Privacy Notice

CBAM Platform


We thank you for using our web application the CBAM platform. To ensure that you feel safe and comfortable when using the CBAM platform, we would like to inform you about how we handle (process) your personal data. Personal data is all data that can be related to you personally, e.g. your name or your e-mail address.


       1) Controller

Controller pursuant to Art. 4 No. 7 of the General Data Protection Regulation (GDPR) and other applicable data protection laws is


Gallehr Sustainable Risk Management GmbH („we”)

Hauptstraße 4361184 KarbenDeutschland

Tel.: +49 (0)6039 9263686

E-Mail: kontakt@gallehr.deWebsite: www.gallehr.com


      2) Log files

Every time you visit the CBAM Platform, our system automatically collects the following data and information from your device:


  1. Your IP address
  2. Referrer (previously visited website)
  3. Requested website
  4. Browser type and version used
  5. Operation system of your device
  6. Date and time of the request
  7. Internet service provider of the accessing device


CBAM platform needs to store your IP address temporarily to enable the requested website to be delivered to your device. To do this, your IP address must be stored for the duration of your session.The other data is stored in the log files to ensure that our website is functioning properly. We also use the data to optimise the website and to ensure the security of our IT systems.The legal basis for the processing of data in the log files is Art. 6 (1) (f) GDPR and Section 25 (2) of the German Telecommunications-Digital-Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz – TDDDG).The data in log files is deleted after each session.


      3) Cookies and other technologies


On the CBAM platform, we only use one technical necessary session cookie to keep track, if you are logged in into your account.This session cookie is stored on your computer during your web session and is automatically deleted when you close your browser – the cookie stores an anonymous session ID allowing you to browse a website without having to log in to each page but it does not collect any information from your device.The legal basis for using this cookie is Art. 25 (2) TDDDG.



      4) CBAM user account and guest account

A user or guest account is required to use the CBAM platform.We provide user accounts to our customers. With this account, customers are able to access the CBAM platform to collect, query and document data for reporting in accordance with Carbon Border Adjustment Mechanism. The legal basis for using this cookie is Art. 25 (2) TDDDG.In addition, our customers may also grant third parties, i.e. their suppliers and other subcontractors, limited access to the CBAM platform (guest accounts).The following categories of personal data are processed for the provision of user and guest accounts:

  1. First name and surname
  2. Business email address
  3. Business telephone number
  4. Log files (c.f. section 2)

We process this personal data as processor on behalf of our customers as controllers subject to Art. 28 GDPR.


      5) Your rights


If your personal data is processed by us, you have the following rights against us:


Right of access


You have the right to request information about the categories of personal data processed, the purposes of processing, any recipients of the data, and the planned storage period (Art. 15 GDPR);


Right to rectification


You have the right to request the rectification or completion of incorrect or incomplete personal data (Art. 16 GDPR);


Right to erasure


In certain cases, you have the right to request the deletion of personal data in accordance with Art. 17 GDPR – in particular if the data is no longer required for the intended purpose or is being processed unlawfully, or if you have withdrawn your consent or objected the processing;


Right to restriction of processing


Under certain conditions, you have the right to request the restriction of personal data if deletion is not possible or the obligation to delete is disputed (Art. 18 GDPR);


Right to withdraw consent


You have the right to withdraw consent at any time with effect for the future (Art. 7 (3) GDPR);


Right to object


You have the right to object to processing that is based on our legitimate interest for reasons arising from your particular situation. In addition, you can object to the processing of your personal data for advertising and data analysis purposes at any time without providing a reason (Art. 21 (1) GDPR).


Right to data portability


You have the right to data portability, i.e. you can receive certain data you have provided to us in a commonly used and machine-readable format, such as CSV, and, if necessary, transmit it to others (subject to Art. 20 GDPR).


Right to lodge a complaint


If you believe that the processing of your data violates data protection law or that your data protection rights have been violated in any other way, you can also complain to a data protection supervisory authority, such as the one responsible for us:


Hessischer Beauftragte für Datenschutz und Informationsfreiheit

Gustav-Stresemann-Ring 16

5189 Wiesbaden

Tel.: 0611-1408 0

E-Mail: poststelle@datenschutz.hessen.de