First CBAM declaration for 2026 imports is due 30 September 2027. Is your supplier data ready? →
CBAMWorks

Legal

Data Processing Agreement

Last updated: 2026-10-19

Parties

This DPA forms part of the agreement between LowerPlane Technologies Private Limited ("Processor", operating CBAMWorks) and the customer ("Controller") identified in the signed order form or the account registration.

Subject matter and duration

The Processor processes personal data on the Controller's instructions to deliver the CBAMWorks service. This DPA applies for the duration of the main services agreement and survives termination for the time needed to return or delete the personal data.

Nature and purpose of processing

  • Hosting the Controller's workspace and data.
  • Receiving and storing supplier contact data and operational records.
  • Running the EU-method emissions calculation engine.
  • Generating declaration-ready exports.
  • Sending supplier invites via email and WhatsApp.
  • Providing customer support.

Categories of data subjects

  • Controller's employees and authorised users of the workspace.
  • Supplier contact persons (name, role, email, phone).
  • Individuals named in supplier operational records (e.g. plant managers).
  • Verifiers and auditors granted read-only access.

Categories of personal data

  • Identification data (name, work email, phone, workspace role).
  • Communication data (support messages, invitation reminders).
  • Operational data linked to named individuals (e.g. operator contact on a monitoring plan).
  • Billing contact and VAT ID.

Processor obligations

The Processor:

  • Processes personal data only on the Controller's documented instructions.
  • Keeps personal data confidential and limits access to authorised personnel.
  • Implements the technical and organisational measures described in Annex A below.
  • Assists the Controller in responding to data-subject requests and in meeting its Article 32–36 obligations.
  • Notifies the Controller of a personal data breach without undue delay and in any case within 72 hours of becoming aware.
  • Returns or deletes personal data at the end of the services, except where law requires longer retention.
  • Makes available information necessary to demonstrate compliance and allows for audits per the clause below.

Sub-processors

The Controller authorises the Processor to engage the sub-processors listed on the sub-processors page. Changes are notified to the Controller by email at least 30 days in advance. The Controller may object to a change on reasonable grounds; if we cannot resolve the objection, either party may terminate the main agreement without penalty.

International transfers

Where personal data is transferred outside the EEA, the parties rely on the EU Standard Contractual Clauses (Decision (EU) 2021/914) and, where applicable, UK Addendum and Swiss amendments. SCCs between the Processor and each sub-processor are available on request.

Audits

The Controller may, once per year on 30 days' notice, request a documentation-based audit (SOC-2-style report when available, filled-out security questionnaire, or written answers to specific control questions). Physical on-site audits are scheduled only where remote means are insufficient and are at the Controller's cost.

Deletion or return

On written request at termination, the Processor will either return or delete all personal data within 30 days, except for backups retained for up to 14 days and anything the Processor is legally required to retain (e.g. billing records).

Liability

Liability under this DPA is subject to the limits set out in the main services agreement, except where applicable data-protection law provides otherwise.

Annex A — Technical and organisational measures

See the security page for the live summary. The key points:

  • Access control — Role-based access per tenant; MFA for staff accounts; least-privilege principle; access review every 90 days.
  • Audit log — Append-only; captures who/when/what for every state change.
  • Encryption — TLS 1.3 in transit; AES-256 at rest for databases and object storage; secrets rotated per environment.
  • Isolation — Row-level tenancy enforced in the data access layer; cross-tenant tests in CI.
  • Supply chain — Lockfiles committed; dependency vulnerability monitoring.
  • Backups — Nightly, encrypted, 14-day retention, off-site sync, periodic restore drills.
  • Incident response — Documented runbook; 72-hour notification SLA.
  • Staff training — Security + data-protection training on onboarding and annually.

Signature

When you sign the main services agreement with CBAMWorks, you are deemed to have accepted this DPA. A countersigned PDF version is available on request — privacy@cbamworks.com.