Terms and Conditions

Version 2.0 — March 2026

1. CARROT Network and Websites

Carrot Fndn is a Swiss foundation in the sense of Article 80 et seq. of the Swiss Civil Code with its registered seat in Zug ("Foundation").

The Foundation has developed and deployed the CARROT blockchain-based network ("Network"), which is managed by the Carrot Foundation in partnership with its community of stakeholders. The Network enables on-chain and off-chain recording of circular economy actions, including supply chain logistics and waste management activities; environmental measurement, reporting, and verification; auditing; recycling, composting, reuse, and recycled content use in products certification; as well as decarbonization. The circular economy actions taken by participants ("Participants") (e.g., raw material providers, packers, fillers, producers, waste generators, bin custodians, haulers, processors, recyclers, raw material buyers, methodology authors, methodology developers, auditors, and NGOs, among others) are recorded on the Network via mobile, software, and web applications of third-party Carrot Network Integrators ("INTs") that connect to the Network via APIs. Resources such as raw materials or waste mass ("MassIDs") and products ("ProductIDs") are codified as unique identifiers that establish chain of custody and material or product responsibility. Based on the recorded circular economy actions and the corresponding environmental and social gains realized, the Foundation generates non-fungible Tokenized Recycling Credits ("TRC"), Tokenized Carbon Credits ("TCC") as well as other types of credits, which are subsequently offered by the Foundation to interested third-party buyers ("Token Buyers"). The purchase of TRCs and TCCs by Token Buyers distributes proceeds ("Rewards") to the supply chain Participants who contributed in a collaborative manner to recover resources for reuse or recycling, thereby avoiding pollution to land, water, and the atmosphere and the need for new raw material extraction. For the purpose of these Terms and Conditions ("Terms"), the Participants and the INTs are collectively referred to as ("Users").

The Foundation hosts and maintains websites under the domain www.carrot.eco ("Websites") that allow users to learn about the Carrot Fndn and Network, its purpose, and how it functions; join the community; become versed in the circular economy; view reported circular economy data and Environmental & Social Claims of its Participants, purchase and retire tokens (e.g., TRCs, TCCs and others); confirm the retirement of credits (burned non-fungible tokens) in a public registry; and verify and compare environmental performance by all Participants, including through a leader board.

2. Acceptance of and Amendments to the Terms and Conditions

These Terms, together with any documents expressly incorporated by reference herein, govern the access to and use of the Websites, the Network, and related smart contracts. Furthermore, it governs the process for measuring, reporting, and verifying circular economy contributions ("Environmental & Social Claims") (e.g., avoided waste; avoided, captured, or removed greenhouse gas (GHG) emissions; green jobs; social and economic benefits; and others) and Rewards Users may receive, as further described below. By using the Websites and/or the Network, the Users agree to be bound by these Terms.

The use of the applications offered by the Carrot Blockchain Integrators (INTs) and any rights and obligations between Participants and INTs are not governed by these Terms but by other terms & conditions and/or agreements established between the parties.

The Foundation reserves the right to change or modify these Terms at any time at its own and sole discretion. By continuing to access, use, send, or have data sent by a third party (e.g., INT) to the Websites and/or the Network, the Users confirm that they accept the updated Terms and all the terms incorporated therein by reference. INTs and service providers ("Service Providers") such as Haulers, Processors and Recyclers, are also responsible for informing their customers, who are also Users, of updated terms and securing their acceptance of such Terms, especially as it relates to receiving Rewards that also involve those Users.

Any Participant/User who participates in the creation or sale of Tokenized Recycling Credits or Tokenized Carbon Credits is also bound by the Terms & Conditions for Recycling and Carbon Credit Token Sales and Purchases published under the Terms & Conditions section of the Carrot Network. The Terms & Conditions for Recycling and Carbon Token Credit Sales and Purchases shall be incorporated into these Terms by reference for all purposes.

3. Know Your Customer/Business ("KYC")

In order to participate in the Carrot Network, Users must provide individual identification information, such as their full name, mobile number, birthdate, email address, wallet address to which Rewards (as defined below) may be sent, residential address, document showing proof of residential address, nationalities, government ID for each nationality, and documents showing proof of government ID, including proof of possession, such as a photo of the person holding the ID.

In the case of a company, the legal representative must, in addition to providing individual identification information, provide documents showing proof of legal representation, a corporate email, the legal name of the corporation, the Tax ID of the company, and a document showing proof of Tax ID as well as any other information as may be reasonably requested from time to time by the Foundation, in order to complete the Foundation's examination ("KYC-Check"). Users and INTs must provide true, accurate, current, and complete information and must promptly update the Foundation electronically with any data changes. Additional information will be required of specific Participants, such as Processors and Recyclers (e.g., environmental licenses to conduct business) and NGO Beneficiaries to verify the qualifications of parties relating to the environmental works being performed.

Know Your Customer (KYC) and Know Your Business (KYB) checks may be conducted by the Carrot Network itself or by third parties on behalf of the Carrot Network.

4. User's Transfer of Rights

Users herewith transfer any and all past, present, or future rights, benefits, interests, credits, certificates, notes, claims, or authorizations, including reporting rights, claims on recycled or reuse of products and materials; carbon reduction, capture, or removal; or any other environmental, marketing, and similar rights or Environmental & Social Claims, resulting from or arising in connection with the data shared to the Network as it relates to circular economy actions (e.g., MassIDs, ProductIDs or other) in each case on an exclusive basis to the Foundation.

For the avoidance of doubt, the transfer of rights set forth in this Section 4 does not reflect or imply any present monetary value in the data or environmental actions shared by the User. The commercial value of any Environmental & Social Claim arises solely from the Foundation's application of the applicable Methodology, validation of the circular economy action, issuance of the corresponding credit or token, and its effective sale to a Token Buyer — a cycle that may or may not be completed. No single User holds ownership over any MassID, as the environmental gain represented by each credit results from the collective contribution of multiple supply chain Participants, each receiving only their proportional share of proceeds in accordance with the Rewards Distribution Policy upon a successful sale. The exclusive and irrevocable nature of the transfer serves solely to preserve the integrity of the crediting program for the protection of all Participants, Token Buyers, and the ecosystem as a whole. No liability shall attach to the Foundation solely by reason of this transfer in the event that no Token is issued or sold in connection with the relevant circular economy action.

For the avoidance of doubt, Users lose all of their rights to reporting Environmental & Social Claims in waste (Extended Producer Responsibility) or carbon (voluntary or mandatory) programs through the actions of recycling or reuse data submitted to the Network. Reporting of Environmental & Social Claims for the same product, resource, mass, or activity with another party is strictly prohibited, as this would constitute double counting and possibly double profiting on top of the same circular economy Environmental & Social Claims. Users may not themselves make any claim that in any way compromises the transfer of the Environmental & Social Claims to the Foundation. Furthermore, Users may not assign or transfer the Environmental & Social Claims in whole or in part to any party other than the Foundation. Any such prohibited transfer is null and void and can result in temporary or permanent removal from the Network as well as fines and legal action against the Participant.

Carrot holds the exclusive right to issue and sell credits (tokens) for the data provided to the network, upon validation and certification of circular economy actions — logistical events, chain of custody, and official hauling records (e.g., Waste Transport Manifests (Manifesto de Transporte de Resíduos (MTR) in Brazil)) recorded and tracked using the Network's MassID, RecycledID, ProductID, and GasID solutions. The minimum requirements for credit issuance include identifying the stakeholders involved in the final hauling leg to an accredited recycler without the need for full onboarding of the participants with the exception of the recycler, as long as the stakeholders are individually identified in official hauling records (e.g., MTRs in the case of Brazil).

The Carrot Fndn will in turn transfer the rights in Environmental & Social Claims to the Token (TRC or TCC) Buyer in exchange for the important investment realized by the buyer in supporting circular economy actions. Only following token retirement, thereby making it untransferable, will the Token Buyer be allowed to claim and use the associated Environmental & Social Claims. Retired tokens prove contributions realized by the holder of the token as an investment in ecosystem-driven waste and carbon avoidance, serving as proof of carbon offsetting and meeting Extended Producer Responsibilities in accordance with Carrot Standards. Retired tokens become eligible to be listed in the Carrot Registry and leaderboards. Such proofs may or may not be accepted by other registries, and Carrot is not responsible for their acceptance elsewhere, as this is beyond the control of Carrot Fndn.

5. Methodologies

The Carrot Network utilizes methodologies created by third-party contributors for use in verifying data and measuring environmental and social gain ("Methodologies"). Methodologies are written by Methodology Authors and developed by Methodology Developers and each Participant receives a portion of the Rewards generated by the TRCs and TCCs that result from the use of the Methodology. The Reward amounts are predetermined in the Rewards Distribution Policy for each material and are published on the website at Rewards Distribution Policy.

6. Homologation

Some Participants are deemed to have particularly important roles within the Carrot Network and will need to be accredited by the Foundation (or by one of its partners) to ensure performance capabilities, legal standing, and data quality are established.

Carrot Network Integrators who submit circular economy action data to the Network will need to be accredited for sufficient quality and security of the data provided. While data quality is the responsibility of the INT and the Users involved, verification of INT data will be continuously conducted by the Foundation and Network Participants.

NGO Beneficiaries will need to be accredited in order to be eligible to receive rewards from the Carrot Network. Homologation will involve submittal of the organization's governing documents; submittal of the organization's tax ID; proof of the organization's good standing to conduct business; proof of the organization's good standing with tax authorities; proof of the organization's mission or purpose to advance the transition to a circular economy; and proof that the organization is apolitical.

Processors and Recyclers need to be accredited for each Methodology utilized to certify recycling or reuse and issue TRCs and TCCs. Processors who receive and perform sorting activities, as well as Recyclers who do the important work of mass manipulation for transformation into new inputs, will be audited by an independent Auditor considered by the Foundation to be an expert in the field to ensure that they are capable of the environmental work being conducted and are in good professional and legal standing.

Homologation renewals will be dictated by the rules established by different methodologies, and it is the responsibility of each Participant to ensure that their accreditation is kept up-to-date. Homologation and renewals, including audits, may incur a cost for the candidate, and the cost will be communicated to the candidate in advance of the initiation of any accreditation work. The candidate will, of course, have every right to reject the accreditation work, which will result in the automatic disqualification of the candidate when the accreditation period expires. Carrot will always seek to establish a fair value for accreditation work, considering the costs and value of the work employed by Auditors and the accreditation team. Carrot's accreditation team can be reached at operations@carrot.eco.

7. Rewards

Subject to the transfer of rights, successful passing of the KYC Check, verification of circular economy action data submitted to the Network by INTs, and certification under a methodology ("Methodology") selected by the accredited Recycler, Users may be rewarded with a portion of the proceeds generated by the sale of tokens (e.g., TRC and TCC) to Token Buyers ("Rewards").

Rewards, if any, will be paid out in tokens, in the amount determined by the Foundation and its supporters, and executed through the smart contracts developed or approved by the Foundation, directly to the wallet address provided by the User. Each User is fully responsible for providing the Foundation with a functioning wallet address held by them for their own account and for claiming the tokens that were reserved or distributed to them from the Network.

Access to and redemption of credit rewards (USDC or $Carrot) reserved in the Smart Contract for each participants based on the Rewards Distribution Policy, are strictly conditional upon the completion of onboarding (including the KYC/KYB process) and the full acceptance of the Carrot Network Terms of Use and Sales and Purchases of TRCs and TCCs by the respective Participant. The reward redemption period is 90 calendar days from the credit sale date, designed to incentivize supply chain digitalization, stakeholder onboarding, and improved waste sorting. Upon expiration of this period, unclaimed rewards will be automatically transferred to the Carrot Community Fund, canceling the User's opportunity to withdraw said rewards (incentives) from given credits. The User may sign the terms at any time and begin participating in earning rewards at any time for credits sold less than 90 calendar days ago and in future credit issuance.

The Rewards and their distribution allocations are predetermined in the rewards distribution policy of the Foundation ("Reward Policy"), which is available on the Carrot Network Website under Rewards Distribution Policy. The Reward Policy may be amended by the Foundation at any time at its discretion to benefit the community as a whole. However, amendments will be communicated to all Participants through the primary email address that was provided for each account, providing reasonable time for any adjustments if they are deemed necessary.

Particular attention should be given to the rewards distribution discounts to service providers designed to encourage supply chain digitization (i.e., the "Incentive Mechanism") when the Waste Generator is not identified, as well as to Waste Generators who are "Large Revenue" businesses, designed to ensure credit buyers are not discouraged from purchasing credits that distribute proceeds to large organizations while also maintaining sufficient incentive to ensure participation and network adoption. The Waste Generator plays a key role in the circular economy because he/she/it makes the determination of whether and how to sort post-consumer and post-industrial waste and products and, ultimately, if those will in fact be recovered for reuse and/or recycling.

Participants may also be temporarily or permanently excluded from receiving rewards if the Foundation or a third-party auditor ("Auditor") identifies behavior that is deemed unethical, illegal, criminal, or other and/or appears to show collusion with other Participants regarding reported circular economy actions, including but not limited to overstating the recycling or reuse activities and corresponding Environmental & Social Claims achieved. The exclusion in rewards distribution may be directed to the Participants directly involved as well as to users who are related to the Participants, penalizing such Participants through association. Such penalties are fundamental to deter bad actors and align interests in reporting data with the highest quality possible onto the Network. Such a mechanism for ensuring self-policing of data quality on the Network is often referred to as Proof-of-Authority, or ("PoA"). For more information, see the section below on Penalties and Suspensions.

Participants who are penalized by not receiving rewards from credit sales due to credits that were prevented from being sold, either for suspicious activity or identified as containing compromised data, recognize that, even if they have no part in the activities of the Bad Actor(s), that the penalty serves as a fundamental component of the network's self-policing mechanism required for ensuring high-quality data on the Network. The penalized good actor agrees to not dispute or take any action against the Carrot Fndn for Rewards not distributed to them. Penalized Participants should also not take action against any other good actors who are also involved, for no fault of their own. Good actors are invited to communicate with the identified Bad Actor to ensure actions are corrected and, if matters cannot be resolved, to change service providers and/or work with other Participants. Bad Actors shall be solely responsible for indemnifying and holding harmless the Participants from and against any claims, losses, and penalties, whether civil, criminal, tax, administrative, environmental or otherwise, resulting from the action or omission of such Bad Actor.

All Participants, as members of a Network, are each deemed responsible for documenting their circular economy actions and reporting Environmental Claims accurately and understand that rewards serve only as a bonus when all activities can be reasonably verified, and Participants are conducting their circular economy actions correctly.

7A. Impact Recognition Program

By accepting these Terms, the Participant grants the Foundation a non-exclusive, royalty-free authorization to publicly disclose the environmental results and impacts generated by their organization on the Network — including waste volumes recovered and recycled, carbon emissions reduced, prevented or removed, certificates and credits (recycling, carbon and other) issued and retired — on the Carrot website, social media channels, whitepapers, and institutional materials, with the purpose of publicly recognizing their contribution to the low-carbon, inclusive circular economy and encouraging others to participate.

Only environmental impact data and the organization's name, logo and website will be used, along with any further information voluntarily provided by the organization. No personal data of individual Users will be disclosed under this Section.

Participants who do not wish to be featured may opt out at any time by written notice to legal@carrot.eco, without affecting their participation in the Network or their right to receive Rewards. Opt-out requests will be processed within 15 business days.

8. Service Fees

The Carrot Fndn, organizations that represent it or utilize the network, may charge fees associated with services provided, including, but not limited to, data use, data storage, digital Monitoring, Measurement, Reporting and Verification (dMRV), auditing and certification of supply chains, reuse, recycling, composting, energy production, greenhouse gas emissions measurement (production, avoidance, prevention, removal and capture,) proof of recycled-content use in products, certification and issuance of credits and any additional services that may be offered for measuring and monetizing environmental, financial and social impacts.

Any fees associated with services provided will be communicated to Participants in advance and require prior approval by the User before being charged.

9. Intellectual Property Rights

Users acknowledge and agree that the Carrot White Paper, Websites available at www.carrot.eco, docs.carrot.eco and www.explore.carrot.eco, including their "look and feel" (e.g., graphics, design, text, images, logos, page headers, button icons, and scripts); proprietary content, information, and other materials; and all content and other materials contained therein, including, without limitation, the Foundation's and the Carrot Network's logo and all designs, text, graphics, pictures, data, software, sound files, other files, and the selection and arrangement thereof are the proprietary property of the Foundation or its affiliates, licensors, or Users, as applicable, and the Users agree not to take any action(s) inconsistent with such ownership interests. The Foundation and its affiliates and licensors, as applicable, reserve all rights in connection with the White Paper, Websites, and their content, including, without limitation, the exclusive right to create derivative works. Except as expressly set forth herein, Users' use of the Network or Websites does not grant to Users ownership of any other rights with respect to any content, code, data, or other materials that Users may access on or through the Network or Websites.

10. Code of Conduct

The Foundation may issue rules for the use of the Network and Websites and amend them at its own and sole discretion ("Code of Conduct"). Users are obliged to inform themselves about the current version of the Code of Conduct and ensure that they and their respective communities comply with the Code of Conduct.

The current Code of Conduct is described in the Carrot White Paper under the Governance section and subsections for Community Values and Community Guidelines.

11. Penalties and Suspensions

In the event of any irregularities in activities or in the reporting of data relating to a Participant, flagged as a potential "Bad Actor," Carrot Fndn or an accredited independent third-party Auditor, may suspend the Participant immediately from involvement in the Network and participation in the issuance of certificates and/or TRCs and TCCs. Participants associated with any Bad Actors may also be suspended immediately. Additional information may be requested from all of the Participants involved until sufficient clarification has been provided in order to determine how long the penalty may be or if and when the Participant may be reinstated. If a credit is found to contain, or potentially contain, bad data and the credit has already been sold, any proceeds not yet distributed will be directed to Carrot's Community Fund for use as the community deems most appropriate. Carrot Fndn has no obligation to return the value associated with the credits that were reserved for the Participants while they have been penalized. Again, the burden rests on each Participant to ensure that the data being provided is accurate and that they are working with other Participants who take the work of data quality seriously.

If any participant fails to provide a response to the request for information within 30 days, the participant may be permanently disqualified from participating in the Network and the issuance of credits.

For the period in which the activities in question failed to meet the requirements of a given methodology, participants will not receive any rewards from the sale of TRCs or TCCs.

During the period of non-compliance, TRCs or TCCs issued prior to this period involving the Bad Actor and not yet sold will be prevented from being sold until the situation is resolved.

In the event of fraud being identified for any of the requirements of a given methodology, accredited Participants will permanently lose their Homologation rights, and appropriate legal measures may be taken.

Any evidence of intentional practices that negatively impact the well-being of local communities or of natural ecosystems will serve as solid justification for permanent exclusion from participating in the Network.

Legal action may be taken by the Carrot Fndn against the party for any damages done to the Foundation or the Network in accordance with the degree and involvement of each Party relating to the damages.

12. Communication

Users agree and understand that the Foundation will communicate with Users via electronic means. Users agree to keep their email address current and to notify the Foundation of any changes. Users agree that any notices, agreements, disclosures, or other communications delivered to their email addresses are considered valid.

13. Representations and Warranties of the Users

The Users represent and warrant to the Foundation the following, and acknowledge that the Foundation is relying on these representations and warranties:

1. If Users are entities, they are duly organized, validly existing, and in good standing under the laws of its domicile;

2. If Users are entities, they have the full right, power, and authority to use the Websites, the Network and related smart contracts and accept these Terms;

3. If User is a natural person, they are of legal age in the jurisdiction applicable to them and have the right, authority, and capacity to enter into these Terms;

4. They own or have secured all rights (including intellectual property rights), consents, clearances and approvals necessary to be able to grant the rights granted hereunder;

5. If the User is an accredited Recycler, they acknowledge that, under Carrot's crediting program and corresponding methodologies, they assume the role of the final, key stakeholder along the waste recovery and recycling chain that transforms waste into a resource, acting also as the "Project Developer" for credit issuance purposes. The Recycler commits to informing its supply chain Participants (the waste Generator, Bin Custodians, Haulers, and Processors,) associated with the waste mass it is recycling, of the opportunity to participate in the rewards distribution that may be produced from credit sales — inviting them to onboard the Carrot platform, notifying them of the reward redemption deadline, and explaining how their data is shared and protected in accordance with Carrot's Terms and Conditions and Privacy Policies.

6. They will not transfer the Environmental & Social Claims in whole or in part to any party other than the Foundation, and they will not themselves make any claims that in any way compromise the transfer of the Environmental & Social Claims to the Foundation or the party to which the Foundation further transfers the claims upon the sale and retirement of TRCs and TCCs;

7. There is no guarantee as to the number of Rewards Users will receive or whether they will receive any Rewards at all;

8. They are allowed to receive and hold Rewards in tokens, if any, according to the laws and regulations applicable to them;

9. They are not listed, or associated with any person or entity listed, on any of the US Department of Commerce's Denied Persons or Entity List, the US Department of Treasury's Specially Designated Nationals or Blocked Persons Lists, the US Department of State's Debarred Parties List, the EU Consolidated List of Persons, Groups and Entities Subject to EU Financial Sanctions, or the Swiss SECO's Overall List of Sanctioned Individuals, Entities and Organizations, and neither they nor any of their affiliates, officers or directors is a resident of a country or territory that has been designated as non-cooperative with international anti-money laundering principles or procedures by an intergovernmental group or organization, such as the Financial Action Task Force on money laundering;

10. They confirm not to be resident of, citizen of or located in a geographic area that is subject to UN-, US-, EU-, Swiss, Brazil-, or any other sovereign country sanctions or embargoes (including, but not limited to: Belarus, Burundi, Central African Republic, Congo, DPRK (North Korea), Guinea, Guinea-Bissau, Iran, Iraq, Lebanon, Libya, Mali, Myanmar (Burma), Republic of South Sudan, Russia, Somalia, Sudan, Syria, Ukraine, Venezuela, Yemen, or Zimbabwe);

11. They are not domiciled in or organized under the laws of any country, whose legislation conflicts with the present allocation of tokens and/or the purpose of the Foundation in general;

12. The Contributor understands and agrees that it is not entitled to sell, donate, pledge or transfer in any other way the tokens to persons as defined in items [9–11] above;

13. They have such knowledge and experience in financial and business matters that they are capable of evaluating the merits and risks of agreeing to these Terms and using the Network and Websites;

14. They have a deep understanding of the functionality, usage, storage, transmission mechanisms and intricacies associated with cryptographic tokens and blockchain-based software systems;

15. They have been advised that the use of the Website, the Network and related smart contracts and the tokens to be transferred by/to/from them hereunder may, in certain jurisdictions, be considered securities, and that such issuance and/or transfer may be subject to securities laws;

16. All information provided by them is true, current, accurate and complete, and they do not act on behalf of any third party;

17. They are using the Websites, the Network and/or related smart contracts in line with the Code of Conduct, as determined in these Terms and Conditions, and under no circumstances shall be used for any illegal purposes;

18. They understand and expressly accept that there is no warranty whatsoever on the Website, the Network and/or related smart contracts, expressed or implied, to the extent permitted by law, and that the use of Websites or Network is at their own and sole risk on an "as is" and "under development" basis and without, to the extent permitted by law, any warranties of any kind, including, but not limited to, warranties of title or implied warranties, merchantability or fitness for a particular purpose. They are aware that they will not receive money or any other compensation for any damages they might incur in connection with the use of the Network or Websites;

19. They have not relied on any representations or warranties made by the Foundation or any other person outside of those made in these Terms, including but not limited to, conversations of any kind, whether through oral or electronic communication or any presentation, technical paper, white paper, social media content or website posting;

20. They have not granted any other party any rights that conflict with the rights granted herein;

21. THEY HEREBY WAIVE THE RIGHT TO PARTICIPATE IN ANY CLASS-ACTION LAWSUIT OR CLASS-WIDE ARBITRATION AGAINST ANY ENTITY OR INDIVIDUAL INVOLVED IN THE DEVELOPMENT OR PROVISION OF THE WEBSITES, THE NETWORK AND/OR RELATED SMART CONTRACTS.

14. Representations and Warranties of the Foundation

The Foundation represents and warrants to the Users the following, and acknowledges that the Users are relying on these representations and warranties:

1. The Foundation is a foundation duly organized, validly existing, and in good standing under the laws of Switzerland and has all requisite corporate power and authority to carry on its statutory purpose and operation as now conducted and as presently proposed to be conducted.

2. The Foundation has all the requisite power and authority to carry out and perform its obligations under these Terms. These Terms constitute a legal, valid, and binding obligation of the Foundation enforceable against the Foundation in accordance with its terms, except that such enforceability may be limited by applicable bankruptcy, insolvency, reorganization, moratorium, and similar laws of general application relating to or affecting creditors' rights generally and by equitable principles (regardless of whether enforcement is sought in a proceeding in equity or at law).

3. The execution, delivery, and performance under these Terms require no approval or other action from any person other than the Foundation.

4. There are no actions pending or threatened against or by the Foundation or any affiliate of the Foundation that challenge or seek to prevent, enjoin, or otherwise delay the transactions contemplated by these Terms. No event has occurred, or circumstances exist that may give rise to or serve as a basis for any such action.

15. Indemnifications

Users agree to the fullest extent permitted by applicable law, to indemnify, defend, and hold harmless the Foundation, and its respective past, present, and future employees, officers, directors, contractors, consultants, equity holders, suppliers, vendors, service providers, parent companies, subsidiaries, affiliates, agents, representatives, predecessors, successors, and assigns (individually and collectively, the "Foundation Parties"), from and against all actual or alleged claims, damages, awards, judgments, losses, liabilities, obligations, penalties, interests, fees, expenses (including, without limitation, attorneys' fees and expenses), and costs (including, without limitation, court costs, costs of settlement, and costs of pursuing indemnification and insurance), of every kind and nature whatsoever, whether known or unknown, foreseen or unforeseen, matured or unmatured, or suspected or unsuspected, in law or equity, whether in tort, contract, or otherwise (collectively, "Claims"), including, but not limited to, damages to property or personal injury, that are caused by, arise out of or are related to (a) misuse of the Website, (b) any Feedback Users provide, (c) violation or breach of these Terms (in particular but not exhaustively Section 5 of these Terms) or applicable law, (d) violation of the rights of or obligations to a third-party, including another User, and (e) Users negligence or willful misconduct. They agree to promptly notify the Foundation of any Claims and cooperate with the Foundation Parties in defending such Claims. They further agree that the Foundation Parties shall have control of the defense or settlement of any Claims. This indemnity is in addition to, and not in lieu of, any other indemnities as set forth in a written agreement between Users and the Foundation.

User accepts and acknowledges the risks related to the use of the Network, as set forth in these Terms. The User acknowledges and agrees that, while Carrot applies data security measures and software management, including encryption and cryptography, Carrot is not responsible for any risk related to the use of the Network including, but not limited to, the activity, personal data, and service obligations of the User. Notwithstanding, Carrot's liability for any losses and damages due to the breach of these Terms shall be limited to the total amount of payments made by the User to Carrot in connection with any Network services in the prior twelve (12) months. Any indirect damages are expressly excluded from Carrot's liabilities, including, but not limited to, loss of opportunity, damages, consequential damages, reputational damage, or other.

16. Disclaimers

Users' access to and use of the Websites, the Network and related smart contracts are at their own risk. They understand and agree that the service is provided on an "as is" and "as available" basis, and the Foundation expressly disclaims warranties or conditions of any kind, either express or implied. The Foundation and its officers, employees, directors, shareholders, parents, subsidiaries, affiliates, agents, and licensors make no warranty or representation and disclaim all responsibility for whether the services of the Foundation: (a) will meet Users' requirements; (b) will be available on an uninterrupted, timely, secure, or error-free basis; or (c) will be accurate, reliable, complete, legal, or safe. The Foundation disclaims all other warranties or conditions, express or implied, including, without limitation, implied warranties or conditions of merchantability, fitness for a particular purpose, title and non-infringement.

The Foundation will not be liable for any kind of action taken or taken in reliance on material or information contained on the Websites or Network.

While the Foundation attempts to make the access to and use of the Websites and Network safe, it cannot and does not represent or warrant that the Network or Websites will be available at all times, free of viruses or other harmful components. While the Foundation takes data security seriously and employs solutions such as encryption and cryptography, it cannot guarantee the security of any data that Users disclose online. No advice or information, whether oral or obtained from the Foundation parties or through the service, will create any warranty or representation not expressly made herein. Users accept the inherent security risks of providing information and dealing online over the internet and will not hold the Foundation responsible for any breach of security.

The liability of the Foundation for direct and indirect damages — regardless of the legal ground — is expressly excluded to the maximum extent permitted by law. Likewise, contractual liability for actions or omissions of auxiliary persons, as well as the non-contractual liability of the Foundation is excluded to the maximum extent permitted by law. The Foundation will not be responsible or liable to Users for any loss and take no responsibility for, and will not be liable to Users for, any use of the Website, the Network, and related smart contracts, content, and/or content linked to or associated with any losses, damages, or claims arising from: (a) Users error, incorrectly constructed transactions, or mistyped addresses; (b) server failure or data loss; (c) unauthorized access or use; (d) any unauthorized third-party activities, including without limitation the use of viruses, phishing, brute-forcing or other means of attack against the service. Notwithstanding the foregoing, nothing in this Section shall exclude or limit Carrot's liability for direct damages arising from Carrot's own breach of these Terms, which shall remain subject to the liability cap set forth in Section 15.

The Foundation is not responsible or liable for any sustained losses or injury due to vulnerability or any kind of failure, abnormal behavior, or software (e.g., wallet, smart contract), the Website, the Network, and related smart contracts. The Foundation is not responsible for losses or injury due to late reports by developers or representatives (or no report at all) of any issues with the Website, the Network, and/or related smart contracts.

The Foundation is not responsible for the correct recording of circular economy actions on the Network. Any and all liability of the Foundation in connection with the erroneous, omitted or failed recording of circular economy actions on the Network is explicitly excluded. However, the Foundation shall remain liable for direct damages caused by errors in the recording of circular economy actions attributable to its own systems or processes, subject to the liability cap set forth in Section 15.

The foregoing does not affect any warranties that cannot be excluded or limited under applicable law. To the extent the Foundation may not, as a matter of applicable law, disclaim any (implied) warranty, the scope and duration of such warranty shall be the minimum permitted by applicable law.

17. Risks

Users accept and acknowledge the risks connected to the use of Websites, the Network, and related smart contracts. In particular, but not exhaustively, the Users understand the inherent risks listed hereinafter. By using the Website, the Network, and/or related smart contracts, the Users acknowledge and assume these risks:

17.1 Risk of Software Weaknesses

The Users understand and accept that the Network and related smart contracts, other involved software and technology as well as technical concepts and theories are still unproven in a live (non-test) environment, which is why there is no warranty that the process for setting up communities and initiatives, issuing, receiving, use and ownership of the tokens will be uninterrupted or error-free and there is an inherent risk that the software and related technologies and theories could contain weaknesses, vulnerabilities or bugs causing, inter alia, the complete loss of the tokens.

The Users particularly understand and accept that the Network and related smart contracts are (once decentralized) immutable and that, consequently, it may be difficult or impossible to cure software weaknesses.

17.2 Regulatory Risk

The regulatory regime governing blockchain technologies, cryptocurrencies, and tokens is uncertain, and new regulations or policies may materially adversely affect the use of the Website, the Network and/or related smart contracts.

The Users understand and accept that blockchain technology allows new forms of interaction. There is a possibility that certain jurisdictions will apply existing regulations or introduce new regulations addressing blockchain technology-based applications, in a way that may be contrary to the current setup and which may, inter alia, result in substantial modifications to the Website, the Network and/or related smart contracts, including the termination of the Project and the loss of the tokens or their functionality for the Users.

The Users understand and accept that certain regulators may nevertheless qualify tokens as securities or other financial instruments under their applicable law. It remains in the Users responsibility to comply with any laws and regulations applicable to the Users when holding or transferring tokens.

The Users explicitly accept and acknowledge that the Foundation assumes no liability for any and all risks relating to taxation or regulatory issues in connection with the use of the Website, the Network, and/or related smart contracts. It remains the sole responsibility of the Users to seek local legal, tax, and regulatory advice.

17.3 Risk of Abandonment / Lack of Success

A lack of use or public interest in the creation and development of distributed ecosystems could negatively impact the development of those ecosystems and related applications and could therefore also negatively impact the potential utility or value of the Website, the Network and/or related smart contracts.

17.4 Risk of Third-Party Providers

The services of the Foundation may rely on third-party software. If the Foundation is unable to maintain a good relationship with such third parties; if the terms and conditions or pricing of such third parties change; if the Foundation violates or cannot comply with the terms and conditions of such third parties; or if any of such third parties loses market share or falls out of favor or is unavailable for a prolonged period of time, access to and use of the Website, the Network and/or related smart contracts may suffer.

17.5 Risk of Private Key Loss

Tokens allocated to a particular address can only be accessed with the private key that corresponds to that address. The Users understand and accept that if the private key file or wallet password were lost or stolen, the access to the Users' address as well as to the tokens allocated to them would be unrecoverable and would be permanently lost. The Foundation neither has control over the Users' addresses; therefore, the Users shall have no recourse to seek any refunds, recovery, or replacements from the Foundation in the event that they cannot access other Users' address as well as to the tokens anymore and/or any tokens are lost or stolen.

17.6 Risk of Theft

The Users understand and accept that, while best efforts are made to reduce potential software attacks on the Website, the Network and related smart contracts, other involved software, and/or other technology components may be exposed to attacks by hackers or other individuals that could result in theft or loss of the tokens.

17.7 Risk of Network Attacks and Forks

The User understands and accepts that, as with other blockchains, the blockchain used for the Network could be susceptible to consensus-related attacks, including but not limited to double-spend attacks, majority validation power attacks, censorship attacks, and byzantine behavior in the consensus algorithm, or be subject to forks. Any successful attack or fork presents a risk to the Network and/or related smart contracts, the expected proper execution and sequencing of token transactions, the expected proper execution and sequencing of contract computations, as well as the token balances in the wallet of the Users.

There are risks associated with using Internet and blockchain-based products, including but not limited to, the risk associated with hardware, software, and internet connections, the risk of malicious software introduction, and the risk that third parties may obtain unauthorized access to information stored within User Account. Users accept and acknowledge that the Foundation will not be responsible for any communication failures, disruptions, errors, distortions, or delays they may experience when using the Website, the Network and/or related smart contracts for transactions, however caused.

18. Data Protection

18.1 In relation to the performance of its services, the Foundation may process company identification data and User's personal data to ensure that Participants are properly identified and their User, Organization and Data declarations are accurate and in accordance with the Carrot Fndn Privacy Policy.

18.2 To the extent that Network Integrators (INTs) collect personal data of other Users or third parties and disclose it to the Foundation by publishing it on the Network, it is the INT who is responsible for the lawfulness of any such Use and processing, pursuant to local privacy laws (i.e., GDPR or Article 39 of the LGPD in Brazil) and will hold the Foundation harmless in relation to any damages that arise or are claimed against the Foundation in the event of unlawful processing carried out under the INT's responsibility.

If any tools provided by the Network are utilized by the INT to assist in personal data protection, it is the INT's responsibility to ensure that the tools are utilized properly and kept up-to-date.

18.3 By accepting these Terms, the User agrees that their identification data will be used for the purposes of validating chain of custody and performing multiparty verification. Carrot, through its Network Integrators, Recyclers, and Auditors guarantee that the identification data of Generators and Transporters will be treated as private and masked on the Explorer and any public interface and managed in strict compliance with the local privacy laws. Public disclosure of such data is conditional upon the User's declared consent upon onboarding. Data from the entire chain of custody will remain visible at all times to the Foundation and accredited auditors for the purposes of verification and certification by independent third parties, as required for issuing high-integrity and regulatory-eligible credits (tokens). The foregoing does not apply to the public disclosure of organizational-level environmental impact data under Section 7A (Impact Recognition Program), which is governed exclusively by the terms of that Section.

18.4 Each party is responsible for adherence to local privacy laws concerning personal data management under its effective control and processing. The Foundation's liability is limited to personal data processed directly by it or under its instruction and does not extend to data processed by INTs, sub-processors contracted by Users themselves, or third parties outside the Foundation's operational scope.

18.5 The Foundation implements and maintains appropriate technical and administrative measures to protect personal data against unauthorized access, destruction, loss, alteration, or improper disclosure, as detailed in the Privacy Policy. Notwithstanding, Users acknowledge that no technological system offers absolute security and that the Foundation shall not be liable for security incidents arising exclusively from zero-day vulnerabilities not yet identified by the security community, state-level or critical infrastructure attacks beyond the Foundation's reasonable control, or failures in third-party systems, networks, or infrastructures over which the Foundation has no direct operational control.

18.6 In the event of a security incident that may entail relevant risk or harm to data subjects, the Foundation will notify the relevant supervisory authority and the affected data subjects within the applicable legal deadlines: 72 (seventy-two) hours for the GDPR supervisory authorities (GDPR, Art. 33) and the ANPD (LGPD, Art. 48 and Resolution CD/ANPD No. 15/2024); and as quickly as possible for the FDPIC (revDSG, Art. 24). Notification shall include (i) the nature of the affected data; (ii) information on the data subjects involved; (iii) technical measures adopted; and (iv) risks related to the incident and actions taken to mitigate their effects.

18.7 Users are responsible for protecting the privacy of personal data of other Users and third parties under their control or inserted into the Network. In the event of gross negligence, intentional leakage, or attacks promoted or facilitated by the User, the Foundation may adopt the measures set forth in Section 11 of these Terms, including suspension, penalties, and legal action, without prejudice to applicable civil and criminal liability.

18.8 One party shall not be held liable for acts, omissions, or violations of data protection legislation committed by the other party, its agents, and/or contractors.

18.9 Failure to comply with the obligations set forth in the aforementioned data protection laws and in this contract by the user will result in its immediate termination.

Attention should be given to laws such as the EU's General Data Protection Regulation (GDPR)¹, The Council of Europe's Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data², the California Consumer Privacy Act (CCPA)³ and Brazil's General Law for Protection of Personal Data (LGPD)⁴, to name a few.

19. Modifications to the Website

The Foundation reserves the right, in its sole discretion, to modify, suspend, or discontinue, temporarily or permanently, the provision of its Websites or Network (or any features or parts thereof) at any time and without liability as a result. The Foundation commits to communicating such actions to Participants in advance on every occasion, except when the action taken is necessary to protect the security of all Participants.

20. Tax

The Users are solely responsible for determining what, if any, taxes apply to their use of the Website, the Network, and/or related smart contracts, as well as to the transfer of Environmental & Social Claims. The Foundation is not responsible for determining or paying the taxes that apply to such use.

21. Miscellaneous

21.1 Relationship of the Parties

The Foundation and the Users are independent contractors. These Terms do not create, nor are they intended to create, a partnership, franchise, joint venture, agency, fiduciary, or employment relationship between the Parties.

21.2 Severability

If any provision of these Terms is invalid, illegal, or unenforceable in any jurisdiction, such invalidity, illegality, or unenforceability shall not affect any other provision of the Terms or invalidate or render unenforceable such provision in any other jurisdiction. Upon such determination that any provision is invalid, illegal, or unenforceable, the Terms shall be modified to effectuate the original intent of the original provision as closely as possible.

21.3 Assignment

Notwithstanding the possibility to grant access to the User Account to other Users, Users may not assign or transfer any rights and licenses granted under these Terms, without the prior written (text form sufficient) consent of the Foundation. The Foundation may freely assign or transfer any rights and licenses granted under these Terms without restriction, upon communication to the Users and Participants informing them of such assignments.

21.4 Applicable Law and Jurisdiction

These Terms, as well as the use of the Website, the Network, and related smart contracts, shall be governed by and construed in accordance with the substantive laws of Switzerland. The application of the United Nations Convention on Contracts for the International Sale of Goods shall be excluded.

Any dispute arising out of or in conjunction with these Terms shall be submitted to the exclusive jurisdiction of the courts of the city of Zug, Switzerland.

Notwithstanding the choice of Swiss law and jurisdiction set forth above, where mandatory consumer protection laws, data protection regulations, or other non-waivable statutory provisions of the User's jurisdiction of residence grant rights or protections that cannot be excluded or limited by contract, such mandatory provisions shall apply to the extent required by applicable law. This carve-out does not affect the validity or enforceability of any other provision of these Terms, nor does it constitute a waiver of Swiss law as the governing law for all matters that the parties may freely contract upon.

For the avoidance of doubt: (i) this provision applies where local law is mandatory and cannot be displaced by contract, such as consumer protection statutes, data protection laws, and labor regulations; (ii) it does not apply to commercial or operational matters freely governed by these Terms; and (iii) the class-action waiver set forth in Section 13(21) applies to the fullest extent permitted by the applicable mandatory law of the User's jurisdiction.

Footnotes

1. EU: General Data Protection Regulation — gdpr.eu ↩

2. ETS No. 108, Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Council of Europe (CoE). ↩

3. California Privacy Protection Agency: The California Privacy Rights Act of 2020 — cppa.ca.gov/regulations/ ↩

4. LEI Nº 13.709, DE 14 DE AGOSTO DE 2018. BRASIL, Lei Geral de Proteção de Dados Pessoais (LGPD) — planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm ↩