Privacy Policy

This policy explains how Oak Sustainability Limited (“Censatim”, “we”) handles personal data when you use censatim.com, in accordance with UK GDPR and the Data Protection Act 2018. We are the data controller. Contact: support@censatim.com.

1. What we collect

• Assessment inputs: the descriptions you type, your answers to assessment questions, your firm type and use case, and the assessment-relevant facts extracted from documents you upload.
• Uploaded documents: processed transiently to extract relevant facts; the extracts (not the raw files) are retained with the assessment record.
• Contact details: your email address, which we ask for when you start an assessment so we can send you your results and a link to return to them, and also when you sign in or contact us.
• Marketing preference: whether you ticked the optional box to receive occasional updates, and when. Leaving it unticked means you hear from us only about your own assessments.
• Publication permission: whether you gave express permission for your report to be published on our site as a worked example. This box is unticked by default and we never publish without it.
• Account data: if you create an account, your email and your saved assessments.
• Payment data: when you purchase an assessment, payment is handled by Stripe. Your card details are collected by Stripe directly and never touch our servers; we receive confirmation of payment and a reference, not your card number.
• Technical data: IP address (used for rate limiting and abuse prevention) and privacy-friendly, cookieless analytics (page views and product events). We do not use tracking cookies and therefore do not show a cookie banner; the only cookies set are those strictly necessary for signing in.

Please do not include unnecessary personal data (for example, data about identifiable individuals) in descriptions or documents; the service assesses assets and activities, not people.

2. Why we process it (lawful bases)

• To provide the service (run assessments, deliver reports, operate accounts): performance of a contract.
• To operate and protect the service (rate limiting, security, debugging, improving assessment quality): legitimate interests.
• To respond to you and follow up on assessments (including our internal record of completed assessments): legitimate interests.
• Marketing (occasional updates, only if you tick the box): consent, withdrawable at any time by emailing us or using the unsubscribe link. We record the fact and time of your consent.
• Publishing a report as a worked example: your express, separately given permission, withdrawable at any time.

3. AI processing

Assessments are generated from your inputs and Censatim’s EU Taxonomy criteria database, using large language models provided by Anthropic via API, orchestrated by Censatim’s assessment engine built specifically for EU Taxonomy interpretation. Your inputs are sent to Anthropic solely to generate your assessment. Under our API arrangement, inputs and outputs are not used to train Anthropic’s models.

4. Who processes data for us (sub-processors)

Where processing occurs outside the UK/EEA, it is safeguarded by appropriate transfer mechanisms (such as standard contractual clauses and, where applicable, the UK–US Data Bridge).

5. Retention

Records of free and unpaid assessments (inputs, extracts, results, and the email address you provide) are retained for 24 months from your last activity on that assessment, then deleted or anonymised. Records of paid assessments are retained for six years from the date of assessment, so that a purchased report can be retrieved as issued throughout a full reporting cycle, the accuracy commitment can be honoured, and UK tax and company law requirements are met. Account data is retained while your account is active. Marketing consents are kept until you withdraw them, plus a short period afterwards as evidence that the withdrawal was actioned. You can request deletion at any time (section 6).

6. Your rights

You have the rights of access, rectification, erasure, restriction, portability, and objection under UK GDPR. To exercise them, email support@censatim.com; we respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).

7. Changes

We will post any changes to this policy on this page with an updated date.