This Privacy Policy applies to cbamproof.co.uk, operated by Archimedes Lever Ltd (trading as CBAM Proof). For privacy enquiries contact legal@cbamproof.co.uk.
1.1Who we are
Archimedes Lever Ltd (trading as CBAM Proof) is the data controller for personal data collected through cbamproof.co.uk. Registered in England and Wales, company number 16859569. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.
1.2What data we collect
Data you provide directly
- Full name, job title, and company name
- Business email address
- EORI number and VAT registration number
- Import data: commodity type, volume, country of origin, place of origin
- Emissions data: emission factor basis, precursor details
- Declaration confirmation and timestamp
Data generated automatically
- CBAM liability calculations, Carbon Price Relief deductions, and emissions intensity figures
- Report ID, report URL, and report access timestamps
- Monitoring period and basis (import year or production year)
- IP address and browser type (server logs, retained 90 days)
1.3Why we process your data and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|
| Generate your CBAM liability estimate and CPR calculation | Contract performance (Art. 6(1)(b)) |
| Deliver your CBAM compliance report and supplier risk assessment | Contract performance (Art. 6(1)(b)) |
| Retain CBAM compliance records for the statutory 6-year period (Reg. 16) | Legal obligation (Art. 6(1)(c)) |
| Send follow-up communications about your CBAM readiness | Legitimate interests (Art. 6(1)(f)) |
| Improve the platform and fix errors | Legitimate interests (Art. 6(1)(f)) |
1.4Who we share your data with
We use the following third-party processors, all bound by data processing agreements:
- Supabase Inc. — cloud database (EU region servers)
- Anthropic PBC — AI model (Claude) for personalised video script generation
- HeyGen Inc. — AI video generation platform
- n8n GmbH — workflow automation
- SendGrid / Postmark — transactional email delivery
We do not sell your personal data. We do not share your data with HMRC unless required by law.
1.5How long we keep your data
- Compliance report data: 6 years from report date (Reg. 16, CBAM Regulations 2026)
- Public report URL: 14 days from generation (data retained; URL expires)
- Marketing communications data: until you unsubscribe or request deletion
- Server logs: 90 days
1.6Your rights under UK GDPR
- Access — request a copy of the personal data we hold
- Rectification — ask us to correct inaccurate data
- Erasure — request deletion (subject to Reg. 16 retention obligations)
- Restriction — ask us to restrict processing during a complaint
- Portability — receive your data in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — where processing is consent-based
Contact: legal@cbamproof.co.uk. We respond within one calendar month. You may also complain to the ICO at ico.org.uk.
1.7Cookies
CBAM Proof uses only strictly necessary cookies. We do not use advertising, analytics, or third-party tracking cookies. See our Cookie Policy for full details.
1.8Changes to this policy
Material changes will be notified to registered users by email. Current version always available at cbamproof.co.uk/privacy. Effective from 9 April 2026.