Legal

Privacy policy

This page is a structural placeholder, not a finished policy. Nothing below is legal text — each section marks what a complete policy needs to say, so it doesn't get published half done.

Not yet published. Every item below is a TODO(legal) — replace with reviewed text before this page is linked from anywhere but this build.

What we collect

TODO(legal): List every field actually collected: the /contact form (name, work email, company, sector, regulation, optional message) and any data the calculator sends (currently none — see /tools/cbam-calculator, all calculation happens in the browser).

Why we collect it

TODO(legal): State the purpose limitation clearly: replying to assessment requests. No marketing list opt-in exists on this site yet — if that changes, this section and the form need an explicit consent checkbox.

Legal basis and DPDP Act, 2023

TODO(legal): This is an Indian company processing Indian (and possibly EU) visitors' personal data. Have counsel confirm the legal basis under India's Digital Personal Data Protection Act, 2023, and whether GDPR applies to any EU-based visitors, before this goes live.

Third parties

TODO(legal): Disclose the /contact form backend (Formspree) by name once it's wired up, and any analytics vendor if one is ever added — the build brief for this site currently prohibits analytics without explicit sign-off.

Retention and deletion

TODO(legal): Define how long assessment-request submissions are kept and how someone requests deletion.

Contact for privacy requests

TODO(legal): Add a real email address or DPO contact once one is designated.