Privacy notice for the CBAM check

Last updated 20 October 2026

Who is responsible

Cnxion Customs and Logistics AB, org. no. 559468-7641, Bräcke Ödsmål 2, 457 41 Fjällbacka, Sweden, is responsible for the personal data described here. Contact us about privacy at support@cnxion.io.

What we collect

• The details you enter in the form: name, work email address, company, job title (if you give it) and country.
• Your answers to the questions about your company's imports, the goods and their yearly volumes, where they are produced, and your CBAM preparation.
• Whether you agreed to receive marketing emails, with the wording you agreed to and when.
• Technical data needed to protect the form against abuse: your IP address and the result of the security check.

Why we use it, and on what legal basis

• To send you the checklist you asked for and record that you asked for it. Legal basis: steps taken at your request (GDPR article 6(1)(b)).
• To follow up on your request, for example by contacting you about CBAM compliance and how CNXION can help. Legal basis: our legitimate interest in following up on a business enquiry (article 6(1)(f)). You can object at any time.
• To send you marketing emails, only if you ticked the consent box. Legal basis: your consent (article 6(1)(a)). You can withdraw it at any time through the unsubscribe link in each email.
• To protect the form against spam and abuse. Legal basis: our legitimate interest in keeping the service secure (article 6(1)(f)).

Who processes the data for us

• Microsoft (Azure): hosting of this website and our server, in the Netherlands.
• Twilio SendGrid: sending the checklist email.
• Cloudflare (Turnstile): checking that the form is filled in by a person, not a bot.
• HubSpot: our customer relationship management system, where your request is stored, in Germany.
• Datadog: technical logs of our server, used to find and fix errors, stored in Germany. They contain no personal data, with two exceptions: the IP address of a visitor who sends too many requests in a short time, and, when your request could not be completed, the details you entered, so that we can still complete it.

These providers process the data on our behalf under data processing agreements. Microsoft, HubSpot and Datadog store it in the EU, but their US parent companies may access some of it from the United States, for example for support. Twilio SendGrid and Cloudflare may process it in the United States. All five US companies are certified under the EU–US Data Privacy Framework, and their agreements also include the European Commission's standard contractual clauses, which apply if the Framework cannot be used.

How long we keep it

• Your request and answers: up to 12 months after your last contact with us, unless you become a customer or give consent to marketing.
• Marketing consent: until you withdraw it.
• Technical security data and server logs: up to 90 days.

Cookies and browser storage

This website does not set cookies and does not use tracking or analytics.

While you take the CBAM check, your answers and the question you are on are kept in your browser's session storage, so reloading the page does not lose them. This is needed for the check you asked for, so it does not require your consent. Your name and email address are never stored this way. The stored answers are deleted when you close the tab, and as soon as you have requested your checklist.

The Cloudflare security check is loaded on the CBAM check page, so Cloudflare receives your IP address when you open that page. When the contact form is shown, it checks that you are a person, using your IP address, a technical fingerprint of your browser's secure connection, your browser's user agent, and our site key and web address. It stores one value, cf.turnstile.u, in your browser's local storage under Cloudflare's own domain (challenges.cloudflare.com); it sets no cookies. This is strictly necessary to protect the form, so it does not require your consent. Cloudflare also uses these signals, as an independent controller, to improve its bot detection; see Cloudflare's Turnstile privacy addendum.

Your rights

You have the right to access your personal data and to have it corrected or deleted. You can also ask us to restrict how we use it, ask for a copy in a portable format, and object to our use of it. You can always object to direct marketing, and we will then stop. To use your rights, email support@cnxion.io.

If you think we handle your data incorrectly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or to the data protection authority where you live or work.