Privacy Policy

1. Who We Are

Ozzint Ltd (“Ozzint”, “we”, “us”, “our”) is the data controller for personal data processed in connection with your account and your use of the Ozzint Classify platform. We are registered in England and Wales.

This policy explains what personal data we collect, why we collect it, the legal basis for processing, how long we keep it, who we share it with, and your rights under UK GDPR and the Data Protection Act 2018.

If you have questions about this policy or wish to exercise your rights, contact us at privacy@ozzint.com.

2. Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, organisation name, role, and billing contact details provided at registration or during account management.
• Uploaded document content: commercial invoices, packing lists, and other trade documents you submit for processing. These may contain personal data relating to suppliers, buyers, freight contacts, and named individuals.
• Classification and compliance outputs: extracted line items, HS code classifications, duty calculations, sanctions screening results, audit logs, and generated export files produced during pipeline execution.
• Usage and technical data: IP addresses, browser type, access timestamps, and operational telemetry collected in server-side logs to maintain platform security and performance. We do not use browser tracking cookies for analytics.
• Support communications: any personal data you include in emails or messages sent to our support team.

We collect data directly from you when you register or use the Service, and automatically via server-side logs during normal platform operation. We do not purchase or obtain personal data from third-party data brokers.

3. Lawful Basis for Processing

We rely on the following lawful bases under Article 6 UK GDPR:

• Contract (Article 6(1)(b)): Processing your account data and enabling you to use the Service is necessary to perform our contract with you.
• Legal obligation (Article 6(1)(c)): Customs records, classification audit trails, and sanctions screening logs are retained to comply with HMRC record-keeping requirements under the Taxation (Cross-border Trade) Act 2018 and associated customs regulations.
• Legitimate interests (Article 6(1)(f)): We process usage and technical data to maintain platform security, detect fraud, improve classification quality, and support customer accounts. We have conducted a legitimate interests assessment and are satisfied that our interests do not override your rights and freedoms.
• Compliance with a legal obligation (Article 6(1)(c)): We may process data to respond to lawful requests from HMRC, law enforcement agencies, or other regulatory bodies.

4. How We Use Your Data

We use your personal data to:

• Create and manage your account, authenticate your identity, and provide access to the Service.
• Execute the customs compliance pipeline: extract invoice data, classify goods, screen parties, calculate duties, and generate export files.
• Maintain an immutable audit trail of all classification and compliance decisions as required by HMRC customs record-keeping rules.
• Send transactional emails including processing results, account notifications, and security alerts.
• Respond to support requests and investigate reported issues.
• Monitor platform security, detect and prevent misuse, and comply with regulatory obligations.
• Improve classification accuracy using aggregated, de-identified quality metrics. We do not use your Customer Content to train AI models without your explicit written consent.

5. Data Retention

We retain customs records, classification outputs, sanctions screening results, duty calculations, and associated audit logs for up to six years from the date of processing. This retention period is mandated by HMRC under the Taxation (Cross-border Trade) Act 2018, which requires importers and their agents to retain customs records for a minimum of four years, and up to six years for certain categories of record. This is a legal requirement and cannot be shortened by account closure.

Account data (name, email, contact details) is retained for the duration of your active account and for up to two years after account closure, after which it is deleted or anonymised.

Support communications are retained for up to three years.

Server-side access logs are retained for up to 12 months for security and audit purposes, then deleted.

Where applicable law requires a shorter retention period, we will apply the shorter period. We conduct annual reviews of retained data and delete or anonymise records that are no longer required.

6. Subprocessors and Third-Party Sharing

We share personal data with the following categories of subprocessors who process data on our behalf, subject to written data processing agreements:

• Anthropic, PBC (United States): AI model inference for invoice extraction and HS tariff classification. Customer Content is submitted to Anthropic’s Claude API for processing. Anthropic does not use API inputs to train models under its enterprise API terms.
• Supabase, Inc. (United States): PostgreSQL database hosting, authentication, and file storage for invoice documents and compliance outputs.
• Vercel, Inc. (United States): Platform hosting, serverless function execution, and content delivery network.
• Postmark / Wildbit, LLC (United States): Transactional email delivery for processing results, account notifications, and ClearBot email automation.

We do not sell personal data to third parties. We do not share personal data with advertisers or marketing platforms. We may disclose data to public authorities (including HMRC and law enforcement) where required by law or valid legal process.

7. International Data Transfers

All four of our named subprocessors are based in the United States. Transfers of personal data from the United Kingdom to the United States are made under the UK’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable, in accordance with Chapter V UK GDPR and the guidance of the Information Commissioner’s Office. We have completed transfer risk assessments for each subprocessor and are satisfied that appropriate safeguards are in place.

Where a subprocessor participates in the UK-US Data Bridge and has self-certified under that framework, we may additionally rely on the UK adequacy regulations in relation to that transfer.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access (Article 15): You may request a copy of the personal data we hold about you and information about how we process it.
• Right to rectification (Article 16): You may ask us to correct inaccurate or incomplete personal data.
• Right to erasure (Article 17): You may ask us to delete your personal data where there is no lawful reason for us to continue processing it. Note that we are required by law to retain customs records for up to six years and cannot delete these records early.
• Right to restriction (Article 18): You may ask us to restrict processing of your personal data in certain circumstances, for example while accuracy is disputed.
• Right to data portability (Article 20): Where processing is based on your consent or a contract and is carried out by automated means, you may ask us to provide your personal data in a structured, commonly used, machine-readable format.
• Right to object (Article 21): You may object to processing based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Rights related to automated decision-making (Article 22): We do not make decisions about you that produce legal or similarly significant effects using solely automated processing. All compliance outputs are pre-decision guidance subject to human review.

To exercise any of these rights, contact us at privacy@ozzint.com. We will respond within one calendar month. We will not charge a fee for reasonable requests. We may ask you to verify your identity before we can action your request.

9. Cookies

We use essential cookies for session management, authentication, and platform security. We do not use advertising cookies or third-party browser tracking cookies. Full details of the cookies we set are available in our Cookie Policy.

10. Children’s Data

The Service is intended for business use by adults only. We do not knowingly collect personal data from individuals under the age of 18. If you believe we hold such data in error, please contact us at privacy@ozzint.com and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice before the changes take effect. The “Last updated” date at the top of this page indicates when the most recent revision was made. Continued use of the Service after notification of changes constitutes acceptance of the revised policy.

12. How to Contact Us and How to Complain

For any questions about this policy, to exercise your rights, or to raise a data protection concern, contact us at privacy@ozzint.com.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection:

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF