How we collect, use and protect your personal data
Archimedes Lever Ltd (trading as CBAM Proof) is the data controller for personal data collected through cbamproof.co.uk. Registered in England and Wales, company number 16859569. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Generate your CBAM liability estimate and CPR calculation | Contract performance (Art. 6(1)(b)) |
| Deliver your CBAM compliance report and supplier risk assessment | Contract performance (Art. 6(1)(b)) |
| Retain CBAM compliance records for the statutory 6-year period (Reg. 16) | Legal obligation (Art. 6(1)(c)) |
| Send follow-up communications about your CBAM readiness | Legitimate interests (Art. 6(1)(f)) |
| Improve the platform and fix errors | Legitimate interests (Art. 6(1)(f)) |
| Understand how visitors use the site, via Google Analytics | Consent (Art. 6(1)(a)) — only where you've accepted analytics cookies |
We use the following third-party processors, all bound by data processing agreements:
We do not sell your personal data. We do not share your data with HMRC unless required by law.
Google LLC is based in the United States. Where personal data is transferred to it, this is protected by the EU Standard Contractual Clauses (Modules 2 and 3) together with the UK International Data Transfer Addendum, as set out in Google's published Data Processing Addendum. Stripe, Inc. transfers are covered by Stripe's own Data Processing Agreement, which incorporates the same UK-approved transfer mechanism. We review these safeguards periodically and will update this section if a provider's transfer mechanism changes.
Where you engage us for the Verified Facility Data Service, Readiness Audit, or Continuous Compliance Retainer, you or your suppliers may provide commercially sensitive information about overseas installations — including production data, emissions figures, and supplier or mill identities. This is generally not personal data under UK GDPR unless it identifies a specific individual (for example, a named contact person), and is instead protected as confidential commercial information under the terms of your engagement with us.
We do not share this data with other clients, suppliers, or third parties beyond what's needed to deliver your engagement, and we do not use one client's supplier data to inform our work for another. Where analysis is assisted by AI tools, the same processors and safeguards described elsewhere in this policy apply. Specific confidentiality terms for a given engagement are set out in that engagement's own agreement, which takes precedence over this general policy for anything it covers.
Contact: legal@cbamproof.co.uk. We respond within one calendar month. You may also complain to the ICO at ico.org.uk.
CBAM Proof uses strictly necessary cookies at all times. We also use Google Analytics (GA4) to understand how visitors use the site, but only where you've given consent via our cookie banner — this cookie is never set without your explicit agreement, and declining it doesn't affect anything else on the site. See our Cookie Policy for full details.
Material changes will be notified to registered users by email. Current version always available at cbamproof.co.uk/privacy. Effective from 9 April 2026.