‹ Back to home

Privacy policy

This English translation is provided for convenience only. Only the German version is legally binding; in case of any discrepancy, the German version prevails.

As of: 14 October 2026

1. Controller

GambTec, owner Toni Gambino, Meldenweg 18, 12357 Berlin, Germany
E-mail: kontakt@gambtec.de, phone: +49 30 68055975

2. What this is about

CBAMfix is an application for companies that import goods into the EU: it records imports, checks CN codes against the CBAM list of goods and monitors the quantity threshold of the Carbon Border Adjustment Mechanism. The home page and the CN code check are public; everything else can only be used with a user account. The check by CN code runs entirely in your browser – the codes you enter are not transmitted to us. Section 7 applies to the search by description of goods.

3. Server and access logs

The application runs on a server of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in a data centre in Germany. When the application is accessed, the server processes technically necessary data (IP address, time, requested address, browser identifier) and stores it briefly in log files in order to ensure operation and fend off attacks. The legal basis is Art. 6(1)(f) GDPR.

Visitor statistics: On the public pages – not in the application – we count page views with our own method on our server, without cookies and without browser storage. We store the page accessed, the domain of the referring page, the time and a check value. The check value is formed from the IP address and browser identifier with a random key that is newly generated every day; the IP address itself is not stored. The key is overwritten the following day – after that the check value can no longer be attributed to anyone. No data is transmitted to third parties. The purpose is measuring visitor numbers; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement).

4. Cookies and browser storage

Only technically necessary cookies are set:

The browser's local storage only holds the display setting (light/dark mode). There are no advertising or tracking services and no third-party embeds; the visitor statistics (section 3) work without cookies.

5. User account

For the account we store name, e-mail address, the password exclusively as a hash, the time of the last login and – if set up – passkeys (public key) and the encrypted secret of the authenticator app. The legal basis is Art. 6(1)(b) GDPR.

6. Import data and documents

We store the company data (name, EORI number, registered office, type of customs representation, status of CBAM authorisation), the recorded imports (date, CN code, description, net mass, country of origin, supplier, registration number of the customs declaration) and uploaded documents. Documents may contain personal data, such as names of contact persons; you are the controller for this data, and we process it on your behalf under the data processing agreement.

7. AI processing

When you upload a document, the file is transmitted to Anthropic, PBC (USA) and read automatically there. The transfer to the USA is based on the EU Standard Contractual Clauses. The content is not used there to train models. Only the respective document is transmitted; account data is not included. The result consists of suggestions that are only adopted after your review.

Search by description of goods: If you describe goods on the CN code check page or in the application so that matching CN codes can be suggested, we also transmit the text you enter (at most 600 characters) to Anthropic, PBC (USA), based on the EU Standard Contractual Clauses. Only this text is transmitted, not your IP address or account data; it is not used there to train models. We do not store the text, only the time and size of the request in order to limit costs. To prevent misuse, our server keeps your IP address in memory for at most 15 minutes to count requests; it is not stored. Please do not enter any personal data in the description. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a useful service protected against misuse), and Art. 6(1)(b) GDPR within the application.

8. E-mail delivery

Notifications (e.g. warnings about the quantity threshold) and account e-mails are sent via the mail service of Strato AG (Otto-Ostrowski-Str. 7, 10249 Berlin, Germany). Notifications can be switched off in the settings.

9. Subscription and payment

Subscription payments are handled by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). You enter payment data directly with Stripe; we only receive information about the subscription (plan, status, period, Stripe customer number) and do not store any card or account data. The legal basis is Art. 6(1)(b) GDPR.

10. Storage period

Data remains stored as long as the account exists. After the end of the contract, the account and its content are deleted after 90 days at the latest, earlier on request, unless statutory retention obligations prevent this. Please also keep your customs records yourself – CBAMfix does not replace statutory record keeping. Backups are stored encrypted and overwritten on a rolling basis.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). A message to kontakt@gambtec.de is sufficient. You can also lodge a complaint with a supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information.