Data Processing Agreement

About this agreement

This Data Processing Agreement forms part of the agreement between you (the “Customer”) and Sustys for the use of the service, and governs Sustys’ processing of personal data on your behalf under Article 28 of the General Data Protection Regulation (GDPR). Where it conflicts with the Terms of Service on data protection, this agreement prevails.

Roles

For the personal data you enter or upload, you are the controller and Sustys is the processor. Where you act as a customs consultant or representative for your own clients, you may instead be a processor to them, and Sustys is then your sub-processor; you are responsible for having your clients’ authorisation for that. In all cases each party processes personal data only as set out here and in the Privacy Policy.

Sustys is the controller for its own operational data (security, billing).

Payment is outside this agreement. Dodo Payments sells the licence to you as merchant of record, and the data-processing agreement we accepted with Dodo Payments Inc. states that it "acts as an independent data Controller" for the personal data it handles in that sale. We therefore do not list it as a subprocessor and we do not direct its processing; the same agreement states that it transfers personal data outside the EEA and the UK under the European Commission’s Standard Contractual Clauses. That description of its role is the provider’s own, as stated in that agreement; the purchase data it receives is listed in the Privacy Policy.

Scope of processing

Subject matter: provision of the Sustys CBAM service.

Duration: for as long as you use the service, then until your data is returned or deleted under «Return and erasure», and for any retention you instruct there.

Nature and purpose: processing the customs documents and data you provide, computing the CBAM certificate cost, producing the declaration file and supporting documents, and, on your instructions, sending data requests and reminders to your suppliers’ contact persons.

Data subjects: your authorised users, your suppliers’ contact persons, and individuals named in the documents you upload.

Data categories: account and contact data; customs declaration data; supplier production data. We do not seek special-category data.

Processing on instructions

Sustys processes personal data only on your documented instructions — including the instructions inherent in using the service — unless EU or member-state law requires otherwise, in which case we inform you first where the law permits. Our personnel are bound by confidentiality.

We transfer personal data outside the EU/EEA only on your instructions or as this agreement describes. We tell you immediately if, in our opinion, an instruction infringes data-protection law.

Subprocessors

You authorise Sustys to engage the subprocessors listed below, each bound by data-protection terms no less protective than this agreement. Each processes your data in the European Union, except the OCR provider, whose processing locations and onward transfers are described below. We remain responsible to you for our subprocessors’ performance of their data-protection obligations. The payment provider is not in this table — see Roles.

We give at least 30 days’ notice before a new subprocessor starts processing your data, and you may object on reasonable data-protection grounds: write to legal@sustys.com within the notice period, and we will work with you to find a resolution. Where a change is needed urgently to keep the service secure or available — for example when a provider fails — we may make it with shorter notice, and we inform you as soon as possible.

Our OCR provider receives the documents we send to its EU regional endpoint. According to the provider’s documentation, that endpoint uses data centres in EU and EFTA countries; the provider has not yet confirmed in writing that our OCR calls fall within that regional processing commitment. The provider states that regional processing is subject to limited, safeguarded transfers to its sub-processors outside that region, as described in its Trust Center, and that, depending on the feature used, data can be temporarily transferred outside the European Union, with safeguards such as the European Commission’s Standard Contractual Clauses. Zero data retention is enabled for our organisation; it governs whether the provider keeps the documents after processing, not where they are processed.

Security

Sustys implements appropriate technical and organisational measures, including row-level tenant isolation, EU-resident hosting, encryption in transit and of backups at rest, access controls, an append-only audit trail of changes, human approval before any declaration is final, and document OCR with zero data retention enabled for our organisation; where the OCR provider processes and transfers data is described under Subprocessors. Payment is handled outside that boundary by the merchant of record, as described under Roles.

Uploaded documents are stored in object storage that runs on our own servers, hosted by Netcup in Germany.

International transfers

Sustys hosts your data and runs the service on infrastructure in the EU, subject to the exception for the OCR provider described under Subprocessors; under the provider’s data-processing agreement, its transfers may be made to countries the European Commission recognises as providing adequate protection, on the basis of other adequate safeguards under data-protection law, or under the European Commission’s Standard Contractual Clauses. Any other transfer outside the EU/EEA through a subprocessor is made only as this agreement describes or on your instructions, under an adequacy decision or Standard Contractual Clauses with appropriate supplementary measures.

Assistance and breach notification

Taking account of the nature of processing, Sustys assists you with data-subject requests, data protection impact assessments, and prior consultations. We notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own obligations.

Return and erasure

When you stop using the service — your last licence ends, or the Terms are terminated — you choose whether we return your data to you or delete it. We then delete it, including copies, within a reasonable period, except: the declaration records you instruct us to keep for your own CBAM record-keeping period (Article 7(5) and (6) of Regulation (EU) 2023/956), which we delete when that period ends; the audit trail of changes to your declarations, which we keep to establish or defend legal claims; and data that EU or member-state law requires us to store.

Audits

Sustys makes available the information necessary to demonstrate compliance with Article 28 GDPR and allows for and contributes to audits, including inspections, conducted by you or an auditor you mandate, subject to reasonable confidentiality and scheduling.

Signing this agreement

Customers who need a counter-signed copy of this agreement can request one at legal@sustys.com once our EU entity is registered.

Current subprocessors