PRIVACY AND DATA
Privacy notice
How we handle website enquiries and discovery appointments.
Updated 7 October 2026. This notice covers the product information website, email enquiries and the on-site discovery booking service. Any future application or pilot will have separate data arrangements.
Who is responsible for your information?
PRISM DIGITAL SOLUTIONS LTD is the controller for website enquiries. Registered in England and Wales, company number 17485973. Registered office: 51 Perrins Gardens, Coventry, CV6 7PS, England.
For privacy questions or requests, email sales@cbamorbit.com with “Privacy request” in the subject, or write to the registered office. This is our existing enquiry mailbox, not a separate privacy service.
Information we receive
If you email us, we receive your email address, message, email metadata and any name, organisation, contact details or attachments you choose to provide. The website link opens your email application; clicking it does not send a message or submit a website form. Providing enquiry details is voluntary, but we may be unable to respond without a return address and enough information about your question.
Please do not send customs records, supplier files or sensitive personal information in an initial enquiry. Contact us first to agree a suitable channel.
The website hosting provider, Vercel, may process technical request and security information, such as IP addresses, browser details, requested pages and timestamps, to deliver and protect the website. The site includes an on-site discovery booking form and a server-side booking service. It has no optional analytics, advertising scripts or marketing signup. The protected preview also uses Vercel authentication, which is separate from a CBAM Orbit application account.
Discovery calls — booking arrangements
The booking form sends your details when you submit an appointment request. If online booking is temporarily unavailable, you can arrange a call by email.
When you book, our website sends your name, work email, company, importer or adviser selection, brief data-challenge question and chosen appointment time through our Vercel-hosted booking service to Zoho Bookings. Our on-site form does not request a phone number. Do not include customs records, supplier files or sensitive personal information.
Zoho Calendar will manage availability and the appointment; Zoho Meeting will provide the online meeting; email services will deliver confirmations and appointment changes. Booking answers may also appear in the meeting agenda, so please keep your question brief and non-confidential. Our purpose is to arrange and respond to your enquiry, using the legitimate interests described below. Booking will not create a SaaS account or subscribe you to marketing.
We use Upstash Redis to help prevent duplicate appointments, limit abuse and temporarily store booking confirmations. The configured production database is in London. The application stores keyed identifiers derived from email/appointment details and IP addresses, encrypted confirmation references with appointment dates and times, and short-lived availability and operational records. It does not store the full enquiry text, name or company in this database. Keyed identifiers are pseudonymous, not anonymous.
The application sets booking-attempt and confirmation records to expire after seven days, IP-based abuse counters after ten minutes, and availability cache entries after thirty seconds. Operational quota records have a two-day expiry renewed when used. These application expiry settings are distinct from provider logs, recovery copies and backups; they do not establish immediate deletion from all provider systems. Upstash's published data processing addendum provides for UK transfer safeguards. Expired or deleted application records may remain in provider backups pending their normal deletion cycle, with access and use restricted under that addendum; legal retention exceptions may apply. Upstash states that its infrastructure disaster-recovery snapshots rotate within 24 hours. Customer daily backups are disabled and no customer snapshots were listed when checked on 7 October 2026. These statements do not set a deletion deadline for separate account, billing or security records.
Our retention policy is the same maximum of 12 months after the last substantive contact for enquiries that do not become customer relationships, with earlier deletion when no longer needed. The founder will review these records monthly across Bookings, Calendar, Meeting and email. Cancelling an appointment does not erase its customer record or email copies. Customer-record deletion has been tested in Bookings. Provider-held recovery, backup and security copies can have different retention periods; the account-termination schedule below does not establish the routine deletion period for Bookings, Calendar or Meeting. No automatic deletion across these services has been verified.
We have selected European session hosting in Zoho Meeting. This setting does not mean that all booking information, support access or other provider processing stays in Europe. Automatic meeting recording, live transcription and automatic transcription of meeting recordings are disabled in our reviewed setup. We do not record discovery calls. Any proposed recording would require a separate notice and review before it starts. You can continue to arrange a call by emailing sales@cbamorbit.com.
Purposes and lawful basis
We use enquiry information to answer questions and discuss whether the developing product may suit your organisation. Our lawful basis is legitimate interests: responding to people who contact us about our business and following up on that discussion. For necessary website delivery, troubleshooting and protection that we determine, our legitimate interest is operating a secure, reliable website. These purposes do not include newsletters, advertising or profiling.
An enquiry does not enrol you in a newsletter, create an application account or guarantee pilot access. Any later marketing programme will be reviewed separately before it starts. We do not use these website enquiries for automated decisions with legal or similarly significant effects.
How long we keep enquiries
For enquiries that do not develop into a customer relationship, we keep information for no more than 12 months after the last substantive contact, and delete it earlier when no longer needed. The founder is responsible for reviewing the enquiry mailbox monthly and deleting records in line with this policy. Messages needed for an ongoing discussion, a dispute or a legal obligation require a documented reason and review date; they should not be kept indefinitely. Customer records would be covered by separate agreed arrangements.
Our Zoho Mail setting deletes messages from Spam and Trash after 30 days. Zoho's Mail deletion policy describes a further 30-day recovery period after an email is deleted from Trash. This is separate from our enquiry retention period and from the account-termination schedule. Under our Zoho data processing agreement, following termination or expiry of the service agreement, personal data is deleted from primary servers at the next routine cleanup cycle, which occurs every six months; deletion from backups follows three months after primary-server deletion. This service-termination schedule is not the schedule for routine deletion of individual emails. Vercel's privacy notice bases retention of its own personal-data records on the time needed to provide services, meet legal obligations, resolve disputes, enforce agreements and address legitimate business needs. Data is deleted or anonymised when no longer required; backup deletion can be delayed with data kept protected. Runtime-log visibility in a dashboard is not a promise that all infrastructure or security copies have been deleted.
Providers, recipients and international processing
Enquiry email is handled by Zoho Mail using our EU account; the website and booking service are hosted on Vercel, and Upstash supplies the booking support database described above. Zoho Bookings, Calendar and Meeting support discovery appointments. Access is intended for the founder and authorised personnel who need it to respond or administer these services. We do not sell enquiry information. Information may also need to be disclosed where required by law.
Our UK data processing agreement with Zoho Corporation Limited names PRISM DIGITAL SOLUTIONS LTD as customer. Vercel's published data processing addendum covers processor handling for Pro customers; Vercel also describes its own controller role for account and service-generated personal data in its privacy notice. Upstash Inc. provides the Redis service; its published terms incorporate a data processing addendum for processor handling, separate from its own account and security purposes.
An EU email account does not mean that all processing stays in the UK or EU. Zoho describes possible technical-support access by its Indian entity, subject to contractual safeguards and supplementary measures. Vercel Inc. describes primary processing facilities in the United States and processing in other countries where it or its providers operate; its data processing addendum includes UK transfer provisions. Upstash's London database setting identifies the configured storage region; its published addendum permits international processing where needed and includes EU Standard Contractual Clauses with UK transfer provisions. Our providers may use infrastructure, security and support subcontractors. A provider's complete subprocessor list can also cover optional products we do not use. You may ask us for information about the relevant safeguards using the privacy contact above.
Zoho privacy policy · Zoho privacy FAQ · Vercel privacy notice · Vercel data processing addendum · Upstash data processing addendum
Your rights
Depending on the circumstances, you can request access to your personal information, correction, erasure or restriction of processing. Portability may apply to certain automated processing based on consent or contract. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
We may need proportionate information to verify a requester's identity. You can raise concerns with us or complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
Keeping this notice up to date
We will update this notice if the way we handle website or discovery-call information changes. The date above identifies the current version. Information about cookies and similar technologies is in our cookie notice.