Privacy Policy

This policy explains how Oak Sustainability Limited (“Censatim”, “we”) handles personal data when you use censatim.com, in accordance with UK GDPR and the Data Protection Act 2018. We are the data controller. Contact: support@censatim.com.

1. What we collect

• Assessment inputs: the descriptions you type, your answers to assessment questions, your firm type and use case, and the assessment-relevant facts extracted from documents you upload.
• Uploaded documents: processed transiently to extract relevant facts; the extracts (not the raw files) are retained with the assessment record.
• Contact details: your email address when you unlock a report, sign in, or contact us.
• Account data: if you create an account, your email and your saved assessments.
• Payment data: when you purchase an assessment, payment is handled by Stripe. Your card details are collected by Stripe directly and never touch our servers; we receive confirmation of payment and a reference, not your card number.
• Technical data: IP address (used for rate limiting and abuse prevention) and privacy-friendly, cookieless analytics (page views and product events). We do not use tracking cookies and therefore do not show a cookie banner; the only cookies set are those strictly necessary for signing in.

Please do not include unnecessary personal data (for example, data about identifiable individuals) in descriptions or documents; the service assesses assets and activities, not people.

2. Why we process it (lawful bases)

• To provide the service (run assessments, deliver reports, operate accounts): performance of a contract.
• To operate and protect the service (rate limiting, security, debugging, improving assessment quality): legitimate interests.
• To respond to you and follow up on assessments (including our internal record of completed assessments): legitimate interests.
• Marketing (e.g. a newsletter, if you opt in): consent, withdrawable at any time.

3. AI processing

Assessments are generated from your inputs and Censatim’s EU Taxonomy criteria database, using large language models provided by Anthropic via API, orchestrated by Censatim’s assessment engine built specifically for EU Taxonomy interpretation. Your inputs are sent to Anthropic solely to generate your assessment. Under our API arrangement, inputs and outputs are not used to train Anthropic’s models.

4. Who processes data for us (sub-processors)

Where processing occurs outside the UK/EEA, it is safeguarded by appropriate transfer mechanisms (such as standard contractual clauses and, where applicable, the UK–US Data Bridge).

5. Retention

Assessment records (inputs, extracts, results, and any email you provide) are retained while useful for providing the service, supporting you, and improving assessment quality, and deleted or anonymised when no longer needed. Account data is retained while your account is active. You can request deletion at any time (section 6).

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability, and objection under UK GDPR. To exercise them, email support@censatim.com; we respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

7. Changes

We will post any changes to this policy on this page with an updated date.