Data processing terms

Subject matter and purpose

Provision of the CBAMReturn service: threshold monitoring, indicative liability, supplier data collection, records keeping, reporting and support. Duration: while you have an account, plus the backup retention period (30 days) after deletion.

Data and data subjects

Business contact data of your staff, your suppliers' staff and your agents (names, work emails, roles); commercial import data (customs entries, values, commodity codes, supplier and installation names, EORI numbers); documents you place in the records vault; audit records of actions in your organisation (actor, action, IP address, time). No special-category data is expected; do not upload any.

Our obligations

• Process personal data only on your documented instructions, which these terms and your use of the service constitute.
• Keep it confidential; staff with access are bound by confidentiality.
• Apply appropriate security: UK hosting, encryption in transit, hashed credentials, two-step verification, per-organisation isolation, audit logging, checksummed document storage, nightly backups with a rehearsed restore, automated tests on every change.
• Use only the listed subprocessors, tell you of any change with 30 days to object, and flow down equivalent terms.
• Help you meet data-subject requests and your own security and impact obligations, given what we hold.
• Tell you without undue delay, and within 72 hours of becoming aware, of any personal data breach affecting your data.
• Delete or return all personal data at the end of the service (export is self-service at any time), except what law requires us to keep.
• Make available the information needed to demonstrate compliance and allow audits on reasonable notice.

Agents and client workspaces

Where a customs broker or other agent creates a client workspace, the agent warrants it has the client's authority, and remains the client's processor (or joint controller) as their engagement provides; we are the agent's subprocessor for that data. Client staff invited into a workspace see only that workspace.

Location and transfers

Data is stored and processed in the United Kingdom. Transactional email is sent through a US-based provider under standard contractual clauses; only the recipient address and message content pass through it.

Contact

Data protection queries: hello@cbamreturn.co.uk. See also the privacy policy.