Privacy notice for suppliers’ contact persons

Who is responsible for your data

The company that listed you as its supplier and sent you the request — it is named in the email you received — decides why and how your contact details are used. It is the controller of that data.

Sustys runs the service that sends the request on that company’s behalf, as its processor under a Data Processing Agreement. Questions about your data go to that company; you can also write to privacy@sustys.com; we will pass your request to that company and, if you ask, tell you how to contact it.

If that company has appointed a data protection officer, it can give you that officer’s contact details.

What data is used and where it came from

Your work email address, and your name or your company’s name if the company entered it as the supplier contact.

The message the company wrote to you, and the record of the requests and reminders sent to you and of your answers.

The company, or the customs representative acting for it, entered or imported your contact details.

Why it is used

To ask your company for the embedded-emissions data of the goods it supplied, which the company needs for its EU CBAM declaration, and to remind you until the request is answered.

The company relies on its legitimate interest in obtaining, from its suppliers, the embedded-emissions data it must report in its EU CBAM declaration (GDPR Article 6(1)(f)).

Who receives it

Where the company uses a customs representative to prepare its CBAM declaration, that representative can see your contact details and may send the request on the company’s behalf.

Sustys and the subprocessors listed in our Data Processing Agreement, which deliver the emails and host the service.

How long it is kept

Your contact details are kept for as long as the company keeps you in its supplier records in Sustys; archiving you there does not delete them. What happens when the company stops using Sustys is set out in its agreement with Sustys.

Your rights

You can ask the company for access to your data, to correct or erase it, to restrict its use, and to receive it in a portable form; you can also object (see the next section) and lodge a complaint with a data protection supervisory authority.

Your right to object

You can object at any time to your contact details being used for these requests, on grounds relating to your particular situation, by telling the company or writing to privacy@sustys.com.

Data-request emails — the first request, the automatic reminders and any correction request — carry a link at their foot that records your objection.

The reminders also carry a separate link that stops the reminders for that single request.

Automated decisions

No decision about you is made by automated means on the basis of this data.