Privacy Policy
Last Updated: May 6, 2025
1. Introduction
Customatic ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our Platform.
2. Data We Collect
We collect account information (name, email, company), trade data (customs declarations, HS codes, invoices, shipments), usage data (IP address, browser, logs), and communication records.
3. Legal Basis for Processing
We process personal data based on: (a) performance of a contract, (b) your consent, (c) legal obligations, and (d) legitimate interests such as security and service improvement.
4. How We Use Your Data
We use your data to provide and improve the Platform, process customs declarations, generate ASYCUDA XML, provide customer support, ensure security, and comply with legal obligations.
5. Data Sharing
We share data with trusted service providers (cloud hosting, payment processing, email delivery) who process data on our behalf. We do not sell your personal data. We may disclose data to government authorities when required by law.
6. International Transfers
Data is primarily stored in the United States. For transfers from the EEA or UK, we use Standard Contractual Clauses (SCCs) and other appropriate safeguards.
7. Data Retention
Account data is retained for 7 years after account closure. Trade data is retained for 7 years to meet customs record-keeping requirements. Usage logs are retained for 12-24 months. Backup data is retained for up to 90 days beyond active retention.
8. Your Rights
Depending on your location, you may have the right to access, rectify, erase, restrict processing, object to processing, and request data portability. To exercise these rights, contact us at [email protected].
9. Cookies
We use cookies for authentication, security, and analytics. See our Cookie Policy for details. You can manage cookie preferences through your browser settings.
10. Security
We implement TLS 1.3 encryption in transit, AES-256 encryption at rest, role-based access controls, and regular security assessments. No method of transmission is 100% secure.
11. Data Breaches
In the event of a personal data breach likely to result in a high risk to your rights, we will notify affected users without undue delay and report to supervisory authorities within 72 hours.
12. Children's Privacy
The Platform is not intended for individuals under 16. We do not knowingly collect data from children under 16.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be notified via email and posted on the Platform with 30 days notice.
14. Contact
For privacy questions, contact us at [email protected].
15. California Privacy Rights (CCPA/CPRA)
California residents have the right to know, delete, and correct their personal information. We do not sell personal information or share it for cross-context behavioral advertising.