UK GDPR Data Processing Notice

2.1Data controller details

2.2Categories of personal data processed

• Identity data: name, job title
• Contact data: business email address
• Business data: company name, EORI number, VAT number
• Commercial data: import volumes, commodity types, country of origin
• Technical compliance data: emissions intensity values, CPR calculations, monitoring period records
• Behavioural data: platform usage, report access timestamps
• Payment data: billing name and email address processed by our payment processor, Stripe — CBAM Proof does not store card details

2.3Special category data

CBAM Proof does not intentionally collect special category data (Article 9 UK GDPR). Please do not submit any such data.

2.3aCommercially sensitive data that is not personal data

Under a paid engagement, you or your suppliers may share commercial information about overseas mills or installations — production figures, emissions data, supplier identities. This is generally not "personal data" for UK GDPR purposes unless it identifies a specific individual, and so is not covered by Articles 13/14 in the way this notice describes below. It's protected instead as confidential commercial information under the terms of your engagement — see our Privacy Policy, section 1.4b for how this is handled.

2.4International transfers

• Google LLC (USA) — EU Standard Contractual Clauses (Modules 2 and 3) together with the UK International Data Transfer Addendum, per Google's published Data Processing Addendum
• Stripe, Inc. (USA) — covered by Stripe's own Data Processing Agreement, which incorporates the same UK-approved transfer mechanism
• Supabase Inc. (USA / EU hosting) — EU region hosting; Standard Contractual Clauses apply

We review these safeguards periodically and will update this section if a provider's transfer mechanism changes.

2.5Automated decision-making

CBAM Proof uses automated calculation to generate CBAM liability estimates following the statutory methodology in Regulation 5 of the CBAM Regulations 2026. These are informational estimates only — not binding HMRC determinations.

2.6Data minimisation

EORI and VAT numbers are collected solely for importer identification per Regulation 2 of the CBAM Administrative Provisions Regulations 2026. Identity data is required only for the paid Readiness Audit — the free calculator may be used anonymously.