notices.
You can contact us to clarify the legal basis for particular processing and whether providing information is a statutory or contractual requirement, or necessary to enter into a contract.
You may ask us to access, correct or delete Personal Information we hold about you, subject to applicable lawful conditions and exceptions. Contact us using the details below. We may retain information where it remains necessary for the purposes and retention criteria described in this notice.
We share the information needed to provide the services you request. This includes service providers that process information on our behalf to run the Services — for example hosted account and database services, email delivery, invoicing and accounting, and push notifications — and, only where you have separately chosen it, the optional AI assistance described below. It also includes the chambers of commerce or other authorities involved in your application. Providers processing information on our behalf are subject to appropriate data-protection obligations. You can contact us for further information about the providers we use.
Service Providers are not authorized to use or disclose your information except as necessary to perform services on our behalf or comply with legal requirements. They are given only the information they need to perform their designated functions, and we do not authorize them to use it for their own marketing or other purposes. We do not sell your Personal Information.
If you opt in to marketing emails, your email address and related subscription details are shared with our email marketing provider (Mailchimp) to send them. This is separate from service emails and from the information needed to provide the Services; see Email marketing.
We may also disclose any Personal Information we collect, use or receive if required or permitted by law, such as to comply with a subpoena or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
See Optional AI assistance for kit lists for details of this optional feature and the separate choices that apply. It is not enabled merely by accepting this notice.
Optional kit-list AI assistance is available in supported versions of Carnet Pro only when you explicitly opt in. Updating the app, reading this notice or having an Issued carnet does not opt you in. Each choice described below is made separately through your account settings.
With your permission, Media Carnets uses the OpenAI API to help staff identify equipment descriptions that may need clarification before chamber submission. For consenting accounts, draft suggestions may be prepared automatically in the background after a list is submitted or replaced, even while staff are offline. Staff check suggestions before applying any changes and review the list again before chamber submission. Clear descriptions should remain unchanged, and AI suggestions do not guarantee chamber approval.
In supported versions of Carnet Pro, each customer account can make two separate, independent choices through optional first-login onboarding and later in Settings, under AI assistance:
Each choice is off by default and applies to existing and future applications created by that customer account, including existing chamber-accepted descriptions available for reuse. It does not extend to applications created by colleagues with their own accounts. If you decline AI review, our team will format your lists manually. Declining accepted-example reuse does not prevent AI review if you have separately allowed it. Standard non-AI formatting remains available in either case. An Issued carnet or a chamber's acceptance is not permission for AI use. Only grant permissions you are authorised to give for the content concerned.
We send description text and limited chamber and accepted-example context. Separate contact, customer-account, serial-number, quantity, weight, value and origin fields are excluded from this AI feature. Anything written inside a description is part of the text, so please keep personal, sensitive and unnecessary confidential information out of descriptions. Removing separate identity fields does not make the descriptions anonymous.
We use the OpenAI API with sharing of API inputs and outputs, model feedback, and evaluation or fine-tuning data disabled for the production project. We do not permit this content to be used to train OpenAI's models. The private reference library retrieves useful examples; it does not fine-tune OpenAI's models.
The configured OpenAI project uses global processing and standard retention. Processing may take place outside the UK, including in the United States. For this service, OpenAI processes data on our behalf under its published Data Processing Addendum, which our Services Agreement incorporates. For UK personal data, this includes Standard Contractual Clauses with the UK Addendum. We have assessed the UK-to-US transfer using the ICO's guidance and the UK government's published analysis. OpenAI's subprocessors may also process data in other countries under contractual safeguards. You can contact us for information about the safeguards applicable to your data.
We request that OpenAI does not store generated Responses for later retrieval. This does not remove all provider retention: content may be retained in abuse-monitoring logs for up to 30 days, with longer retention in the documented legal or safety exceptions. This is not a zero-data-retention service. See the provider data controls for further information.
Our additional AI-review records and cached search representations are configured for daily deletion once more than 30 days old, normally within 31 days. Core carnet records, chamber workbooks, staff-change audits and permission evidence are separate and follow the retention criteria below.
You can change or withdraw either choice in Settings, under AI assistance, at any time, including after issuance. You can also contact carnets@mediacarnets.com for help. Withdrawal stops new uses for the purpose disabled and invalidates pending review suggestions. It cannot recall a request already transmitted to OpenAI, undo previous staff edits, or erase records needed to provide the carnet service or meet legal obligations. Disabling reuse removes those examples from future selection; cached representations no longer supported by another permitted source are removed by the next daily cleanup.
Reading this notice, continuing to use the service or having an existing account does not opt you into either AI purpose.
We retain Personal Information for as long as it is necessary to administer an application or carnet and its closure, comply with applicable customs, legal, tax and accounting obligations, preserve necessary audit and permission evidence, and establish or resolve disputes. Carnets can remain live for a period after issue and customs authorities or chambers can raise claims or queries about a carnet after it has been used, so records of applications, goods lists, carnets and related invoices may need to be kept after an account stops being used. How long depends on the obligation or purpose concerned; information is not retained automatically or indefinitely merely because an account exists. You can contact us to ask how these criteria apply to your information.
Account closure and erasure are different. Closing or deactivating your account stops you using it, but does not by itself erase all information about you. If you ask us to erase Personal Information, we will review the request and erase what we are not required or entitled to keep. Where customs, financial or legal retention is necessary, we will tell you what we must keep and why, and restrict its use to those purposes.
We may use aggregated data derived from your Personal Information after you update or delete it, but not in a manner that would identify you personally. Withdrawing an optional AI permission or marketing consent is separate from asking us to erase Personal Information.
We do not add our own optional analytics scripts to the Website unless you have allowed optional cookies. As described under Cookies, the hosting platform's page-view and error analytics scripts are currently blocked from running by the Website's browser security policy. You can contact us with questions about this processing.
We do not knowingly collect any Personal Information from children under the age of 18. If you are under the age of 18, please do not submit any Personal Information through the Website and Services. If you have reason to believe that a child under the age of 18 has provided Personal Information to us through the Website and Services, please contact us to request that we delete that child’s Personal Information from our Services.
We encourage parents and legal guardians to monitor their children’s Internet usage and to help enforce this Policy by instructing their children never to provide Personal Information through the Website and Services without their permission. We also ask that all parents and legal guardians overseeing the care of children take the necessary precautions to ensure that their children are instructed to never give out Personal Information when online without their permission.
Some browsers incorporate a Do Not Track feature that signals to websites you visit that you do not want to have your online activity tracked. Tracking is not the same as using or collecting information in connection with a website. For these purposes, tracking refers to collecting personally identifiable information from users who use or visit a website or online service as they move across different websites over time. The Website and Services do not track its visitors over time and across third-party websites. However, some third-party websites may keep track of your browsing activities when they serve you content, which enables them to tailor what they present to you. For a description of Do Not Track protocols for browsers and mobile devices or to learn more about the choices available to you, visit internetcookies.com
Marketing emails, such as newsletters and product news, are optional and separate from the Services. We only send them if you have opted in, and opting in is never a condition of using the Services. We use Mailchimp to send marketing emails to people who have opted in.
You can withdraw at any time by using the unsubscribe link in any marketing email or by contacting us. Withdrawing does not affect the lawfulness of earlier emails. You will continue to receive service emails that are necessary for your account, applications, carnets and invoices.
The Carnet Pro apps can send push notifications, for example about application or quote status, if you allow them on your device. To deliver them, a device token issued by your device's operating system is stored and associated with your account and device, and is processed by our push notification provider. Device tokens are used only to deliver notifications. You can stop push notifications at any time in your device or app settings.
The Website and Services contain links to other resources that are not owned or controlled by us. Please be aware that we are not responsible for the privacy practices of such other resources or third parties. We encourage you to be aware when you leave the Website and Services and to read the privacy statements of each and every resource that may collect Personal Information.
We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. We maintain reasonable administrative, technical, and physical safeguards in an effort to protect against unauthorized access, use, modification, and disclosure of Personal Information in our control and custody. However, no data transmission over the Internet or wireless network can be guaranteed.
Therefore, while we strive to protect your Personal Information, you acknowledge that (a) there are security and privacy limitations of the Internet which are beyond our control; (b) the security, integrity, and privacy of any and all information and data exchanged between you and the Website and Services cannot be guaranteed; and (c) any such information and data may be viewed or tampered with in transit by a third party, despite best efforts.
As the security of Personal Information depends in part on the security of the device you use to communicate with us and the security you use to protect your credentials, please take appropriate measures to protect this information.
In the event we become aware that the security of the Website and Services has been compromised or Users’ Personal Information has been disclosed to unrelated third parties as a result of external activity, including, but not limited to, security attacks or fraud, we reserve the right to take reasonably appropriate measures, including, but not limited to, investigation and reporting, as well as notification to and cooperation with law enforcement authorities.
In the event of a data breach, we will make reasonable efforts to notify affected individuals if we believe that there is a reasonable risk of harm to the User as a result of the breach or if notice is otherwise required by law. When we do, we will post a notice on the Website, send you an email. In jurisdictions where required, we may also report the breach to relevant authorities in accordance with applicable data protection regulations.
We reserve the right to modify this Policy or its terms related to the Website and Services at any time at our discretion. When we do, we will revise the updated date at the bottom of this page. We may also provide notice to you in other ways at our discretion, such as through the contact information you have provided.
An updated version of this Policy will be effective immediately upon the posting of the revised Policy unless otherwise specified. Continued use of the Website or Services does not constitute consent to new optional processing. Material changes of purpose that require consent will be presented separately so that you can make a choice.
Where we rely on your consent for optional processing, that consent is requested separately and you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it was withdrawn. Material purpose changes requiring consent will also be presented separately.
Depending on the circumstances and applicable law, you may have rights of access, correction, erasure, restriction, portability and objection in relation to your Personal Information. These rights are not absolute and may be subject to lawful conditions or exceptions. To exercise a right, contact carnets@mediacarnets.com.
If you have any questions, concerns, or complaints regarding this Policy, the information we hold about you, or if you wish to exercise your rights, we encourage you to contact us using the details below:
We will attempt to resolve complaints and disputes and make every reasonable effort to honor your wish to exercise your rights as quickly as possible and in any event, within the timescales provided by applicable data protection laws.
If you are in the UK, you may make a complaint to the UK Information Commissioner's Office without first obtaining our agreement. If you are in the European Union or European Economic Area, you may also complain to the data protection supervisory authority in the country where you live, work or where you believe an infringement took place. A list of EU supervisory authorities is published by the European Data Protection Board.
Last updated · 11 October 2026
Social media features
Our Website and Services may include social media features, such as the Facebook and Twitter buttons, Share This buttons, etc (collectively, “Social Media Features”). These Social Media Features may collect your IP address, what page you are visiting on our Website and Services, and may set a cookie to enable Social Media Features to function properly. Social Media Features are hosted either by their respective providers or directly on our Website and Services. Your interactions with these Social Media Features are governed by the privacy policy of their respective providers.