Privacy Policy

Who we are

For the personal data described in this policy, Sustys is the data controller — except the customs, declaration and supplier data processed in the application for our customers: for that data the customer is the controller and Sustys its processor under the Data Processing Agreement, and requests about it go to the customer. You can reach our privacy contact at privacy@sustys.com.

What this policy covers

This policy covers the Sustys website (sustys.com) and the Sustys application (app.sustys.com). The website holds no login and sets no advertising trackers; the application is where your CBAM data is processed under the terms below.

It applies to people who visit our website, contact us, sign up, or use Sustys on behalf of an importer, customs consultant or supplier. Where you use Sustys as a customer’s authorised user, that customer is the controller of the customs data you handle, and Sustys acts as its processor under the Data Processing Agreement.

What we process

Account data — your name, work email, organisation and role, to create and secure your account and let you act for your organisation.

Pilot application data — what you submit on the website’s pilot application form: whether you apply as an importer or a customs representative, your work email, company, country of establishment, the CBAM goods sectors you import, and any note you choose to add. We use it to assess and answer your application. It is stored with Brevo, our email provider, which sends the confirmation email and, once you confirm, keeps you on our pilot contact list; our web host keeps a copy with a hashed IP address to prevent abuse.

Customs and declaration data — the customs declaration documents you upload and the line-by-line data read from them or entered by you (CN codes, net mass, country of origin), and the results Sustys computes from them.

Supplier-provided data — where a supplier enters production data: the declared emissions intensity for an installation and good, and which buyers it is shared with.

Communications — the messages you send us and, only if you opt in, your email address for product updates.

Technical and usage data — the server logs needed to run and secure the service and, only with your consent, EU-hosted product analytics.

Purchase data — when you buy a licence, what we send to the payment provider is: the buying user’s email address, your organisation’s legal name and country, your VAT number and business name if you gave one, the licence and its price, and two of our own reference numbers for the purchase and the organisation. You then type your billing address on the provider’s page — that goes to it, not through us.

What comes back, and what we store, is the provider’s payment and session identifiers, the identifiers of any refund or dispute, and the link to the invoice it issues. We never receive your card number: the card is entered on the provider’s own page.

Why we process it, and our legal basis

Under Article 6 GDPR, we rely on:

Performance of a contract — to provide the service to you and your organisation, and to grant and deliver the licence you buy through our merchant of record.

Legitimate interests — to secure the service, prevent abuse, keep an audit trail, and improve the product, balanced against your rights.

Consent — for non-essential analytics cookies and product-update emails; you can withdraw it at any time.

Legal obligation — where we must retain or disclose data to comply with applicable law.

For the customs, declaration and supplier data we process for our customers, the legal basis is the customer’s, and we act on its instructions under the Data Processing Agreement.

We do not sell your data.

The CBAM boundary

Sustys processes the embedded emissions of imported CBAM goods, for the purpose of your declaration — and nothing wider. We do not compile company-wide emissions reporting, sell offsets, or provide environmental advice. We hold this boundary by design, and it shapes what data we ask for.

Cookies and analytics

The website and the application set no analytics cookie and record no analytics events until you accept analytics, and analytics never include session replay or advertising trackers. The Cookie Policy lists the cookies we use and how to change your choice.

Where

The Sustys service runs in the European Union. Our subprocessors process data in the EU, except that our OCR provider’s EU regional endpoint uses, according to the provider, data centres in EU and EFTA countries, and the provider may transfer data outside them, as described in the Data Processing Agreement.

Buying a licence is a separate exception. Payment is handled by Dodo Payments, which sells the licence to you as merchant of record. Its data-processing agreement — we accepted it with Dodo Payments Inc. — states that it transfers personal data outside the EEA and the UK, and that the European Commission’s Standard Contractual Clauses are incorporated into that agreement to cover those transfers.

Your customs entries, declarations, uploaded documents and supplier data are never sent to it — only the purchase data listed above.

You can ask for a copy of the Standard Contractual Clauses in the payment provider’s agreement at privacy@sustys.com.

Who we share it with

We share it with the providers that run the service, each for one job: hosting (Germany), optical character recognition on the documents you upload, transactional email, operational logs and alerting, uptime monitoring, and product analytics (events are recorded only if you accept analytics cookies). Each of them processes your data in the EU, except the OCR provider, whose EU regional endpoint uses, according to the provider, data centres in EU and EFTA countries, and which may transfer data outside them; the Data Processing Agreement names each provider with its purpose and describes those transfers.

Hostinger hosts the website, its pilot application form and our email inboxes, in the EU (Lithuania).

Separately from that list, Dodo Payments receives the purchase data described under "What we process". It is not one of our subprocessors: it sells the licence to you in its own name and says in its own data-processing agreement that it acts as an independent data controller for that transaction. What it does with that data is governed by its terms, which are shown to you at checkout.

We disclose data to authorities only where the law requires it.

We do not sell your data, and we do not share it for advertising.

Retention

Operational logs are kept for 14 days by our logging provider. Product analytics, recorded only if you accept analytics, are kept for one year by our analytics provider.

Erasing an account does not erase everything. Erasure pseudonymises the account and leaves the records we need to keep: the audit trail behind a declaration, which we keep to establish and defend legal claims, and the list of addresses that asked never to be emailed again, which only works if it is kept.

Declaration records are kept on the customer’s behalf while it uses the service. When it stops, they are returned to it or deleted, as it chooses under the Data Processing Agreement; if it asks us to keep them, we keep them until the end of its CBAM record-keeping period — the end of the fourth year after the year in which the declaration has been or should have been submitted (Article 7(6) of Regulation (EU) 2023/956) — and then delete them.

The commercial record of a licence purchase — what was bought, when, and for how much — is kept as an accounting record, and survives the erasure of an account for that reason. The payment provider keeps its own records of the sale as an independent controller, under its own retention rules.

Product updates

If you turn on "Product updates" in your settings, we email you occasionally about new features and CBAM changes. We do this only on your consent (GDPR Art. 6(1)(a)) — never by default, and never as a condition of using Sustys.

These emails are sent through Brevo, our email provider, which processes them inside the European Union.

You can withdraw at any time: turn the setting off, or use the unsubscribe link in any of those emails. Withdrawing is as easy as opting in, and it never affects your sign-in links, account security emails, or supplier data requests.

We keep a record of when you opted in and out. That record is what lets us prove your choice was yours (Art. 7(1)), so it outlives the consent itself.

Your rights

Subject to applicable law and to our legal retention duties, you have the right to access the personal data we hold about you and receive a copy; to have inaccurate data corrected and incomplete data completed; to have your data erased where there is no overriding legal ground to keep it; to restrict certain processing; to receive the data you gave us in a machine-readable format and have it sent to another controller, where processing is based on consent or contract; and to withdraw your consent at any time, without affecting the processing that took place before.

Right to object: where we rely on legitimate interests, you can object at any time, on grounds relating to your situation. We then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.

To exercise any of these rights, write to privacy@sustys.com.

You also have the right to lodge a complaint with a data-protection supervisory authority.

Changes to this policy

We update this policy as the product and the law evolve, publish the revised text here, and announce material changes through the service.

Contact

Questions, requests or concerns about your data: privacy@sustys.com.