Who we are
Sustys is operated by [legal entity name], a company incorporated in [EU jurisdiction] under registration number [reg. no.], with its registered office at [registered address] (“Sustys”, “we”, “us”). For the personal data described in this policy, Sustys is the data controller.
You can reach our privacy contact at privacy@sustys.com. Where a Data Protection Officer is appointed, their details are published here: [DPO name & contact].
Pending detail. Items in [brackets] — our legal entity, registered address, and supervisory authority — are confirmed before launch, once incorporation completes. This document will be reviewed by qualified counsel before it takes effect.
What this policy covers
This policy covers the Sustys marketing website (sustys.com) and the Sustys application (app.sustys.com). The marketing site holds no login and sets no advertising trackers; the application is where your CBAM data is processed under the terms below.
It applies to people who visit our site, contact us, sign up, or use Sustys on behalf of an importer, customs consultant, or supplier. Where you use Sustys as a customer’s authorised user, that customer is the controller of the customs data you handle, and Sustys acts as their processor — see our Data Processing Agreement.
The data we process
We keep the categories of data narrow and purpose-bound:
- Account data
- Your name, work email, organisation, and role — to create and secure your account and let you act for your organisation.
- Customs & declaration data
- The customs declaration PDFs you upload and the line-by-line data read from them (CN codes, net mass, country of origin), plus the embedded-emissions figures resolved against them.
- Supplier-provided data
- Where a supplier enters production data, the declared emissions intensity for an installation and good, and which buyers it is shared with.
- Communications
- Messages you send us, and — only if you opt in — your email address for product updates.
- Technical & usage data
- Basic server logs needed to run and secure the service, and — only with your consent — privacy-first, EU-hosted product analytics.
Why we process it, and our legal basis
Under Article 6 GDPR, we rely on:
- Performance of a contract — to provide the service: read your declarations, resolve the embedded carbon, and produce the file you submit.
- Legitimate interests — to secure the service, prevent abuse, keep an audit trail, and improve the product, balanced against your rights.
- Consent — for non-essential analytics cookies and any marketing email; you can withdraw it at any time.
- Legal obligation — where we must retain or disclose data to comply with applicable law.
The CBAM boundary
Sustys processes the embedded emissions of imported CBAM goods, for the purpose of your declaration — and nothing wider. We do not compile company-wide emissions reporting, sell offsets, or provide environmental advice. We hold this boundary by design, and it shapes what data we ask for.
Where it’s processed
Sustys is EU-hosted, in Nuremberg, Germany. Your customs documents and declaration data are processed and stored in the EU, and document OCR runs with an EU-based provider under a zero-retention agreement. Where any sub-processor would involve a transfer outside the EU/EEA, it is covered by an adequacy decision or Standard Contractual Clauses; our intent and default is no non-EU egress of your data.
How long we keep it
We keep account data while your account is active and for a limited period afterwards. Customs documents and declaration data are retained for as long as the customer’s configuration and applicable record-keeping rules require, then deleted or anonymised. Server logs are kept for a short, security-appropriate window. Specific retention periods are set out in the DPA: [retention schedule].
Your rights
Subject to applicable law, you have the right to:
- access the personal data we hold about you, and receive a copy;
- have inaccurate data corrected, and incomplete data completed;
- have your data erased, where there is no overriding legal ground to keep it;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format, where processing is by consent or contract;
- withdraw consent at any time, without affecting prior processing.
To exercise any of these, email privacy@sustys.com. You also have the right to lodge a complaint with your supervisory authority; ours is [lead supervisory authority].
Changes to this policy
We update this policy as the product and the law evolve. We post the revised version here with a new revision date, and announce material changes through the service. CBAM rules shift, and so will the specifics — the principles above will not.
Contact
Questions, requests, or concerns about your data: privacy@sustys.com. For how we secure it, see Security. For our company details, see the Imprint.